TheBigShiftStudio

KLED BROKE OUR LAWS. @ndpcngr look into this. I am making this last post before i put it to rest. Kled AI collected personal data from 25,000 Nigerians, sold it to AI labs and governments, then IP-banned the entire country. What they did not tell you is that while they were operating in Nigeria, they appear to have been breaking Nigerian law. Here is the legal case, point by point, with every source linked. FIRST. UNDERSTAND WHAT KLED ACTUALLY IS Kled, registered as Nitrility Inc., is not a neutral tech platform. By their own published terms of service (app.kled.ai/terms), the moment you upload anything to Kled, you are not just sharing content. You are irrevocably selling it. Their exact words: "YOU UNDERSTAND AND AGREE THAT YOU ARE IRREVOCABLY SELLING SUBMITTED CONTENT TO COMPANY TO BE USED FOR ANY PURPOSE." They then grant themselves the right to "sell, share, sublicense, transfer and/or distribute Submitted Content to our affiliates, our customers, partners and/or prospective customers and partners to be used for any purpose, including without limitation the development of artificial and machine learning products." Their own website (kled.ai) states they power the world's leading AI companies, governments, and research institutions. Your photos, videos, and identity documents were being sold the moment you hit upload. But here is the part that exposes the entire "we pay you fairly" narrative as a trap. Their terms also contain this clause: "If the consents, covenants, releases and/or rights granted to Company are deemed legally unenforceable or otherwise revoked, reversed, invalidated, or withdrawn with respect to any Submitted Content, then you are required to immediately refund to Company any compensation you previously received in connection with such Submitted Content." Read that again. If a Nigerian court or the NDPC ever rules that their consent clause is unenforceable under Nigerian law, Kled can legally demand every naira they paid you back. They built a clause to reclaim payments the moment their legal framework gets challenged. They did not come to empower you. They came to extract from you, and they made sure they could take back even the few dollars they offered if anyone tried to hold them accountable. That is not fair compensation. That is a legal trap dressed as an opportunity. VIOLATION ONE: OPERATING WITHOUT NDPC REGISTRATION The Nigeria Data Protection Act 2023 classifies any organization that processes the personal data of more than 200 Nigerian users within six months as a Data Controller of Major Importance. That classification triggers a mandatory legal obligation to register with the Nigeria Data Protection Commission before operating at scale. Kled had 25,000 Nigerian users. The NDPC maintains a public register of all compliant organizations here: services.ndpc.gov.ng/repo/?f… Search for Kled or Nitrility Inc. yourself. They are not on it. ( I have provide screenshots below) Operating on Nigerian user data at that scale without NDPC registration is a direct violation of the Act. VIOLATION TWO: PROCESSING DATA AFTER CONSENT WAS COMPROMISED By his own public admission, Nigerian users were actively submitting KYC documents through Kled's verification system. He stated this himself in his original post when he described being "flooded with thousands of fake Japanese passports and identity cards with Nigerians photoshopped onto them" in their KYC system. The NDPA requires that when a user's ability to complete the consent process is blocked or their data is rejected, all processing of their personal data must stop immediately. But Kled's own App Store developer responses, which you can verify yourself (apps.apple.com/ca/app/kled/i…), show a pattern of telling users that uploaded content remains in processing even after their accounts are rejected or flagged. Their terms of service (app.kled.ai/terms) confirm this further, stating explicitly that if consent is ever deemed unenforceable, the company retains the right to reclaim payments while making no commitment to delete the data already collected. Nigerian users went through KYC. He confirmed that himself. Their data was retained after rejection. His own terms confirm that. Under the NDPA, that is unlawful data processing. VIOLATION THREE: UNLAWFUL CROSS-BORDER DATA TRANSFER The NDPA is explicit. Nigerian user data can only be transferred abroad if the receiving organization provides a level of data protection substantially equivalent to Nigerian law (cookieyes.com/blog/nigeria-d…). Kled's business model is selling Nigerian user data to AI labs, governments, and research institutions internationally. Their own terms of service (app.kled.ai/terms) confirm they sell, share, sublicense, transfer and distribute submitted content to customers, partners, and prospective partners for any purpose. Nowhere in their privacy policy (kled.ai/privacy-policy) do they disclose whether those buyers meet Nigeria's data adequacy standards. That is not a minor oversight. That is a legal violation. Their governing law clause makes it even worse. Their terms state: "This Agreement shall be governed by the laws of the State of Delaware." Nigerian law is not mentioned anywhere in their entire terms of service. They designed this contract to operate entirely outside Nigerian legal jurisdiction while collecting data from Nigerian citizens. VIOLATION FOUR: NO DATA PROTECTION OFFICER Under the NDPA and the GAID 2025 (ndpc.gov.ng/wp-content/uploa…), every Data Controller of Major Importance must appoint a qualified Data Protection Officer to monitor compliance, handle user rights requests, and liaise with the NDPC. Kled processed the data of 25,000 Nigerians at millions of uploads per day. They have never publicly disclosed the appointment of a DPO for their Nigerian operations. VIOLATION FIVE: NO COMPLIANCE AUDIT FILED Data Controllers of Major Importance are required to conduct annual compliance audits and submit Compliance Audit Returns to the NDPC (ndpc.gov.ng/faqs). A company that processed 10 million uploads from Nigerian users, collected biometric identity data through KYC, and sold that data to third parties internationally, has no public record of submitting a single compliance audit to Nigeria's data protection authority. THE PRECEDENT THEY SHOULD BE WORRIED ABOUT The NDPC and FCCPC jointly fined Meta $220 million for the same category of violations, including unauthorized data collection, failure to file a compliance audit, and unlawful cross-border data transfers. That fine was upheld by a Nigerian tribunal on April 25, 2025 (fccpc.gov.ng/violations-trib…). The NDPC has also launched formal investigations into Temu over improper handling of Nigerian user data. This is not a toothless regulatory environment. It is a live one. Kled processed data from 25,000 Nigerians, transferred it internationally to unnamed AI labs and governments, collected biometric identity information through KYC, built a contract designed to reclaim payments if their legal framework is ever challenged, and did all of this without registering with the NDPC, without appointing a Data Protection Officer, without filing a compliance audit, and without disclosing whether their data buyers meet Nigerian legal standards. That is not a business decision. That is a compliance failure with legal consequences. WHAT YOU CAN DO RIGHT NOW If you are a Nigerian who uploaded data to Kled, you have rights under the NDPA. You have the right to know what data they hold on you, the right to request deletion, and the right to know exactly who they sold your data to. File a formal complaint directly with the Nigeria Data Protection Commission here: ndpc.gov.ng Read the full NDPC resources and official documents here: ndpc.gov.ng/resources They banned Nigeria. Nigeria has a law. Use it. @ndpcngr Please take this seriously.