Privacy Policy

Last updated: 4 May 2026

This Privacy Policy describes how Terawatt Renewables Limited ("Terawatt", "we", "us", or "our") collects, uses, and shares personal information when you use the TerawattOS mobile application and related backend services (collectively, the "Services").

TerawattOS is a business-to-business (B2B) energy asset monitoring and maintenance platform. The mobile application is intended for use by authorised personnel of Terawatt's customer organisations — typically operators, managers, and field technicians — to view telemetry, manage work orders, and capture maintenance evidence at energy-asset sites.

By using the Services, you agree to the practices described in this Policy. If you do not agree, please do not use the Services.

1. Information We Collect

1.1 Information you provide

• Account information: name, work email address, phone number, and the role assigned to you within your organisation (for example, technician, manager, viewer).
• Authentication credentials: a hashed password and, where applicable, multi-factor authentication tokens.
• Work-order content: notes, status updates, signatures, and other text you enter while completing maintenance jobs.
• Photos and media: images you capture with the device camera (or select from your photo library) as evidence attached to work orders, asset inspections, or fault reports.
• Support communications: any information you send to us when you contact support.

1.2 Information collected automatically

• Device identifiers: a randomly generated device ID stored locally for session and security purposes, plus the operating system version and application version.
• Authentication tokens: short-lived access tokens and refresh tokens stored in the operating system's secure keystore (Android Keystore / iOS Keychain) so you do not have to sign in for every request.
• Approximate location: when you choose to attach a GPS location to a work order or piece of evidence. We do not collect precise background location.
• Crash and diagnostic data: stack traces, breadcrumbs, application state, and a random installation identifier are sent to our error-monitoring provider (see Section 4) to help us diagnose and fix faults.
• Usage data: the API endpoints you access, request timestamps, and high-level event data used for service health and security monitoring.

1.3 Information from energy assets and IoT devices

TerawattOS connects to industrial energy assets through proprietary IoT dongles. Telemetry data from those devices (voltage, current, power, battery state of charge, fault codes, device health) is associated with the asset and the customer organisation, not directly with individual end-users. Where work-order activity links a user to a specific asset event, that link is treated as personal information under this Policy.

2. How We Use Information

We process the information described above for the following purposes:

• Provide and operate the Services: authenticate you, keep you signed in, route requests to the correct customer organisation, and display sites, assets, alerts, and work orders.
• Maintenance workflows: create, assign, and complete work orders; attach photos, notes, and locations as job evidence; track preventive-maintenance schedules and alert acknowledgements.
• Asset monitoring and alerting: ingest telemetry from IoT dongles, evaluate rules, and notify the responsible users when an alert is triggered.
• Security and abuse prevention: detect compromised accounts, throttle suspicious activity, audit administrative actions, and enforce role-based access controls.
• Diagnostics and reliability: investigate crashes, performance issues, and connectivity failures using error-monitoring data.
• Customer support: respond to your questions and resolve issues you report.
• Legal and compliance obligations: meet our obligations under applicable laws, respond to lawful requests, and enforce our terms.

We do not sell your personal information. We do not use your personal information for behavioural advertising. TerawattOS does not contain third-party advertising SDKs and does not access your device's Advertising ID.

3. Legal Bases for Processing

Where the Nigeria Data Protection Act, 2023 (NDPA) or other applicable law requires a legal basis, we rely on one or more of the following:

• Contract: processing is necessary to provide the Services to your organisation under our agreement with them, or to take steps at your request before signing in.
• Legitimate interest: securing the Services, preventing fraud, debugging, and improving reliability — balanced against your rights and freedoms.
• Consent: for optional features such as accessing your camera, photo library, or location, which you can grant or revoke through your device settings.
• Legal obligation: where we must process information to comply with a law that applies to us.

4. How We Share Information

We share personal information only as described below.

4.1 Within your organisation

Other authorised users in your organisation may see information you create or are assigned to — for example, work-order assignees, managers reviewing job evidence, and administrators managing user roles.

4.2 Service providers (data processors)

We rely on a small number of vendors to operate the Services:

Each provider is bound by contract to use personal information only on our documented instructions and to apply appropriate security safeguards.

4.3 Legal and safety

We may disclose information to comply with valid legal process, to protect the rights, property, and safety of Terawatt, our users, or the public, or to investigate and prevent fraud, abuse, or security incidents.

4.4 Business transfers

If Terawatt is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction, subject to the protections in this Policy.

5. International Data Transfers

Terawatt is based in Nigeria. Some of our service providers (including DigitalOcean and Sentry) process data in regions outside Nigeria, including the European Union and the United States. Where required by the NDPA or other applicable law, we put in place appropriate safeguards for such transfers, including contractual commitments equivalent to standard data-protection clauses.

6. Data Retention

We retain personal information for as long as your organisation maintains an active subscription and for a reasonable period thereafter to meet our legal, accounting, and dispute-resolution obligations. Specifically:

• Account and authentication records — for the life of the account, then up to 12 months after deactivation.
• Work-order content and evidence — for the duration agreed with the customer organisation, typically aligned with regulatory and warranty requirements for energy assets.
• Telemetry data — retained according to the customer organisation's contractual data-retention term.
• Crash and diagnostic data — retained by our error-monitoring provider for up to 90 days.

When the retention period ends, we delete or anonymise the data, unless we are required to keep it for a longer period by law.

7. Security

We use industry-standard safeguards to protect personal information, including encryption in transit (TLS), encryption at rest for backend databases, secure key storage on mobile devices (Android Keystore / iOS Keychain), role-based access controls, mutual-TLS authentication between IoT dongles and our backend, and audit logging of administrative actions. No system is perfectly secure; if we discover a security incident affecting your information, we will notify you and applicable regulators in accordance with the law.

8. Your Rights

Subject to the Nigeria Data Protection Act, 2023 (NDPA) and any other law that applies to you, you have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request deletion of your information, subject to our legal obligations.
• Object to or restrict certain processing.
• Receive your information in a portable format.
• Withdraw any consent you have previously given (without affecting prior processing).
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC) or another competent supervisory authority.

Because TerawattOS is a B2B service, the most direct route to exercise these rights for organisation-managed data is through your organisation's administrator. You can also contact us using the details in Section 12, or submit a request through our data-rights portal: https://app.termly.io/dsar/a548bab6-a8a0-4379-bbcb-dbe82147219f .

9. Children

TerawattOS is intended for use by adult professionals at our customer organisations and is not directed at children. We do not knowingly collect personal information from children under the age of 18. If you believe a child has provided us with personal information, please contact us and we will take appropriate steps to delete it.

10. Permissions on Your Mobile Device

TerawattOS requests certain device permissions to provide its features. You can grant or revoke these permissions at any time through your device settings.

• Camera: used only when you choose to capture a photo as part of a work order, asset inspection, or fault report.
• Photo library / storage: used only when you choose to attach an existing image to a work order.
• Notifications: used to alert you about new work orders, alert escalations, and operational messages.
• Location: used only when you explicitly choose to attach a location to a work order or piece of evidence.
• Network state: used to detect connectivity changes and queue work for offline sync.

11. Changes to This Policy

We may update this Policy from time to time. When we do, we will revise the "Last updated" date at the top and, where the changes are material, take additional steps to notify you (for example, an in-app message). Your continued use of the Services after the changes take effect constitutes acceptance of the updated Policy.

12. Contact Us

If you have questions or complaints about this Policy or our handling of your personal information, contact us at:

Terawatt Renewables Limited
KM 10, Idiroko Road, Canaan Land
Ota, Ogun 110001
Nigeria
Email: privacy@send.terawattos.com