Privacy Policy

1. Who we are

Penelope (searchpenelope.com) is a device registry operated by Randisoft ("Penelope", "we", "us"). For anything in this policy, contact us at info@searchpenelope.com.

2. What we collect

• Account data: your name, email address, and password (stored hashed, never in plain text). Optionally: phone number and organization name.
• Device data: device type, brand, model, IMEI and/or serial number, optional labels, and optional receipt or photo uploads.
• Theft reports: if you flag a device stolen: the date, the reported location, and an optional police report reference.
• Lookup data:when anyone searches the registry: the searched identifier, the searcher's IP address, the time, and, only if the searcher grants browser permission, their approximate location and the street address derived from it.
• Payment data: payments are processed by Paystack. We receive transaction references and payment status. We never see or store your card details.
• Cookies: we use session cookies to keep you signed in. No advertising or tracking cookies.

3. How we use it

• Operating the registry: answering device lookups and displaying theft reports.
• Alerting owners on the Active Protection plan when their reported-stolen device is searched.
• Sending account emails: verification, password reset, and service notices.
• Preventing abuse: rate limiting and fraud detection use IP addresses and search logs.
• Processing subscription payments through Paystack.

We do not sell personal data. We do not use it for advertising.

4. What is public

• The status of a registered device (registered, or reported stolen) is visible to anyone who searches its IMEI or serial number. That visibility is the purpose of the registry, and you consent to it by registering a device.
• If you report a device stolen, the report date, reported location, and police report reference (if provided) are shown to searchers, attributed to you as the registered owner's report.
• Your name and phone number are shown on your stolen device's results only if you have an active Active Protection subscription. This is a feature you choose; you can end it by cancelling the subscription or contacting us.

5. What device owners receive about searchers

When someone searches a device that is reported stolen, the device's owner may receive the searcher's IP address and, if the searcher granted location permission, their approximate location (rounded, roughly 110 meters) and the derived address. This is disclosed at the search box before any search is made. We collect this to help theft victims recover their property.

6. Who processes data for us

We use service providers to run Penelope: cloud hosting and database providers, an email delivery provider, Paystack for payments, Cloudinary for private storage of proof-of-ownership files you choose to upload (receipts and device photos, never publicly accessible), and OpenStreetMap's Nominatim service for converting coordinates to addresses (only coordinates are sent, never your identity). These providers process data on our instructions.

7. Retention

Account and device data are kept while your account exists and deleted on verified request. Search logs are retained for up to 24 months for abuse prevention and theft recovery, then deleted or anonymized. Payment records are kept as required by financial regulations.

8. Your rights

Under the Nigeria Data Protection Act 2023 (and equivalent laws where you live), you can request access to your data, correction, deletion, restriction of processing, or withdraw consent. Email info@searchpenelope.com and we will respond within 30 days. You may also lodge a complaint with the Nigeria Data Protection Commission (NDPC).

9. Security and breaches

Data is encrypted in transit. Passwords are hashed. Access to production data is restricted. If a breach affecting your personal data occurs, we will notify the NDPC within 72 hours of becoming aware and inform affected users without undue delay.

10. Children

Penelope is not directed at children. You must be at least 16 to create an account.

11. Changes

We will post any changes to this policy here and update the effective date. Material changes will be announced by email to account holders.