SomakuAI

Privacy Policy

Last updated: September 2026

1. Introduction

›This Privacy Policy explains how Orbitrix collects, uses, stores, shares, and protects personal data obtained through your use of Somaku AI.
›Orbitrix acts as the Data Controller responsible for processing personal data in accordance with the Nigeria Data Protection Act 2023 and applicable international data privacy frameworks.

2. Information We Collect

›Orbitrix collects personal data to deliver, secure, and optimize Somaku AI. We collect the following categories of information:
›Account Information: Personal identification data obtained during single sign-on, such as Google authentication, including your full name, email address, and profile picture URL.
›Conversation and Prompt Data: Text prompts, queries, conversation histories, system messages, and any files, images, or media attachments submitted by users to Somaku AI.
›Usage and Technical Analytics: Automatically generated telemetry data, including message volume, active session durations, feature interactions, language or category choices, IP addresses, device types, browser configurations, and operating system diagnostics.
›Payment and Transactional Records: Subscription records, transaction histories, billing status, and payment customer identifiers generated via Paystack. Orbitrix does not store or process debit or credit card credentials on its servers.
›Uploaded Files: Files and media assets uploaded by users to facilitate query processing, stored via third-party cloud infrastructure, specifically ImageKit.

3. How We Use Your Information

›Orbitrix processes personal data for specified, explicit, and legitimate operational purposes, including:
›Processing user inputs and delivering AI-generated responses.
›Maintaining and rendering user chat session histories through the Recent feature across devices.
›Managing subscriptions, billing accounts, and transaction validations via Paystack.
›Dispatching transactional notices, billing statements, system alerts, and security updates via Resend.
›Enforcing tier-based message limits, fair usage policies, and platform abuse prevention.
›Optimizing server performance, system architecture, stability, and functional reliability.

4. Lawful Basis for Data Processing

›In accordance with Section 25 of the Nigeria Data Protection Act 2023, Orbitrix relies on the following legal bases to process your personal data:
›Consent: Freely given, informed consent provided upon user account registration and acceptance of our terms for storing account details and processing prompt inputs.
›Performance of a Contract: Processing necessary to execute our contractual obligations under the Terms of Service, such as account provisioning, payment processing, and delivering paid plan features.
›Legitimate Interests: Processing necessary to achieve Orbitrix legitimate business interests, including platform security, fraud prevention, abuse monitoring, and system optimization, provided such processing does not override the fundamental privacy rights of the user.

5. AI Processing and OpenAI API Disclosures

›Cross-Border Processing: To generate artificial intelligence outputs, Somaku AI transmits user inputs and prompt data to the OpenAI Application Programming Interface. Users acknowledge that this data processing takes place on infrastructure hosted outside the Federal Republic of Nigeria.
›Independent Relationship: Somaku AI is an independent service provided by Orbitrix. Somaku AI is not ChatGPT and does not imply any partnership, sponsorship, corporate endorsement, or special enterprise agreement with OpenAI beyond the lawful subscription to its API services.
›Model Training Exemption: Per OpenAI enterprise API data usage policies, inputs and outputs processed via the API are retained for a limited duration solely for abuse and safety monitoring and are not utilized to train OpenAI foundation models by default.

6. Cookies

›Authentication Cookies: Somaku AI uses essential session cookies exclusively for user authentication and maintaining secure sign-in states.
›No Local Storage: We do not use local storage. Cookies are used for authentication sessions only.
›No Advertising Trackers: Orbitrix does not deploy third-party advertising cookies, cross-site trackers, or behavioral profiling scripts.
›Managing Cookies: Users may disable cookies through browser settings. However, disabling essential authentication cookies will prevent users from staying signed into their account.

7. Data Storage, Hosting, and Security Measures

›Infrastructure Partners: Somaku AI application assets, storage buckets, and payment processing flow through enterprise-grade sub-processors, including Paystack for payment gateway services, ImageKit for file storage, and Resend for email delivery.
›Security Controls: In compliance with Section 39 of the Nigeria Data Protection Act 2023, Orbitrix implements strict technical and organizational safeguards:
›Transport Layer Security (TLS/SSL) encryption for all data in transit.
›Secure, HTTP-only cookie storage for session tokens.
›Strict, role-based access restrictions limiting stored data access to authorized Orbitrix technical personnel.
›Security Disclaimer: While Orbitrix takes reasonable, industry-standard measures to safeguard personal data, no internet-based transmission or storage system can be guaranteed to be completely immune from unauthorized breach.

