Privacy Policy
Last updated: 28 July 2026
Juno Inc is a trading name of Juno Labs Limited (RC 9710961), a private company limited by shares registered in Nigeria (“Juno”, “we”, “us”). We build and run ARIA, an AI assistant that answers property buyers for real estate agencies on WhatsApp, Instagram and web chat. This policy explains what personal data moves through ARIA, why, where it goes, how long it is kept, and what you can ask us to do about it. It is written to meet the Nigeria Data Protection Act 2023 (the “Act”) and the Nigeria Data Protection Commission’s General Application and Implementation Directive 2025.
Who is responsible for your data
The Act distinguishes between a data controller, who decides why and how personal data is used, and a data processor, who handles it on the controller’s instructions. Juno is a controller in some circumstances and a processor in others, and the distinction determines who you should contact.
If you are a buyer messaging an agency
If you are a buyer or tenant chatting with an estate agency on WhatsApp, Instagram or a chat window on their site, the agency is the data controller. It is their customer relationship, their listings and their decision to answer you with ARIA. Juno acts as their data processor: we run the software, we hold the conversation on their behalf, and we only do what the agency has engaged us to do. Requests about that conversation are best sent to the agency first. We will help them answer you, and you can also write to us directly using the details under “Contact and complaints” below.
If you are an agency dealing with Juno
For this website, the “Get started” enquiry form, the contact form, the client dashboard we provide to each agency, sign in emails and billing, Juno Labs Limited is the data controller. Those are our own purposes, and this policy is the notice for them.
How we handle buyer conversations
When you message an agency through ARIA, the following passes through our systems.
What ARIA collects
- Your messages. The text you send and the replies ARIA sends back, stored as a conversation history so the assistant can remember the thread and the agency can see what was said.
- Your channel identifier. On WhatsApp this is the phone number you message from. On Instagram it is the page scoped ID Meta provides for your account. On web chat it is a session identifier created in your browser.
- Voice notes. If you send a voice note on WhatsApp and the agency has that feature enabled, the audio is downloaded and transcribed to text, as described under “Voice notes and transcription” below.
- What you are looking for. Location, budget, number of bedrooms, whether you want to rent or buy, and similar details that you mention, extracted from your messages so ARIA can find matching listings.
- Contact details you volunteer. If you give a name or a phone number so the agency can call you back, that is captured as a lead and sent on to the agency.
- A light personalisation summary built from your own past messages in the same conversation, such as areas you have asked about before and budgets you have mentioned, so that you do not have to repeat information you have already given.
ARIA is built for ordinary property enquiries. Please do not send identity documents, bank details, health information or other sensitive personal data through the chat. If you do, it will be retained in the conversation history like any other message, and you can ask for it to be removed.
Why we collect it
To answer your enquiry, find listings that match it, and pass you to the agency’s staff when you want a viewing or a call back. The agency normally relies on your request and its own legitimate interest in responding to enquiries as its lawful basis under section 25 of the Act. The agency, as controller, is responsible for confirming that basis.
Voice notes and transcription
A voice note is fetched from the messaging provider and sent to Google’s Gemini model for transcription. The transcript then becomes the message ARIA answers, and the transcript is stored in the conversation history in the same way a typed message would be. We do not keep our own copy of the audio file after transcription. If a voice note cannot be transcribed, ARIA asks you to type the message instead.
Where an agency’s leads are sent
When ARIA captures a lead, it sends a summary to the agency on whichever of these the agency has configured: their email address, their own Slack channel, and a WhatsApp message to the firm’s line. The summary contains the name and phone number you gave, the message that triggered it, and the search details above. The choice of channels is the agency’s, not ours.
What we do not do
We do not sell personal data, and we do not use buyer conversations to advertise to you. We do not use one agency’s buyer data for another agency: every conversation and lead is stored under that agency’s own identifier and is only readable within it. We do not write message contents, phone numbers, names or email addresses into our application logs, and where a buyer needs to be identified in a log for troubleshooting, the identifier is replaced with a salted one way hash.
