Who we are

The Suny platform (the website and app at suny.energy) is owned and operated by Petgrave.io Technologies Limited (“Petgrave.io”, “Suny”, “we”, “us”), RC 1960464, House 6, IPENT 4 Extension, Lokogoma, Abuja, FCT, Nigeria. We are the data controller for personal data processed through the platform. Our Data Protection Officer is Fitzroy Petgrave. Questions about this policy or your data go to hello@petgrave.io.

What we collect

• Solar estimate details — approximate location, appliances and power needs, backup preferences, occupancy and budget, entered when you use the design tool.
• Contact and account data — your name, email address (your primary sign-in identity), phone number if you add one, and a password (stored only as a secure hash).
• Identity verification data — for installers, and for customers at the point of accepting a quote or paying a milestone: full name, date of birth and National Identification Number (NIN); optionally, for installers on the stronger tier, Bank Verification Number (BVN); for installer companies, the Corporate Affairs Commission (RC/BN) registration number.
• Installer business and credential data — business name, service area, description, NEMSA certificate number and category, and documents you upload for certification readiness (for example a degree or trade certificate, CV, references, employment letter, NEMSA certificate), plus past-project details and photographs.
• Transaction data — quotes, quote requests, project milestones, and bank-transfer payment references and status; for installers, subscription plan and billing records held by our payment processor.
• Usage and research data — an IP address, device identifiers and pseudonymous interaction events (pages viewed, steps completed, whether a match was requested), used in aggregated form for research into solar adoption in Nigeria and to improve the platform. This is not linked to your name.
• Support data — messages you send us and our replies.

Why we process it, and our lawful basis

• To generate estimates and quotes, match you with installers, and run your project and milestones — because it is necessary to provide the service you have asked for.
• To verify the identity of installers and customers, installer business registration and NEMSA certification, to prevent fraud and impersonation — with your consent, which we ask for separately when we collect the data, and because we have a legitimate interest in a trustworthy marketplace.
• To confirm and record milestone payments and bill installer subscriptions — to provide the service, and for our legitimate interest in operating the platform.
• To respond to enquiries and provide support — for our legitimate interest and to provide the service.
• For aggregated, pseudonymised research into solar adoption in Nigeria — for our legitimate interest, with the data pseudonymised so it is not used to make decisions about you.
• To meet legal, regulatory and tax obligations and respond to lawful requests — to comply with the law.

Where we rely on your consent you can withdraw it at any time by contacting us, though we may then be unable to keep you listed as a verified installer or let you complete a transaction.

Who we share it with

• Matched installers — your contact details and quote-request details are shared with the specific installer(s) matched to your request, so they can prepare and deliver your quote.
• Identity verification providers— we send the identifiers above to Dojah Technologies Limited (Nigeria), a licensed provider, which checks them against official databases (for example the National Identity Management Commission for NIN, and the Corporate Affairs Commission for company registration). Dojah processes this data under a written agreement with us. We do not store your NIN or BVN — we keep only the fact and date a check was done, a reference, its result, and an encrypted copy of the provider's response.
• Payment processor — Paystack (Nigeria) processes installer subscription payments. Customer milestone payments are by direct bank transfer and are confirmed manually by our team.
• Service providers — application hosting (Render), website hosting (Vercel), our database and file storage (Supabase), transactional email (Resend) and AI-assisted text processing (Anthropic), which process data on our instructions to run the platform.
• NEMSA— for certificate verification, our team checks a submitted certificate number against NEMSA's public records or with the issuing office.
• Legal — authorities, regulators or advisers where required by law or to establish or defend legal claims.

We do not sell your personal data.

Transfers outside Nigeria

Some of our service providers store or process data outside Nigeria: application hosting (Render, Oregon, United States), website hosting (Vercel, United States), our database and file storage (Supabase, Ireland), transactional email (Resend, United States), and AI-assisted text processing (Anthropic, United States). Identity verification (Dojah) and payment processing (Paystack) take place in Nigeria. Where data leaves Nigeria it is transferred to processors bound by written data-processing agreements with contractual safeguards, and, where relevant, on the basis of your consent or the necessity of providing the service you have asked for.

How long we keep it

• Account and contact data — while your account is active, then 24 months.
• Quote, project and milestone records — 6 years after the project closes (contract and tax records).
• Payment records — 6 years.
• Identity verification result, date and reference (we do not keep the NIN or BVN itself) — while your account is active, then 6 years, so we can show a check was properly done.
• Documents you upload for NEMSA readiness — for the life of your installer account, then deleted within 6 months.
• Pseudonymous research events — kept in aggregated form; because they are not linked to your identity they are not deleted when an account closes.
• Support correspondence — 24 months.

Verification providers keep source data under their own retention policies.

Automated checks and your right to a human review

A verification result may be produced automatically. We do not reject an installer or a customer on an automated result alone — where a check does not pass, a member of our team reviews it before any decision, and you can ask us to look again and give us more information.

Your rights

Under the Nigeria Data Protection Act you can ask us to give you a copy of your personal data, correct it, delete it, restrict or object to certain processing, or provide it in a portable form. To exercise a right, contact hello@petgrave.io; we will respond within 30 days. You can also complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

Security

We use encryption in transit and at rest for personal data, access controls that limit staff access to what their role needs and log that access, and we do not store raw national identification or bank numbers in our own systems. No system is perfectly secure; if a breach affects your rights we will act on it in line with our obligations to the Nigeria Data Protection Commission and to you.

Children

Suny is not directed at people under 18 and we do not knowingly collect their data.

Changes

We may update this policy as the platform develops. We will post the new version here with an updated date, and for a significant change affecting how we use your data we will tell you directly.

Contact

Petgrave.io Technologies Limited
Data Protection Officer: Fitzroy Petgrave
hello@petgrave.io
+234 803 295 9146
House 6, IPENT 4 Extension, Lokogoma, Abuja, FCT, Nigeria