Privacy Policy

Who we are

Rekoja is run by two companies. Rekoja Ltd, registered in England and Wales, runs the platform. Rekoja Nigeria Limited, registered in Nigeria, runs the service desk in Lagos.

Rekoja Ltd is the controller of your personal information under UK data protection law (UK GDPR). Rekoja Nigeria Limited is the controller under Nigeria's NDPA. Where both companies work on the same case, they act as joint controllers.

What we collect

  • Account details. Your name, email address, and password (stored securely, never in plain text).
  • Assessment answers. What you tell us in the free assessment or study quiz: nationality, visa history, qualifications, finances, and similar, so we can assess your options.
  • Case information and documents. If you open a paid case, the details and documents a real application needs, such as passport details, immigration history, refusal letters, and bank statements. Some of this is special category data, and we protect it accordingly.
  • Payment records. What you bought, when, and for how much. Your card details go directly to Stripe (GBP) or Paystack (NGN); we never see or store full card numbers.
  • Usage data. Pages visited, features used, and errors, with personal details stripped out before they reach our tools.

How we use it

We use your information to run the service, assess your options, prepare your case, take payment, keep the service secure, and meet our legal obligations.

We ask for your consent separately for: marketing email, WhatsApp contact, our staff viewing the documents on your case, and sending a document to our AI provider (asked per document). You can withdraw any consent at any time.

Who we share it with

We use a small number of providers, each under a contract limiting what they can do: Supabase (database and file storage), Vercel (hosting), Stripe and Paystack (payments), Resend (email), Anthropic (AI document reading, only with your per-document consent), Upstash (abuse prevention), and PostHog and Sentry (product analytics and error monitoring, with personal details stripped out).

We do not sell your personal information, and we do not share it with anyone for their own marketing.

How long we keep it

Case documents are kept for 6 years after the case closes, then permanently deleted. Account information is kept while your account is active. Records of consent given and withdrawn are kept so we can always show what was agreed and when.

Your rights

You can ask to see the information we hold, correct it, delete it, restrict or object to how we use it, receive it in a portable format, and withdraw any consent.

Data export and account erasure are self-serve in Settings, then Security, protected by your password. If you have an open case, erasure waits until the case is closed or cancelled. Records we are required to keep are anonymised rather than deleted.

Transfers between the UK and Nigeria

Our two companies work together on cases, so information sometimes moves between the UK and Nigeria, with safeguards so it gets the same level of protection wherever it is handled.

Cookies

On the website, analytics cookies run only with your consent, and we never use advertising cookies. In the app, we use essential cookies to keep you signed in.

Security

Documents are stored privately with strict access control and are only opened through short-lived signed links. Actions on your case are recorded in a log that cannot be edited after the fact.

Complaints

Contact us first and we will try to put it right. You can also complain directly to the Information Commissioner's Office in the UK (ico.org.uk) or the Nigeria Data Protection Commission (ndpc.gov.ng).

Changes

We will update this page, and the date below, when what we do with your information changes.

Contact

Email desk@rekoja.com, or use the complaints page.

Last updated: 8 August 2026. Rekoja Ltd, registered in England and Wales. Rekoja Nigeria Limited, registered in Nigeria (CAC).