Privacy Policy
Effective 9 October 2026
1. Who we are and what this covers
MERLBase is a platform for field data and impact tracking that organisations use to plan development projects, collect field data, review it and report on results. It is run by DevX Strategy (“we”, “us”), Suite 415 MKK Plaza, Jabi, Abuja, Nigeria.
This policy explains how personal data is handled for three groups of people:
- Account holders: staff of an organisation that uses MERLBase.
- Respondents: people who answer a form that an organisation has shared with them by link.
- Visitors: people who browse our website.
Our role depends on the data
- For account details (your name, email and so on) we decide how the data is used, so we are the controller.
- For everything an organisation puts into the platform, including its projects, field data, photos, locations and the answers people give on its forms, the organisation decides why and how the data is used. It is the controller, and we are its processor, acting on its instructions. If you gave information to an organisation, please contact that organisation first about your data.
2. What we collect
Account holders
- Name, email address, password (stored in scrambled form, never in plain text) and optional phone number.
- Your role in the organisation, and an optional profile photo and short bio.
- Activity inside the product, such as the projects you open and the submissions you approve or reject.
Data organisations put into the platform
- Projects, objectives and indicators, monitoring forms, and the answers collected with them.
- Field visits, including the GPS location captured when a visit is recorded, and named locations.
- Photos attached as evidence to a visit. They are kept in private storage and shown only through short-lived links to people in the same organisation.
- Reports, corrective actions and review notes.
An organisation can design a form to collect almost anything. We do not decide what it asks. The organisation is responsible for collecting only what it needs and for having a lawful basis to collect it.
Respondents to a shared form link
- The answers you give, and the time you submitted them.
- Whether you ticked the consent box, and the exact consent wording you saw, if the organisation added one.
- A one-way scrambled code made from your connection’s IP address, used only to stop one source sending large numbers of submissions. We do not store your actual IP address with your response and cannot turn the code back into one.
Visitors
- Our hosting provider keeps standard server logs (IP address, time, pages requested, errors and browser type) for security and troubleshooting.
- If you email us, we keep your message and our reply.
3. How we use it, and why
- To provide the service: create accounts, run projects, store and show data, generate reports and exports. Basis: performing our agreement with the organisation and, for staff, our legitimate interest in running the service.
- To keep the service secure: prevent spam and abuse, investigate problems and protect accounts. Basis: legitimate interest.
- To send service emails: confirm your address, reset passwords and send important notices. We do not send marketing email without your agreement. Basis: performing our agreement.
- To comply with the law and respond to lawful requests. Basis: legal obligation.
- For respondents: to deliver your answers to the organisation that asked for them. Basis: the organisation’s lawful basis, which may be your consent.
We do not sell personal data and we do not use it for advertising.
4. Shared form links (public forms)
An organisation can publish a form and share its link so that people can answer without an account. If you answer one:
- Your answers go to the organisation that shared the form, which decides how they are used.
- A Cloudflare “Turnstile” check runs on the page to tell people from automated programs. Cloudflare may collect technical information from your browser to do this, under its own privacy policy.
- Only answer what you are comfortable sharing. Never put passwords or bank details in a form. If a form asks for personal details and you are unsure why, ask the organisation before you submit.
- To see, correct or delete your answers, contact the organisation that sent you the link. We can help it respond.
Organisations that share forms are responsible for explaining why they collect data, for using a consent statement where it is needed, and for taking special care with information about children and other vulnerable people.
6. Moving data between countries
Some of our providers are outside Nigeria, so data can be processed in the European Union, the United States and other countries. Where this happens we rely on appropriate safeguards, such as contracts that require the same level of protection, as the Nigeria Data Protection Act 2023 allows.
8. How long we keep data
- Organisation data, including form answers, photos and public form responses, is kept while the organisation’s account is active, or until the organisation deletes it.
- If an account or organisation is closed, we delete or anonymise its data within a reasonable time, normally within 30 days of a verified request, apart from what we must keep by law. Copies in routine backups are removed as those backups expire.
- Server logs are kept for a limited time for security and troubleshooting.
Organisations can export their data (as CSV and PDF files) at any time, and administrators and managers can delete public form responses.
9. How we protect data
- All traffic uses encrypted connections (HTTPS).
- Each organisation’s data is separated by database access rules, so one organisation cannot see another’s.
- Roles limit what people can see and do. Evidence photos are stored privately and shown only through short-lived links.
- Public form submissions are checked on our server and protected by spam checks and rate limits. Secret keys are kept on the server and never sent to browsers.
No online service is completely secure. If we discover a breach that puts personal data at risk, we will tell the affected organisations without undue delay and notify the regulator where the law requires.
10. Your rights
Under the Nigeria Data Protection Act 2023, and similar laws elsewhere, you can ask to:
- see the personal data held about you, and get a copy;
- correct data that is wrong or incomplete;
- have data deleted, or restrict how it is used;
- object to uses based on our legitimate interests;
- withdraw consent you have given, at any time, without affecting what happened before; and
- receive your data in a common format so you can move it.
To use these rights for account details, email info@merlbase.com. For data inside an organisation’s projects or forms, contact that organisation first. We will help it respond. We may need to confirm who you are, and we aim to reply within 30 days.
You can also complain to the Nigeria Data Protection Commission (NDPC) if you believe your data has been mishandled.
11. Children
You must be 18 or older to hold an MERLBase account. We do not knowingly create accounts for children. Organisations may use the platform to collect information about or from children as part of their work. They must have a lawful basis, obtain any consent that is required from a parent or guardian, collect no more than they need, and follow safeguarding rules. If you believe a child’s data has been collected improperly, contact the organisation, or contact us at info@merlbase.com and we will help.
12. Changes to this policy
We may update this policy as the service changes. We will change the date at the top and, for significant changes, notify account holders by email or inside the product before they take effect.
13. Contact us
Questions about this policy or your data:
- Email: info@merlbase.com
- Phone: +234 912 957 2406
- Post: DevX Strategy, Suite 415 MKK Plaza, Jabi, Abuja, Nigeria
Also read our Terms of Use.