Skip to content
Writers’ Block
Sign up

Privacy notice

Your data on Writers’ Block Africa

What we collect, why, who sees it, how long we keep it, and what you can ask us to do with it. Each section opens with a short summary; the text under it is the notice itself.

Version 2026-10-25, in effect from 25 October 2026.

Who controls your data

In short: Gold Mind Resourcery Limited runs Writers’ Block Africa and is responsible for your data. Write to hello@writersblockafrica.com about anything here.

Gold Mind Resourcery Limited (RC 896726), trading as Writers Block Africa, is the controller of personal data used to operate WBA. Registered office: Plot 1705, Olugbosi Close, Victoria Island, Lagos. Privacy contact: hello@writersblockafrica.com. Data Protection Officer or responsible privacy lead: the Founder and Chief Executive Officer, through the privacy contact.

Pandascrow and another payment provider may act as an independent controller where it decides how to perform identity, anti-fraud, anti-money-laundering, banking, settlement, reversal or regulatory functions. It may act as a processor where it handles data only on WBA's documented instruction. Its notice governs its independent processing.

What we collect

In short: Your account and profile; what you post, send and sign on WBA; payment references (never your full card or bank number); support messages; the choices you make; and the technical logs that keep WBA running and safe.

WBA may collect account and contact details; professional profile, biography, skills, credentials, level and public settings; briefs, bids, messages, contracts, change orders, drafts, samples, Deliverables, reviews and dispute evidence; payment references, provider status, masked account information and transaction records; support and complaint communications; identity, authority, fraud and safety information where required; consent and preference records; and sign-in, IP address, device, browser, cookie, security, usage, error and audit logs.

WBA should not collect full bank-account or card details where the payment provider can collect them directly. Where feasible, WBA should retain only a masked reference or provider token. A cryptographic hash used to identify an accepted document is not biometric data, but the associated acceptance record is personal data.

In practice: a professional’s full account number goes straight to Pandascrow, and WBA keeps only the bank and the last four digits. Card and bank details a client pays with go straight to Pandascrow and never reach WBA.

Why we use it, and on what basis

In short: Mostly to run the marketplace you signed up for. Some records we must keep by law, and some use is needed to keep WBA safe. Your public listing and optional analytics happen only if you say yes, and you can change your mind.

WBA processes account, matching, contracting, stage, delivery, payment-instruction, support and dispute data, and sends new-brief alerts to Professionals, because it is necessary to perform the user contract or take requested steps before contract. A Professional can switch new-brief alerts off at any time in their settings. WBA processes accounting, tax, regulatory and lawful-request records to comply with legal obligations. WBA processes proportionate security, fraud prevention, service integrity, evidence, limited product-improvement and legal-claims data for legitimate interests after considering the user's rights and reasonable expectations.

WBA relies on consent for optional public-directory publication and non-essential analytics or marketing cookies. Each consent is separate, specific, recorded and as easy to withdraw as to give. Withdrawal does not affect processing already lawful before withdrawal and does not remove a record that WBA must retain on another lawful basis.

We do not sell your personal data, and we do not use it for advertising.

Who we share it with

In short: The person you are working with sees what the engagement needs. Beyond that, only the providers below, each limited to its task, and authorities where the law requires.

WBA uses service providers for database hosting and authentication, website hosting, transactional email, business email, error monitoring, analytics, payment processing and support. Current providers include Supabase, Vercel, Resend, Namecheap Private Email, Sentry, PostHog and Pandascrow. WBA gives each provider only the data reasonably required for its task and uses a written contract where law requires one.

WBA may disclose data to a party to the relevant Engagement, professional advisers, insurers, auditors, regulators, law-enforcement bodies or courts where the disclosure is authorised, necessary to perform the contract, required by law, or reasonably necessary to establish, exercise or defend legal claims. Private samples and unpublished work are not public merely because they are uploaded to WBA.

  • Pandascrow. Payment provider: processes clients’ payments for each stage and pays professionals.
  • Supabase. Database and sign-in.
  • Vercel. Hosts the WBA website and application.
  • Resend. Sends WBA’s emails, such as notices about your engagements.
  • Namecheap Private Email. Sends sign-in emails and hosts our hello@ mailbox.
  • Sentry. Tells us when something on WBA breaks.
  • PostHog. Measures how WBA is used, only if you allow analytics.

Cookies, analytics and diagnostics

In short: Cookies that keep you signed in and safe are always on. Analytics is off until you allow it, and you can change your choice at any time from “Privacy choices” at the foot of every page.

Strictly necessary cookies and similar storage support sign-in, security, preferences and core Platform functions. WBA may use them without consent where law permits. Optional analytics or marketing technology is activated only after the applicable consent and can be rejected or withdrawn through the choice shown on your first visit, or at any time from “Privacy choices” at the foot of every page.