Data we collect for our own purposes
- Enquiry form. If you ask us about ARIA for your agency we collect your agency name, your name, your email address, your phone or WhatsApp number, the plan you are interested in, where your listing photographs are held, and any other information you enter in the notes field. We use it to reply to you and to set the service up if you proceed.
- Contact form. The contact form on this site does not send anything to a server. It opens your own email application with a message addressed to us, so the only thing that leaves your device is the email you choose to send.
- Client and operator accounts. Signing in to the ARIA dashboard uses a one time link emailed to you. We store the email addresses allowed to sign in for each agency. We do not store account passwords.
- Billing. Subscription payments are taken through Paystack. Card details are entered on Paystack’s own pages and never reach us. We store the payment reference, the amount, the date and the plan so that we can issue a receipt and record what an agency has paid for.
- Technical data. Ordinary web server and platform logs, and basic rate limiting on our public forms to prevent spam and abuse.
Our lawful bases here are your consent and the steps needed to enter or perform a contract with your agency, plus our legitimate interest in keeping our systems secure. You can withdraw consent at any time.
The companies that process data for us
ARIA relies on services operated by other companies. Each one receives only the data it needs in order to perform its function, and each is bound by its own contract with us. As at the date above, they are:
- Google Cloud. Runs the application and stores conversation histories, leads, listings and agency configuration.
- Google (Gemini). Generates ARIA’s replies and transcribes voice notes. It receives the recent part of the conversation, the matching listing details and the voice note audio.
- OpenAI. The fallback model provider, and the primary one for agencies that choose it. It receives the same conversation text when it is the provider in use.
- Twilio. Carries WhatsApp messages in both directions and temporarily hosts media such as voice notes.
- Meta. Carries Instagram direct messages. Your use of WhatsApp and Instagram is also governed by Meta’s own terms and privacy policy, which we do not control.
- Cloudinary. Hosts listing photographs where an agency uploads them to us instead of linking to their own.
- Resend. Delivers our emails: lead alerts, sign in links, welcome messages, receipts and monthly reports. Some agencies are configured to use their own SMTP mail server instead.
- Paystack. Processes subscription payments from agencies.
- Amazon Web Services and Google Cloud Storage. Hold encrypted off site backups of agency data.
- Slack. Receives lead alerts only where an agency has connected its own Slack channel.
If we change this list in a way that materially affects buyers or agencies, we will update this page and tell the affected agencies.
Where your data is stored, and when it leaves Nigeria
ARIA runs in Google Cloud, in Belgium. The model providers, messaging providers and email provider listed above also operate outside Nigeria. Personal data collected in Nigeria is therefore transferred abroad.
Part VIII of the Act governs those transfers. We rely on section 41(1)(a): each provider is engaged under contractual terms that require it to protect the personal data to a standard consistent with the Act, including confidentiality, security measures, restrictions on further disclosure, and assistance with data subject requests. Where a transfer is needed to answer a buyer who has asked us to answer them, section 43(1)(b) of the Act, covering a transfer necessary to take steps at the data subject’s request, also applies. We keep a record of the basis for each transfer as section 41(2) requires.
We do not rely on any formal adequacy decision by the Nigeria Data Protection Commission in respect of these countries. If the Commission issues one that changes the position, we will update this page.
How long we keep data
- Buyer conversations and leads. Kept for as long as the agency’s account with us is active, because the agency needs its own enquiry history. The agency can ask us to delete a conversation or a lead at any time, and a buyer can ask the agency, or us, to do the same.
- On account closure. When an agency’s account closes, we delete or return its data, including buyer conversations and leads, within 90 days of the account closing, unless a law requires us to keep something longer.
- Backups. We take a daily encrypted snapshot of agency data to off site storage. Snapshots expire automatically after 120 days. A deletion you ask for takes effect immediately in the live system, and takes effect in the backups as those snapshots expire.
