Law Enforcement Request Policy
This policy explains how Xiam responds to requests from law enforcement and government authorities for user information or content removal.
1. Our General Approach
Xiam requires valid legal process before disclosing user information to law enforcement or government authorities, except in emergency situations involving imminent risk of death or serious physical harm, as described in Section 4. We review every request for legal sufficiency and scope before responding.
Xiam discloses only the information reasonably necessary to comply with a valid legal request and does not voluntarily provide additional information beyond what is legally required or necessary to address an emergency. Xiam may verify the identity and authority of the requesting agency and may require requests to be submitted through official channels before responding.
Xiam may refuse, narrow, or challenge requests that are: legally defective; overly broad or disproportionate; inconsistent with applicable law; technically impossible to fulfill; or in conflict with the rights and safety of users.
Unless legally required, Xiam does not provide law enforcement agencies with direct, continuous, or real-time access to user accounts, databases, or communications.
2. Types of Requests We May Receive
- Subpoenas, court orders, and warrants seeking account information, content, or other data
- Preservation requests asking us to preserve account data pending the issuance of formal legal process
- Content removal/takedown requests based on alleged illegality under local law
- Emergency disclosure requests involving imminent risk to life or safety
Preservation requests may result in temporary preservation of relevant account information for a reasonable period or as required by applicable law, after which normal retention and deletion schedules resume unless formal legal process is received. Xiam may also preserve account information, content, logs, and related metadata when reasonably necessary to investigate abuse, comply with legal obligations, respond to valid legal requests, or protect the safety of users and the public, independent of a specific preservation request.
3. Our Review Process
For each request, we evaluate:
- Whether it is legally valid and issued by a competent authority
- Whether it is appropriately scoped (not overly broad)
- Whether it complies with applicable Nigerian law and, where relevant, the law of the requesting jurisdiction
- Whether we are legally required to comply, legally permitted to comply, or should object
We may narrow, challenge, or decline requests we believe are invalid, overly broad, or not legally binding on Xiam.
4. Emergency Disclosure
Where we have a good-faith belief that an emergency involving imminent danger of death or serious physical injury to a person requires disclosure of information without delay, we may voluntarily disclose limited information to a competent authority, even absent formal legal process, solely to the extent necessary to address the emergency. Emergency disclosures are limited to information reasonably necessary to prevent the threatened harm and do not constitute a waiver of Xiam's general requirement for legal process.
5. User Notification
Where legally permitted, we will attempt to notify affected users before disclosing their information in response to a legal request. We may delay or forgo notification where prohibited by law (such as a valid non-disclosure order), where notification could endanger someone's safety, or where notification would compromise an active investigation (such as child safety matters).
6. Cross-Border Requests
Because Xiam uses infrastructure providers located outside Nigeria (Google Firebase/Google Cloud), we may receive requests from authorities outside Nigeria. Xiam generally requires foreign authorities to use appropriate international legal mechanisms, including mutual legal assistance processes, unless applicable law permits or requires otherwise or an emergency disclosure exception applies. We evaluate such requests under applicable international legal frameworks and in consultation with legal counsel.
Certain information requested by authorities may be stored or processed by third-party infrastructure providers, including Google Firebase and Google Cloud. In some circumstances, authorities may seek information directly from those providers pursuant to their own legal obligations and policies.
7. Child Safety Reporting
Separate from law enforcement requests we receive, Xiam proactively reports confirmed or suspected child sexual abuse material to applicable authorities as described in our Child Safety Standards Policy. This is not contingent on receiving a request — it is an obligation we act on independently.
8. Transparency
We may publish periodic transparency reports as our operational capacity grows, summarizing the volume and nature of law enforcement requests we receive and our response rates, consistent with our Transparency Report Policy, subject to any legal restrictions on disclosure.
9. Contact for Law Enforcement
Law enforcement and government authorities may submit requests to xiamformilo@gmail.com, including official letterhead, the requesting authority's contact information, and the specific legal basis for the request. [We intend to migrate to a dedicated legal/law-enforcement contact address, e.g., legal@xiamapp.com, as Xiam scales.]
10. Changes
We may update this policy as Xiam grows and applicable law evolves. Material changes will be noted in-app.