Privacy Policy

Nu Vibration Tech Hub LTD (RC 8902516), Lagos, Nigeria, is the data controller for Isiroego, registered with the Nigeria Data Protection Commission under NDPC/DCP/13815. This policy explains how we handle your personal data in line with the Nigeria Data Protection Act, 2023 (NDPA). Contact: support@isiroego.com.

• Account: your name, email, optional phone number, and a securely hashed password.
• Financial entries you add: amounts, categories, merchants, notes, budgets, goals, bills.
• Telegram: your Telegram user ID and username, only if you link the bot.
• Payments: via Paystack — card brand, last four digits, and a payment token. We never receive or store your full card number.
• Technical: IP address, device/browser information, and an essential session cookie, used to keep you signed in and to protect the Service.

• To provide the Service (record your entries, compute balances/insights) — performance of a contract.
• To process subscriptions and payments — contract / legal obligation.
• To secure the Service and prevent abuse (e.g., rate-limiting by IP, fraud prevention) — legitimate interest.
• To improve and develop Isiroego using aggregated and de-identified data to understand trends — legitimate interest.
• To send service messages (security, password reset, billing, important notices) — sent regardless of marketing preferences.
• To send marketing — only with your opt-in consent, which you can withdraw anytime.

We use an essential session cookie to keep you logged in, and one analytics identifier (stored in your browser as a cookie and local storage by PostHog, hosted in the EU) so we can count how the product is used — which pages are visited and which features are tried. Analytics records no amounts, merchant names, notes, or anything you type; we send only event names and coarse flags such as “a transaction was logged”. We do not use session replay, screen recording, heatmaps, or advertising/tracking cookies. If you sign in with Google, Google sets its own cookies on Google's pages under Google's policy.

Marketing emails are opt-in; you can unsubscribe at any time. Unsubscribing from marketing does not stop essential service/transactional messages (e.g., password recovery, security, billing).

We do not sell your personal data. We share limited data with trusted providers who process it on our behalf. These are the providers and their purposes, respectively: Paystack — payment processing; Telegram — bot messaging (if you link it); Google — sign-in only, if you choose “Continue with Google” (we receive your name, email address and Google account ID, never your password); Supabase — database hosting; Vercel — website hosting; Render — backend hosting; Upstash — rate-limiting and abuse prevention; Sentry — error monitoring; PostHog — product analytics (pseudonymous usage events, EU-hosted, see §4); and Resend — sending emails.

Some providers process data outside Nigeria (e.g., in Europe/US). Where we transfer data internationally, we take steps to ensure it is protected under safeguards consistent with the NDPA.

The Service is for people 18 and over. We do not knowingly collect data from anyone under 18 who registers independently. A minor may appear only as a family member added by a parent/guardian, who consents to and is responsible for that data.

We keep your data while your account is active. You can request deletion at any time, and we will delete your personal data, except limited records we must keep for legal, accounting, or fraud-prevention reasons (e.g., payment records).

You have the right to access, correct, delete, or port your data, to object to or restrict certain processing, and to withdraw consent. To exercise these, email support@isiroego.com. You may also complain to the Nigeria Data Protection Commission (NDPC).

We protect your data with hashed passwords, encryption in transit, tokenized (never raw) card storage, access controls, and rate-limiting. No system is perfectly secure, but we work to keep your data safe and will notify you and the NDPC of a breach where required.

We may update this policy and will post the new version, with notice for material changes.

Questions or data requests: support@isiroego.com. You may also contact the Nigeria Data Protection Commission (NDPC).