Privacy Policy

Build Scalably operates NairaFlow App. We handle data in line with the Nigeria Data Protection Act 2023 (NDPA). This policy applies to the web app, mobile app, Telegram bot, WhatsApp channel, and the API behind them.

1. What we collect

• Account data (owner): email (required, unique), password (bcrypt hash), optional phone and PIN, session refresh token hash.
• Business profile: name, type, category, state, city, address, logo URL, bank details, reminder time, email, owner name, subscription plan/dates, verification status.
• Records you enter: contacts, transactions, inventory, debts/invoices/supplier invoices, projects/bookings/properties/reviews, staff (name, phone, PIN hash, status).
• Assistant and messaging: conversation content, business memory, channel, user identifier. Voice notes are transcribed by an external provider.
• Technical / admin: API logs, rate limits, one-time codes (5 min), audit log entries, idempotency records. No payment card data; no tracking pixels.

2. Why we use it (legal basis)

Purpose	Basis
Account creation, sign-in, recovery	Contract performance
Store books, reports, invoices	Contract performance
Staff access, plan limits	Contract performance
Transactional email, codes	Contract performance
Assistant, Telegram, WhatsApp	Contract performance
Security — rate limiting, abuse prevention, audit	Legitimate interests
Accounting, tax, legal claims	Legal obligation / legitimate interests

We do not sell personal data, and we do not use business data to train models.

3. Automated processing and the AI assistant

The assistant answers questions about your records and proposes actions you confirm before they apply. To generate a response, your message and recent conversation history are sent to the NairaFlow App AI service along with identifying context (business ID, name, category, role, channel, request mode). Treat the assistant as a system that processes what you type — do not paste anything you would not want processed there.

Voice notes on WhatsApp are transcribed by an external speech-to-text provider before the assistant sees them. The audio is fetched from the messaging provider for transcription.

4. Who else is involved (sub-processors)

Provider	What it handles	Data involved
Cloud hosting	Runs platform; stores DB	All data
Brevo	Transactional email	Email, name, message content
Twilio	WhatsApp messaging	Phone, message content, voice media
Telegram	Bot channel	Chat ID, message content
Groq	Speech-to-text (WhatsApp voice)	Audio, transcript
NairaFlow App AI service	Assistant responses	Message text, history, business ID/name/category, role, channel

Where a provider processes data outside Nigeria, we rely on NDPA-required contractual protections. Enterprise customers may request the current provider list and locations.

5. Security measures

• Bcrypt (10 rounds) for passwords and PINs.
• JWT access/refresh tokens with rotation; sign-out invalidates stored refresh token.
• Tenant isolation: every business-scoped query filtered by business ID.
• Role-based access control (owner, staff, admin roles).
• Login rate-limited to 5 attempts/minute per IP.
• HTTPS with HSTS; headers include X-Frame-Options DENY, X-Content-Type-Options nosniff, Referrer-Policy, restrictive permissions policy.
• API docs disabled in production; error details hidden in production builds.
• Suspended businesses blocked at authentication.

6. Data retention

Data	Retention
Account, business profile, records	Indefinitely until deleted
One-time codes	5 minutes
Idempotency records	Until expiry window passes
Conversation history / memory	Until cleared or business deleted
Audit logs	Retained for accountability

There is currently no automatic purge based on inactivity.

7. Your rights (NDPA)

• Access, correct, delete, restrict or object to processing.
• Portable copy of data you provided.
• Withdraw consent where processing rests on consent.
• Complain to the Nigeria Data Protection Commission.

To exercise them: edit details in the app; export via CSV / PDF; clear assistant history in the app; request deletion of an account or business by emailing [email protected] (see Delete Your Account for what is removed); for anything else, contact the same address. We respond within the period required by law and may ask you to verify account control before acting.

8. Children

NairaFlow App is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child's data has been entered, contact [email protected].

9. Changes

We may update this policy. The effective date at the top shows the current version. Material changes will be communicated through the app or by email. Continuing to use NairaFlow App after a change means you accept the updated policy.

10. Data about your customers, suppliers and guests

The platform does not collect your customers' data on its own initiative — you enter it and decide what to keep. That makes you the controller of those records and NairaFlow App your processor. When your business is deleted, the records belonging to it are deleted with it.

11. Contact