Security
What happens to your recordings.
Photos and voices from a site are personal data. Here is where they live, who sees them, where Walknote AI runs, and how you get them back.
01Responsibility
Who is responsible for what.
You control what your team captures. Walknote processes it for you, with a cloud provider as our sub-processor. The privacy notice names it. For your account details, such as your name and work email, Walknote is the controller. A data-processing agreement is available on request.
02The law
The law we work to.
We work to the Nigeria Data Protection Act 2023 and the Commission’s 2025 implementation directive (the GAID). A breach is reported to the Commission within 72 hours and to you without delay.
03Storage
Where your data lives.
Reports, photos and recordings are stored on our cloud provider’s servers. The provider has no Nigerian region, so your data is stored outside Nigeria (the privacy notice links to its list of regions).
04Walknote AI
Where Walknote AI runs.
Walknote AI runs on our cloud provider’s servers. To transcribe a clip or draft a sentence, we send that clip, or the text and a working-size photo, to them. That can happen outside Nigeria and outside Africa, and we do not choose the country.
Under the Act this is a cross-border transfer, and your agreement with us records it. We send area and item names, never client names or phone numbers. The provider says it does not train on customer data without permission (its terms are linked from the privacy notice).
If your contract sets where data may be processed, raise it before you sign, through the demo form.
05Protection
How a report is protected.
Each photo is fingerprinted on the phone and again on our server, with the phone’s time kept beside our receipt time. Every edit joins a chained audit log. An approved report is frozen: a change makes a new version and the old one stays, marked superseded. Each version is signed and carries a QR code to the public check. We say “tamper-evident”, not “certified”.
What is recorded
- Photo fingerprint
- SHA-256, computed on the phone and again on the server
- Report signature
- Ed25519 over a manifest of every fingerprint and the report's own fingerprint
- Public key
- Download the public key
- Audit log
- Append-only; each entry is chained to the one before it
- Versions
- Immutable; a change creates a new version
06Access
Who can see what.
- Owner: everything, including billing and the team.
- Manager: publishes reports, edits templates, manages the team.
- Inspector: captures and reviews their own visits.
- Viewer: reads.
Share links are random and can be switched off by the sender. A link can be given an expiry. Shared report pages are not indexed by search engines.
07Retention
Keeping and deleting.
Signed reports and their evidence are kept for seven years from approval, or longer if your contract says so. The raw voice of people on site is kept for twelve months unless you keep it. The transcript and fingerprints stay, and a legal hold blocks deletion. The privacy notice sets this out in full.
08People
Recording people.
The app tells inspectors to avoid faces and children, and to say aloud that they are recording; it offers a short notice to read. Occupants’ words are marked as reported by them.
Questions
Short answers.
No. Walknote does not train any model on your recordings or reports, and the cloud provider that runs Walknote AI says it does not train on customer data without permission. The privacy notice names the provider and links to its terms.
What a team captures is controlled by its organisation, so ask the owner first. A signed report is kept for its retention period, and a legal hold blocks deletion. The privacy notice sets out your rights.