Roost handles personal data in two different capacities, and your rights are exercised differently in each.
Where we act as controller. For business user accounts, billing, platform security, support, and improving the Roost product, we decide how and why data is used. We are the controller. Contact us directly.
Where we act on behalf of a business. When a customer books an appointment or messages a business through Roost, we handle that customer's information on the instructions of that business. The business decides why it collects the information and how long it keeps it. The business is the controller; we act on its behalf.
If you are a customer and you want your information corrected or deleted, contact the business you booked with. If you contact us instead, we will pass your request to that business and help them action it.
Roost is a booking and business-management platform for appointment-based businesses — salons, clinics, auto-shops, studios and similar service businesses. Businesses use Roost to manage appointments, staff, services and customer communication, including over WhatsApp.
This policy is published by Roost Systems Limited, RC RC number, a company registered in Nigeria at registered address ("Roost", "we", "us").
Contact for privacy matters: privacy email
This policy covers:
Roost handles personal data in two different capacities, and your rights are exercised differently in each.
Where we act as controller. For business user accounts, billing, platform security, support, and improving the Roost product, we decide how and why data is used. We are the controller. Contact us directly.
Where we act on behalf of a business. When a customer books an appointment or messages a business through Roost, we handle that customer's information on the instructions of that business. The business decides why it collects the information and how long it keeps it. The business is the controller; we act on its behalf.
If you are a customer and you want your information corrected or deleted, contact the business you booked with. If you contact us instead, we will pass your request to that business and help them action it.
We do not ask customers to create a Roost account to book.
We do not collect or store card numbers, CVVs, PINs or bank login details. Payments are handled by a licensed third-party payment provider. Card details are entered on the provider's systems, not ours. We receive only the outcome: whether a payment succeeded, the amount, and a reference.
We also do not hold your money. Payments settle directly to the business's own account, with our platform fee settling separately to us.
Some businesses using Roost — clinics, for example — may record health-related information in appointment notes. Where that happens, the business is the controller of that information and is responsible for the lawful basis for collecting it. We handle it on their instructions and apply the same protections described in this policy.
Roost lets businesses communicate with their customers over WhatsApp, using the WhatsApp Business Platform provided by Meta.
Roost uses artificial intelligence to help businesses serve their customers. Specifically:
Human involvement. The business can see the conversation and can take over at any point. You can ask to speak to a person at any time and the business will be able to respond directly.
No automated decisions with legal effect. We do not use AI to make decisions that produce legal effects for you or similarly significantly affect you, such as denying you a service. Where our system flags a booking as higher risk of a no-show, that is information for the business — a person decides what to do with it.
We do not use your message content to train publicly available AI models.
Under the Nigeria Data Protection Act 2023, we rely on the following:
Where we rely on consent, you can withdraw it at any time. Withdrawing consent does not affect processing already carried out.
We share information only as set out below. We do not sell personal data, and we do not share your information with other businesses on the platform.
Service providers act under contract, may only use the information to provide their service to us, and may not use it for their own purposes.
Some of our service providers — including cloud hosting and AI model providers — process data outside Nigeria. Where that happens, we transfer data only where permitted under the Nigeria Data Protection Act 2023, and we put contractual protections in place requiring the recipient to protect the data to a standard comparable to Nigerian law.
You can ask us for details of the safeguards that apply by contacting us at privacy email.
Under the Nigeria Data Protection Act 2023 you have the right to:
To exercise a right, contact privacy email. We will respond within the timeframe required by law. We may need to verify your identity first.
If your request concerns information a business holds about you as its customer, see section 3 — we will route the request to that business and support them in answering it.
We apply security measures appropriate to the risk, including encryption of data in transit, hashed password storage, role-based access controls that restrict staff access to what their job requires, audit logging of sensitive actions, and access controls on our infrastructure.
No system is completely secure. If a breach occurs that is likely to result in a risk to your rights, we will notify the Nigeria Data Protection Commission and affected individuals as required by law.
Roost is not directed at children and we do not knowingly collect data from a child without the consent of a parent or guardian. Where a business books an appointment for a child, the business is responsible for having the necessary consent. If you believe we hold a child's data without proper consent, contact us and we will act.
Our websites use cookies and similar technologies to keep you signed in, remember preferences, keep the service secure, and understand how the service is used. You can control cookies through your browser settings; disabling some cookies will stop parts of the service working.
We may update this policy. If a change materially affects how we use your information, we will notify business users through the dashboard or by email before it takes effect. The date at the top shows when it was last updated.
Roost Systems Limited
registered address
Email: privacy email
You may also complain to the Nigeria Data Protection Commission if you believe we have handled your data unlawfully.