Privacy Policy

2. Personal data we collect

• Identity & account data: name, email address, phone number, password hash, profile preferences, and authentication tokens.
• Financial & tax data: bank account metadata, transaction history, income and expense records, tax estimates, filing period selections, and categorisation labels you apply in the product.
• Payment data: subscription plan, payment reference, transaction status, and amount paid when you purchase a PayPit subscription. We do not store your full bank login credentials.
• KYC / verification data: government ID details and verification status where required for compliance workflows.
• Technical & usage data: IP address, device and browser type, session identifiers, log files, and interaction events needed to secure and improve the service.
• Support communications: messages you send to our support team and related correspondence.

Some of the data above may qualify as sensitive personal data under the NDPA (for example, financial records linked to your identity). We process such data only where we have an appropriate lawful basis and apply enhanced access controls.

3. Purposes and lawful bases

Reading this policy does not constitute consent. Where consent is required, we request it separately through clear accept/decline controls (for example, our cookie banner or bank-connection consent screen).

4. Third-party processors and financial partners

We do not sell personal data. We share data with authorised third parties only when necessary to operate PayPit, under data processing agreements that require NDPA compliance:

• Mono (Mono.co): We use Mono Connect to let you securely link Nigerian bank accounts and import transactions for tax categorisation. Mono receives your consent directly through its Connect widget. We receive account identity, balances, and transaction data authorised by you — not your internet-banking password.
• Mono DirectPay: We use Mono's payment product to collect subscription fees for PayPit paid plans. Mono processes payment initiation and confirmation; we receive payment status, reference, and amount — not your full card or account credentials. DirectPay is used exclusively for PayPit platform subscription billing, not for tax remittance to NRS.
• Mono Prove: Optional identity verification (BVN/NIN KYC) is completed through Mono Prove. Mono processes identity checks on our behalf; we receive verification status and limited identity attributes required for compliance workflows.
• Cloud infrastructure providers: hosting, storage, encryption, and backup of application data within controlled environments.
• Identity providers: Google Sign-In, when you choose that login method, subject to Google's own privacy terms.
• Analytics providers (with consent): Google Analytics, Meta Pixel, and Microsoft Clarity on public marketing pages only, and only after you accept non-essential cookies.

5. Means of processing and security

• Data is processed electronically on secure servers with role-based access controls.
• Data in transit is protected with TLS encryption; sensitive data at rest is encrypted.
• Staff and contractors with data access are bound by confidentiality obligations.
• We monitor for unauthorised access and maintain incident response procedures.
• Session authentication uses HTTP-only cookies; we never request or store your bank login password.

6. Cookies and tracking technologies

• Necessary cookies: session authentication (connect.sid), security, and theme preferences. These are required for core functionality and do not require separate consent.
• Analytics cookies: Google Analytics, Meta Pixel, and Microsoft Clarity — deployed only after you click “Accept all cookies” on our consent banner.

You may withdraw cookie consent at any time by clearing site data in your browser or contacting privacy@paypit.ng. Withdrawing consent stops non-essential tracking but does not affect necessary cookies required to sign in.

7. Data retention and cross-border transfers

• We retain personal data only for as long as needed to fulfil the purposes described above, or as required by applicable law (for example, tax or audit obligations).
• Where a purpose is complete, we delete or anonymise data within six (6) months unless a legal justification requires longer retention (GAID Art. 49).
• If you close your account, see our Data Deletion page for the request process. Valid requests are processed within 30 days.
• Some processors (for example, analytics or cloud providers) may process data outside Nigeria. Where required, we rely on appropriate safeguards including contractual clauses and, where applicable, your explicit consent before transfer.

8. Your rights as a data subject

Under the NDPA 2023 (Part VI), you have the right to:

• Be informed about how your data is processed (this policy).
• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion (“right to be forgotten”) where applicable.
• Object to or restrict certain processing activities.
• Withdraw consent at any time, without affecting prior lawful processing.
• Data portability, where technically feasible.
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

To exercise any of these rights, email privacy@paypit.ng. We will verify your identity before acting on a request and respond within the timelines required by law.

9. Children, breaches, and policy updates

• PayPit is not directed at children under 18. We do not knowingly collect personal data from children. Contact us if you believe a child has provided data.
• If a personal data breach occurs that is likely to affect your rights, we will notify you and the NDPC as required under NDPA s. 40.
• We may update this policy to reflect legal, product, or operational changes. The effective date at the top will be revised, and material changes will be communicated through the website or by email where appropriate.

10. Contact and complaints