- Enquiry forms. Deleted or anonymised within 12 months if the enquiry does not become an account.
- Billing records. Kept for as long as Nigerian tax and company law requires.
- Application logs. Retained by our hosting platform on a rolling basis, and they do not contain message contents or contact details.
Automated processing and AI generated replies
ARIA is an automated system. Its replies are generated by a large language model and are not written by a person, and it also reads your messages automatically to determine what you are looking for and whether to alert the agency’s staff.
Section 37 of the Act gives you the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects for you. ARIA is not designed to make that kind of decision. It does not approve or refuse anyone, price anything, or decide who gets a property. It answers questions, presents listings and refers you to a member of the agency’s staff. Every decision of that kind, whether to call you, whether to show you a property, whether to accept an offer, is made by the agency’s staff.
You can ask to speak to a person at any time, and the agency’s staff can take over the conversation. Model output can be inaccurate. Prices, availability and property details come from the agency’s own listings and should be confirmed with the agency before you act on them.
How we protect your data
All traffic to and from ARIA is encrypted in transit over HTTPS, and data at rest is encrypted by Google Cloud. Every agency’s data is namespaced under its own identifier, and the signed in session is the only thing that determines which agency’s data a request can reach. Inbound messages from Twilio and Meta, and payment events from Paystack, are rejected unless their cryptographic signature is verified.
Dashboard sign in is by one time emailed link, so there are no stored passwords. Session cookies are HttpOnly and SameSite, and are marked Secure on the live service. Forms that change data are protected against cross site request forgery. Application logs are scrubbed of personal data: message bodies, phone numbers, names and email addresses are never written to them, and buyer identifiers are hashed with a salt. We take daily encrypted backups to two independent providers, expiring after 120 days.
No system is perfectly secure. If a breach happens that is likely to put your rights at risk, we will tell the affected agency without undue delay so it can notify the Commission within the 72 hours section 40 of the Act allows, and we will support that notification with the information available to us. Where we are the controller, we will notify the Commission and the affected individuals ourselves.
Your rights over your data
Under Part VI of the Act you can ask to:
- Be told whether we hold personal data about you, and get a copy of it
- Have inaccurate or incomplete data corrected
- Have your data erased
- Restrict or object to how it is being processed
- Withdraw consent you previously gave
- Ask for human involvement rather than being left to an automated process
- Complain to the Nigeria Data Protection Commission
How to exercise them. If your request is about a conversation you had with an estate agency, ask the agency, since they are the controller and they can act on it directly in their dashboard. If you do not know who they are, or you would prefer to contact us directly, email info@junoinc.org and tell us which agency you were messaging and the phone number or account you used. We will pass it to the agency and help them act on it. Where Juno is the controller, we will act on it ourselves. Either way we will respond without undue delay, and we aim to resolve requests within 30 days.
If what you want is deletion specifically, our data deletion instructions set out the steps, what to include so that we can find your conversation, and how long it takes.
We may need to verify your identity before acting on a request, particularly one to delete or export data.
Children
ARIA is intended for adults seeking property. We do not knowingly collect personal data from children. If you believe a child has sent us personal data, contact us and we will remove it.
Cookies
This marketing site does not use advertising or analytics tracking cookies. The ARIA dashboards use a strictly necessary session cookie so that you stay signed in. No other cookies are set.
Contact and complaints
Data protection enquiries should be sent to info@junoinc.org. Please put “Privacy” in the subject line so that it is routed correctly.
If you are not satisfied with how we handle it, you can complain to the Nigeria Data Protection Commission at ndpc.gov.ng.
Changes to this policy
We will update this page when the product or our providers change, and we will move the “last updated” date at the top. Where a change materially affects agencies or buyers, we will tell the agencies directly.
Juno Labs Limited (RC 9710961), trading as Juno Inc, registered in Nigeria.