In effect
Privacy policy
What BlindspotLab Limited collects when you use Ìhìn, why, who helps us process it, how long we keep it, and the choices you have.
Effective 30 October 2026 · BlindspotLab Limited
01
Who is responsible for your information
Ìhìn (ihin.si and its Circle, Launch and Partner workspaces) is operated by BlindspotLab Limited, a company registered in Nigeria. BlindspotLab Limited is the controller of the personal information described in this policy.
For any privacy question or request, write to mojeeb@blindspotlab.xyz. Please never send passwords, one-time codes or private keys to anyone, including us.
02
What we collect
We collect only what each part of the service needs. Depending on how you use Ìhìn, this includes:
- Account details: your email address, name, and the time you signed in. If you choose Google sign-in, we receive your name, email address and profile picture from Google; we never request access to your mailbox, files or contacts.
- Enquiries: what you send through the contact form, so a person can reply.
- Creators (Circle): your legal name (stored encrypted), display name, country, niches, contact handles, the X account you connect, analytics screenshots you upload, the figures read from them, your rates, an optional public profile, and the wallet address you register for payouts.
- Clients (Launch): your organization's details, team members, brand materials and files you upload, campaign briefs, quotes, invoices and the payment transactions we verify.
- Partners: your application, referral links, daily visit counts for those links and the clients they introduce.
- Security records: sign-in events, staff two-step verification, an audit log of sensitive actions, and rate-limit counters stored as one-way hashes rather than raw network addresses.
03
Connecting X and reading analytics
Creators connect X through X's own authorization screen, separately from signing in. We request read-only access to your profile and posts, store the access token encrypted, and use it to confirm the account is yours and, where applicable, that a campaign post was published. We never ask for your X password, session cookies or two-factor codes, and you can disconnect at any time.
Analytics screenshots are stored privately and are visible only to you and the Ìhìn staff who review applications; every staff view is logged. An AI model may help read the figures in a screenshot. Screenshots are treated as untrusted, the output is checked against a strict format, and a person reviews every result before it is used. AI never makes the decision to approve or decline a creator.
04
Why we use it
We use information to run your account and workspace, assess creator and client applications, plan and deliver campaigns, verify posts and payments, pay creators and partners, prevent fraud and abuse, keep the service secure, answer you, and meet legal and accounting obligations.
Our legal bases are performance of our agreement with you, our legitimate interests in operating a secure and trustworthy service, your consent where we ask for it (for example, to publish a creator profile or a campaign report, or to connect X), and compliance with law. We do not sell personal information or use it for third-party advertising.
06
International transfers
Some providers process information outside Nigeria. Where they do, we rely on their contractual and security commitments and on the safeguards required by the Nigeria Data Protection Act. Clients see only what a campaign needs: creators' published posts, agreed rates within quotes, and source-labelled results. They never see creators' private analytics, legal names or wallet details.
08
How long we keep it
We keep information while your account is active and as long as needed for the purposes above. Some specific periods:
- Sign-in codes expire after 10 minutes and are never stored in our email records.
- Sessions last up to 7 days and are removed after they expire; you can end any session yourself from your account page.
- The content of service emails is deleted after 30 days; the subject, recipient and delivery status are kept as a record.
- Brand files a client removes are permanently deleted after 180 days unless a submitted brand profile still refers to them.
- Invoices, payments, payouts, commissions and the audit log are kept for as long as accounting, tax and legal obligations require, including after an account is closed.
09
How we protect it
Sensitive fields (legal names, X tokens and staff verification secrets) are encrypted at rest. Private files are never public and are served only to people with permission. Staff need two-step verification, and sensitive staff actions are logged. No service can promise perfect security; if you notice a problem, tell us at mojeeb@blindspotlab.xyz.
10
Your rights and choices
You can download a copy of your account data from your account page, and request deletion there. A person reviews each deletion request: we remove or anonymise your personal information, and keep only the financial and audit records the law requires. You can also ask us to access, correct, restrict or object to processing, to withdraw a consent you gave, or to have a person review a decision that affects you.
Write to mojeeb@blindspotlab.xyz; we may need to confirm the request is yours. You may also complain to the Nigeria Data Protection Commission or another competent authority.
11
Age and changes to this policy
Ìhìn is for adults aged 18 and over. We do not knowingly collect information from children.
When we change this policy we update the date at the top, and we tell account holders by email about material changes before they take effect.
Questions, correction requests or privacy concerns? mojeeb@blindspotlab.xyz