8. User Data Rights

›Pursuant to Part VI of the Nigeria Data Protection Act 2023, users maintain specific statutory rights regarding their personal data processed by Orbitrix:
›Right of Access: Users have the right to request confirmation of whether Orbitrix processes their personal data, as well as a copy of the specific personal data held.
›Right to Rectification: Users may request the correction or updating of inaccurate, incomplete, or outdated personal data linked to their account.
›Right to Erasure: Users have the right to request the permanent deletion of their personal data from Orbitrix servers, subject to mandatory statutory retention requirements for financial or operational compliance.
›Right to Restrict or Object to Processing: Users may object to or request the restriction of data processing activities where processing relies on legitimate interests or direct marketing.
›Right to Data Portability: Users may request a structured, commonly used, and machine-readable copy of their personal data to transfer to another service provider.
›Right to Withdraw Consent: Where data processing is based on user consent, users retain the right to withdraw such consent at any time without affecting the lawfulness of processing conducted prior to withdrawal.
›To exercise any of these privacy rights, users may submit a formal request to Orbitrix via support@somakuai.com. Orbitrix will acknowledge and address verified data subject requests within thirty days of receipt.

9. Data Retention Schedules

›Orbitrix retains personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy:
›Account & Profile Data: Retained for the duration of your active account lifecycle. If you delete your account, account credentials and profile details are permanently purged within 30 days.
›Conversation & Prompt History: Saved to render your chat history via the "Recent" feature. Deleting specific chat sessions or purging your account immediately flags conversation data for deletion, removing it from primary servers within 14 days.
›Uploaded Files & Media: Stored via ImageKit solely to execute your processing requests. Files are automatically deleted from cloud storage servers after 30 days unless cleared earlier by user account deletion.
›Financial & Transactional Records: Subscription invoice metadata, Paystack references, and tax/accounting logs are retained for 6 years following transaction completion to satisfy legal and financial recordkeeping requirements under Nigerian law.

10. Data Sharing and Third-Party Sub-Processors

›Orbitrix does not sell, rent, or trade your personal data to third parties. We share data strictly with trusted service providers who assist in operating Somaku AI under strict data protection agreements:
›OpenAI LLC: API partner processing prompt inputs, system instructions, and text outputs.
›Paystack Payments Limited: Payment gateway handling billing transactions and payment card verification.
›ImageKit: Cloud asset hosting provider handling user-uploaded files and media attachments.
›Resend: Transactional email relay provider handling operational emails and system notices.
›Legal Disclosures: Orbitrix may disclose personal data if required to do so by law, court order, or formal request from a competent law enforcement agency or the Nigeria Data Protection Commission (NDPC).

11. Children's Privacy

›Somaku AI is not intended or designed for use by individuals under the age of 18 (or the age of legal majority in your jurisdiction).
›Orbitrix does not knowingly collect or solicit personal data from children.
›If we discover that a child under 18 has created an account or submitted personal data without verifiable parental consent, we will immediately take steps to terminate the account and purge all associated personal data from our systems.

12. Data Breach Notification Procedures

›In accordance with Section 40 of the NDPA 2023, in the event of a security incident that results in an unauthorized breach, compromise, or exposure of personal data:
›Commission Notification: Orbitrix will notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of the breach.
›User Notification: If the breach is likely to pose a high risk to the rights and freedoms of affected users, Orbitrix will notify impacted users without undue delay via their registered email address, detailing the nature of the breach, potential impacts, and remedial measures taken.

13. Updates to This Privacy Policy

›Orbitrix reserves the right to update or modify this Privacy Policy at any time to reflect changes in legal requirements, operational practices, or service functionality.
›When changes are made, we will update the "Last updated" date at the top of this page.
›For material updates affecting data handling practices, we will provide advance notice via email or an in-app banner before changes take effect.

14. Contact Us and Data Protection Officer

›If you have questions, concerns, or complaints regarding this Privacy Policy or wish to exercise your data subject rights under the NDPA 2023, you can reach out to our team or Data Protection Officer (DPO) using the contact details below:
›Data Controller: Orbitrix
›Service Name: Somaku AI
›Support Email: support@somakuai.com
›Privacy / DPO Inquiries: support@somakuai.com

Have questions? support@somakuai.com