Privacy Policy

Who we are

Bodiop Ltd ("we", "us", "our") is the data controller for the personal data described in this Policy. We are a company registered in the Republic of Rwanda, TIN 155969694, with our registered office in Kirehe, Eastern Province, Rwanda.

We are registered with the National Cyber Security Authority (NCSA), Data Protection and Privacy Office as a Data Controller — registration number 001/2376/0426, issued 22 April 2026 and valid until 22 April 2029. The certificate is available here.

We process personal data in accordance with Law N° 058/2021 of 13/10/2021 relating to the Protection of Personal Data and Privacy (the "DPP Law"), and we follow GDPR principles where they add protection.

For all privacy matters, contact privacy@bodiop.rw. We do not require you to go through any individual — this address reaches the people responsible for data protection at Bodiop.

This Policy covers our website bodiop.rw, our WhatsApp alert service, and everything connected to them (the "Service").

1. What we collect

1.1 What you give us when you sign up

1.1a Your qualification profile

To send you only opportunities you can realistically apply for, we collect your education level, field of study and years of experience, and — if you choose to add them — your certifications, target roles and languages. The first three are required if you sign up as a student, unemployed or employed job-seeker, and are optional if you sign up as self-employed or an entrepreneur; the rest are always optional.

These are ordinary personal data (not special category), collected under your consent to this Policy for one purpose only: to check whether you meet an opportunity's stated requirements before we send it to you. They are never shared with employers, funders or advertisers, and are never used to set your price. Your education, experience and certifications are compared only by our own code on our own server. Your target roles text — like your skills and interests — may be sent to our embeddings provider to compute a topical match; your education, experience, certifications and identity are not. You can ask us to correct or remove any of these at any time by emailing privacy@bodiop.rw, and all of them are erased if you delete your account.

1.2 Optional details about you — special category and sensitive data

The signup form also offers four optional fields: gender, refugee status, disability status and nationality. Refugee status and disability status relate to protected characteristics and are treated as special category personal data under the DPP Law. Nationality is not special category data in itself, but it sits close enough to origin — and matters enough to the people we serve — that we give it exactly the same protections as the other three.

We do not collect any other special category data. We never ask for your national ID number, financial account details, health records, religion, ethnicity, political opinions, or biometric data. Please do not include such information in your skills or profile text — if you do, we will remove it.

1.3 What we generate or collect automatically

• Delivery and engagement records — when an alert was sent and delivered, and which links you opened. This is how we detect that alerts have stopped arriving.
• Payment records — the amount, date, plan, status of each MoMo request and MTN's transaction reference. We never see or store your MoMo PIN, and we do not store any card or bank details.
• Website analytics — see section 5 on cookies.
• Referral source — if you arrive from a link that carries campaign tags, we record which campaign brought you, so we know what is worth running.
• Support messages — what you send us and what we reply.

2. Why we use it, and on what legal basis

We do not use your data for advertising, do not build profiles of you for anyone else, and do not send you marketing for third-party products.

Where our basis is legitimate interest, you may object at any time (section 8) and we will stop unless we have compelling grounds that override your objection.

3. Automated processing and how matching works

Bodiop is an automated service, and the DPP Law entitles you to know what that means in practice.

1. We collect opportunity listings from public sources. No personal data of yours is involved at this stage.
2. An AI model reads each listing — not your profile — to extract the deadline, organisation and requirements, and to score it for fraud indicators. Listings that fail screening are discarded.
3. The surviving listings are scored against your profile by our own code, running on our own server. Your skills, district, employment status and category preferences are compared to the listing. This produces a match score and the "why it matched" line in your alert.
4. The top matches are formatted and sent to your WhatsApp number.

This automated matching decides which opportunities you are shown. It does not produce legal effects or similarly significant effects on you — it does not decide whether you get an opportunity, and every alert links to the original source so you can apply directly. If you think your matches are wrong, you can correct your profile, or ask a person to review them by emailing privacy@bodiop.rw.

4. Who we share data with

We do not sell personal data, and we never have. We share it only with the service providers we need to run the Service, each of which processes it on our instructions under a data processing agreement. Our full sub-processor register, including what each one may access, is on our Data Processing & Sub-Processors page.

