Privacy Policy

NairaHQ Limited (RC 9823098), a company registered in Nigeria, is the data controller for the personal data described in this Privacy Policy and determines why and how we process that data. This policy explains what we collect when you use nairahqapp.com and the NairaHQ Service, why we use it, who we share it with, how long we keep it, and the rights available under the Nigeria Data Protection Act 2023 (NDPA).

When a business customer enters personal information about its own customers, staff, contractors, or vendors into NairaHQ, that business generally acts as the controller for that information, and NairaHQ acts as a processor/service provider on the business's instructions.

Account information. Your name, email address, password credentials in protected/hashed form, business name, profile information, roles, permissions, preferences, and two-factor authentication information where enabled.

Business records. Information you or authorised users enter to operate the business, such as customers, vendors, invoices, bills, expenses, transactions, payroll entries, employee information, tax settings, products, services, projects, notes and uploaded files such as receipts.

Subscription and payment information. Subscription plan, billing details, payment status, payment references and related transaction metadata. Payments are processed by Paystack or another identified payment provider. NairaHQ does not receive or store your full card number or card security code.

Technical and security information. IP address, browser type, device and operating-system information, session information, login events, timestamps, pages or features used, security events, diagnostic information and similar logs used to operate and protect the Service.

Support communications. Emails, support tickets and messages you send through support channels or the website help assistant, together with information you choose to provide when asking for help.

Integration data. If you connect a third-party service, we may receive identifiers, access tokens, transaction information or other data required to provide the integration, depending on the provider and permissions you grant.

• To create and administer accounts, subscriptions and workspaces, and to provide requested features (performance of a contract).
• To process and confirm subscription payments and maintain billing records (performance of a contract and legal obligations).
• To authenticate users, support two-factor authentication, prevent fraud, detect abuse, investigate incidents, enforce access controls and maintain security logs (legitimate interests in protecting users, NairaHQ and the Service, and where applicable legal obligations).
• To send service communications such as verification emails, password resets, payment confirmations, renewal notices, security notices and material service updates (performance of a contract and legitimate interests).
• To provide customer support and respond to requests (performance of a contract and legitimate interests).
• To comply with tax, corporate, accounting, regulatory, court or law-enforcement obligations where legally required (legal obligation).
• To send marketing communications only where permitted by law and, where required, with your consent. You can opt out of marketing messages at any time.

We do not sell personal data. We do not use customer business records for third-party advertising.

If your business uses NairaHQ to store or process personal information about customers, employees, vendors, contractors or other people, your business is responsible for determining the lawful basis, providing required privacy notices, collecting any required consent, responding to individual rights requests, and configuring access appropriately. NairaHQ processes that information to provide, secure and support the Service and as otherwise permitted by the agreement with you and applicable law.

We use a limited number of service providers and integrations to operate NairaHQ. We share only the information reasonably required for the relevant service. Providers may include:

• Paystack, for subscription payment processing and payment confirmation.
• Laravel Cloud, our hosting and infrastructure provider; primary production data is hosted in the United States.
• Postmark, for transactional and service email delivery.
• Sentry, where enabled, for error monitoring and technical diagnostics.
• Professional advisers, auditors, insurers or service providers where reasonably necessary for legal, security, financial, compliance or business purposes and subject to appropriate duties of confidentiality.
• Courts, regulators, law-enforcement authorities or other parties where disclosure is required by applicable law or a valid legal process.

If you choose to connect another third-party integration, information may also be shared with that provider according to the permissions you grant and the provider's own terms and privacy policy.

NairaHQ is hosted on Laravel Cloud, and primary production data is stored on cloud infrastructure located in the United States. This means personal data is stored and processed outside Nigeria. For such transfers, NairaHQ applies the measures required by the Nigeria Data Protection Act, including appropriate contractual, organisational and technical safeguards. If our hosting provider or primary hosting region changes, we will update this policy.

We keep account and business records while the account is active. If a trial ends without a subscription, or a paid subscription lapses beyond the applicable grace period, we will ordinarily retain account and business data for up to 90 days so that the customer can renew, restore access or export available records. After that period, data may be deleted or anonymised, subject to legal or operational exceptions.

We may keep particular records longer when required or reasonably necessary for tax, accounting, corporate, fraud-prevention, security, backup, dispute-resolution, litigation or regulatory purposes. Security and authentication logs are ordinarily retained for up to 12 months, although specific logs may be kept longer where reasonably necessary to investigate an incident, comply with law or protect legal rights.

Backup copies may remain for a limited period after deletion from active systems and are generally used only for disaster recovery, security and continuity purposes until they are overwritten or expire under the backup schedule.

We use technical and organisational safeguards designed to protect personal data, including encrypted network connections, protected password storage, access controls, tenant or workspace separation, security logging, restricted production access, backups and restoration procedures. Two-factor authentication is included in every plan and may be required for particular roles, users or actions.

No online service can guarantee absolute security. If a personal-data breach occurs, we will assess it and make notifications to the Nigeria Data Protection Commission and affected individuals where the NDPA or other applicable law requires.

Subject to applicable conditions and exceptions, you may have the right to:

• access personal data we hold about you;
• ask us to correct inaccurate or incomplete personal data;
• ask for deletion of personal data in circumstances where deletion is legally available;
• object to or request restriction of certain processing;
• receive certain personal data you provided in a portable format where applicable;
• withdraw consent where processing is based on consent, without affecting processing carried out before withdrawal; and
• complain to the Nigeria Data Protection Commission (NDPC).

To exercise a right relating to data for which NairaHQ is the controller, email support@nairahqapp.com. We may need to verify your identity before completing a request. If your request relates to information controlled by a business customer, we may direct you to that business and assist it as required.

NairaHQ uses cookies and similar technologies that are necessary to provide and secure the Service, for example to keep sessions active, remember essential settings and protect forms against forgery. We do not use advertising cookies in the Service. If we introduce optional analytics, marketing or other non-essential cookies that require consent, we will provide an appropriate choice and update this policy.

We use Postmark to deliver transactional and service emails such as account verification, password reset, payment, subscription and security messages. We may also send product or marketing communications where permitted. Marketing messages will include an appropriate way to opt out, but you may continue to receive essential service and account communications while you use NairaHQ.

The help assistant on our website searches our Help Centre on our own servers; it is not a third-party chat service. If no article answers your question, we keep the question you typed, and nothing else about you (no name, email address or IP address), for 180 days so that we can write better help articles. If you choose "Talk to a person", the details you enter, together with the searches you made and the articles you opened in the assistant, are sent to our support team as a support ticket and kept with that ticket. Do not send passwords, full payment-card details or other sensitive information that is not needed for support.

NairaHQ is a business service and is not directed to children. You must be at least 18 years old to create a NairaHQ account. We do not knowingly invite children to create accounts or provide personal data directly to us through the Service.

If NairaHQ provides AI-assisted explanations, categorisation, summaries or business insights, the data used to provide those features will be processed for the purpose of delivering the requested functionality and protecting the Service. AI-assisted outputs may be inaccurate and should be reviewed before being used for accounting, payroll, tax, legal or financial decisions. If a third-party AI service is introduced, this policy will be updated to identify the relevant processing where required.

We may update this Privacy Policy when our services, providers, legal obligations or data practices change. If a change is material, we will provide reasonable notice by email, in-product notice or another appropriate method where practicable. The effective date at the top shows when the current version takes effect.

NairaHQ Limited (RC 9823098)
Data controller
Email: support@nairahqapp.com
Website: nairahqapp.com