Privacy policy
How FinNGO collects, uses and protects personal data.
Who we are
FinNGO is provided by [legal entity name], [registered address] ("we"). For the accounting and HR records your organisation keeps in FinNGO, your organisation is the controller and we process that data on its behalf under our data processing terms. For your account details and how you use the service, we are the controller.
Questions and requests: privacy@finngo.app. [Data protection officer details, where required.]
What we collect
- Account details: your name, email address, password (stored only as a hash) and two-factor settings.
- Organisation records you enter: accounts, journals, grants, donors, vendors, staff records, payroll and attachments.
- Usage and security data: sign-in times, IP address, browser, and an audit trail of changes to financial records.
- Billing details: the plan, amounts and payment references. Card and bank details are handled by our payment provider and never reach us.
Why we use it
- To provide the service your organisation signed up for (contract).
- To keep accounts secure, prevent fraud and keep audit trails (our legitimate interests, and your organisation's legal obligations).
- To bill for the service and keep tax records (legal obligation).
- To send service messages such as renewal reminders. We do not send marketing without consent.
Who we share it with
We use the following processors, each bound by a data processing agreement:
| Processor | Purpose | Location |
|---|---|---|
| Supabase | Database, sign-in and file storage | London, United Kingdom |
| Vercel | Hosting the application | [region] |
| ZenPay and Paystack | Taking payments | Nigeria |
| Resend | Sending email | [region] |
| Sentry | Error monitoring | [region] |
| Upstash | Rate limiting | [region] |
| OpenAI | Optional account suggestions, only when your organisation turns this feature on | United States |
Where data leaves Nigeria, the United Kingdom or the European Economic Area, we rely on [adequacy decisions, standard contractual clauses or the equivalent safeguards under the Nigeria Data Protection Act 2023].
How long we keep it
Financial records are kept for as long as your organisation keeps its account and for [six] years after it closes, to meet accounting and tax record-keeping rules. Account and usage data is deleted [within 90 days] of an account closing, unless the law requires longer.
Your rights
Under the Nigeria Data Protection Act 2023, the UK GDPR and the EU GDPR you can ask to see, correct, export or delete your personal data, object to or restrict its use, and withdraw consent. Make a request from your profile page in FinNGO or by email. For records your organisation keeps about you, we will pass your request to your organisation.
You can complain to the Nigeria Data Protection Commission, the UK Information Commissioner's Office or your local supervisory authority.
Security
Data is encrypted in transit and at rest, each organisation's records are isolated at the database level, and two-factor sign-in is available to every user. See the security page for details.
Changes
We will tell account owners by email at least 30 days before a material change to this policy takes effect. Last updated: [date].