A note on n8n: our automation software is n8n, but it runs self-hosted on our own Hetzner server. No subscriber data is sent to n8n the company or to any n8n cloud service. n8n is software we run, not a processor we share with.

We may also disclose data where we are legally required to — for example to the NCSA, the Rwanda Revenue Authority, a court, or law enforcement acting under proper authority. We disclose only what is required, and we will tell you unless we are legally prohibited from doing so.

If Bodiop is ever reorganised, merged or acquired, your data may transfer to the successor, which will remain bound by this Policy. We will notify you before that happens.

5. Cookies and website analytics

The WhatsApp alert service uses no cookies at all. Our website uses:

• Essential cookies set by Cloudflare to keep the site secure and available. These cannot be turned off without breaking the site.
• Microsoft Clarity, which records anonymised page interactions and heatmaps so we can see where the signup form confuses people. Clarity masks text input by default — it does not capture what you type into the form fields — and we do not use it to identify individuals.

You can block these through your browser settings, or opt out of Clarity via Microsoft's privacy statement. Blocking them does not affect your alerts. We do not run advertising or cross-site tracking cookies.

6. Sending data outside Rwanda

Several of our providers are outside Rwanda, so some data is transferred internationally. Where that happens we rely on the safeguards permitted under the DPP Law: contractual clauses imposing standards equivalent to Rwandan law, the provider's own certified transfer framework, and — most importantly — data minimisation.

In practice, minimisation does most of the work here:

• Your full profile stays within our server in Germany and our operational records.
• The AI provider in China receives opportunity listings, not subscribers.
• WhatsApp receives your number and the message, because it cannot deliver without them.
• Payment data stays with MTN in Rwanda.

If you want the detail of a specific transfer, ask us at privacy@bodiop.rw and we will tell you.

7. How we protect your data

In line with Article 38 of the DPP Law, we apply:

• Encryption in transit (HTTPS/TLS everywhere) and encryption at rest on our server;
• Access restricted to the small number of people who need it, using individual accounts and multi-factor authentication;
• Credentials held in an encrypted credential store and never written into our automation code;
• An access-and-change log for operations that touch subscriber records;
• Automatic deletion of operational records once their retention period ends, so old data does not accumulate;
• Regular review of our automations, and backups tested for restore.

No system is perfectly secure. If a personal data breach occurs, we will notify the NCSA within 48 hours of becoming aware of it, as the DPP Law requires, and we will tell affected subscribers directly and without undue delay where there is a risk to them, explaining plainly what happened and what to do.

8. How long we keep it

9. Your rights

Under the DPP Law you have the right to:

• Be informed — which is what this Policy is for;
• Access a copy of the personal data we hold about you;
• Rectify anything inaccurate or incomplete;
• Erase your data ("be forgotten"), subject to the legal retention note above;
• Withdraw consent at any time, in whole or only for the optional fields;
• Object to processing based on legitimate interest;
• Restrict processing while a dispute about accuracy or lawfulness is resolved;
• Portability — receive your data in a structured, machine-readable format;
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. See section 3.

How to exercise them

Email privacy@bodiop.rw, or WhatsApp +250 729 909 068. Include the mobile number on your Bodiop profile so we can locate your record.

Exercising your rights is free. We respond within 30 days, and faster — usually within 7 days — for erasure and consent withdrawal. We may ask you to confirm your identity, but only proportionately: we will not demand identity documents to action a request that comes from your registered number.

If we cannot act on a request, we will explain why and tell you how to challenge that.

Complaints

Please raise it with us first — most things are quicker to fix directly. You also have the right to complain at any time to the Data Protection and Privacy Office of the National Cyber Security Authority at cyber.gov.rw.

10. Children

Bodiop is for adults. You must be 18 or older to use the Service, and we ask you to confirm this at signup. We do not knowingly collect personal data from anyone under 18.

If we learn that we hold data about a child, we delete it promptly. If you believe a child has registered, tell us at privacy@bodiop.rw and we will act.

11. Changes to this Policy

We update this Policy when our practices or the law change. The version number and effective date at the top always show the current version.

For material changes — a new purpose, a new category of data, or a new processor with access to your data — we will tell you by WhatsApp or email before the change takes effect. Where the change requires consent, we will ask for it rather than assume it. Previous versions are available from privacy@bodiop.rw.