PostHog may receive pseudonymous identifiers and usage events. Pseudonymous data is still personal data where it can be linked to a user. Sentry is configured to minimise content and personal data, but diagnostic events may include technical identifiers and data captured when an error occurs. WBA applies collection filters, access controls and retention settings to both services.

Where your data goes

In short: Some providers process data outside Nigeria, in Ireland, elsewhere in Europe and the United States. We record the legal safeguard for each, and you can ask us which one applies.

Some providers process personal data outside Nigeria, including in Ireland, other European locations and the United States. Before a transfer, WBA records the receiving country, provider, categories, purpose and the lawful transfer mechanism. WBA uses an adequacy decision, an instrument approved by the Nigeria Data Protection Commission, or another basis permitted by the Nigeria Data Protection Act 2023, together with supplementary safeguards where required.

WBA's transfer register and current provider documentation identify the mechanism used for each transfer. A person may request information about the applicable safeguard through the privacy contact. WBA will not describe a transfer as protected merely because a provider uses general contractual commitments.

How long we keep it

In short: Your account while it is open, then up to 90 days. Contracts and payment records for six years after the engagement. Support messages for two years. Unsuccessful bids and pitches for two years. Logs for up to a year.

WBA keeps account and profile data while the account is open and ordinarily deletes or anonymises it within 90 days after closure, subject to the exceptions below. Public visibility may end sooner. WBA keeps contracts, payment instructions, transaction references, acceptance records and material action logs for six years after the relevant Engagement closes. WBA keeps ordinary support communications for two years after closure of the request.

Private samples, unsuccessful bids and unselected pitch material are deleted or anonymised within two years after the relevant brief closes, unless the user keeps them in a private library. Drafts and Deliverables are kept for six years after final payment or dispute closure. Dispute, fraud, complaint and legal-claim files are kept for six years after final resolution, or longer where a hold, court process or law requires. Security and error logs are kept for up to 12 months. Backups expire through the ordinary secure backup cycle within 30 days.

WBA may retain a restricted record longer where necessary for tax, accounting, regulatory duties, fraud prevention or legal claims. When retention ends, WBA securely deletes or irreversibly anonymises the data.

Your rights

In short: You can ask to see, correct, delete, restrict or move your data, object to how we use it, have a person review an automated decision, and withdraw a consent.

Subject to the Nigeria Data Protection Act 2023, a data subject may request access, correction, erasure, restriction, objection, portability and review of a decision based solely on automated processing, and may withdraw consent. WBA may ask for information reasonably needed to verify identity and authority. WBA will respond within the period required by law and will explain a lawful refusal or extension.

How to ask, or complain

In short: Write to hello@writersblockafrica.com from the email address on your account. If you are not satisfied, you can complain to the Nigeria Data Protection Commission.

A data subject may complain to the Nigeria Data Protection Commission. Contact and complaint information is available at https://ndpc.gov.ng. A request may be sent to the privacy contact stated above, hello@writersblockafrica.com.

Security and personal-data breaches

In short: We protect your data with access controls, a second sign-in factor for staff, encryption and logging. No system is perfectly secure. If a breach puts you at risk, we tell the regulator within 72 hours and tell you if the risk is high.

WBA uses proportionate technical and organisational measures, including role-based access, authentication, encryption where appropriate, logging, backup, supplier controls, staff confidentiality, incident response and periodic review. No system is completely secure, and WBA does not promise absolute security.

WBA assesses a personal-data breach promptly. Where the breach is likely to create a risk to data subjects' rights and freedoms, WBA notifies the Nigeria Data Protection Commission within 72 hours after becoming aware, to the extent required by law. Where the breach is likely to create a high risk, WBA also communicates with affected data subjects without undue delay unless a statutory exception applies. A processor must notify WBA promptly enough for WBA to meet its duties.

Children

In short: Accounts are for adults. Work about a child needs a proper plan and the right authority.

WBA accounts are for persons aged 18 or over. A project concerning a child may involve child personal data only under a specific safeguarding and privacy plan, with verified authority, data minimisation and the consent or other lawful basis required by applicable law. A Client must not use an adult account to conceal unauthorised collection from a child.

Changes to this notice

In short: Each version is dated. We tell you about a change that matters, and ask first if a new use needs your consent.

WBA will identify the version and effective date of this Notice and give proportionate notice of a material change. A privacy notice is an explanation, not a contract amendment and not a request for blanket consent. Where a changed purpose requires consent or another new lawful basis, WBA will obtain it before the new processing begins.

Questions about this notice: hello@writersblockafrica.com