Privacy Policy

Nu Vibration Tech Hub LTD (RC 8902516), Lagos, Nigeria, is the data controller for Isiroego. This policy explains how we handle your personal data in line with the Nigeria Data Protection Act, 2023 (NDPA). Contact: support@isiroego.com.

• Account: your name, email, optional phone number, and a securely hashed password.
• Financial entries you add: amounts, categories, merchants, notes, budgets, goals, bills.
• Telegram: your Telegram user ID and username, only if you link the bot.
• Payments: via Paystack — card brand, last four digits, and a payment token. We never receive or store your full card number.
• Technical: IP address, device/browser information, and an essential session cookie, used to keep you signed in and to protect the Service.

• To provide the Service (record your entries, compute balances/insights) — performance of a contract.
• To process subscriptions and payments — contract / legal obligation.
• To secure the Service and prevent abuse (e.g., rate-limiting by IP, fraud prevention) — legitimate interest.
• To improve and develop Isiroego using aggregated and de-identified data to understand trends — legitimate interest.
• To send service messages (security, password reset, billing, important notices) — sent regardless of marketing preferences.
• To send marketing — only with your opt-in consent, which you can withdraw anytime.

We use a single essential session cookie to keep you logged in. We do not use advertising or third-party analytics/tracking cookies.

Marketing emails are opt-in; you can unsubscribe at any time. Unsubscribing from marketing does not stop essential service/transactional messages (e.g., password recovery, security, billing).

We do not sell your personal data. We share limited data with trusted providers who process it on our behalf. These are the providers and their purposes, respectively: Paystack — payment processing; Telegram — bot messaging (if you link it); Supabase — database hosting; Vercel — website hosting; Render — backend hosting; Upstash — rate-limiting and abuse prevention; Sentry — error monitoring; and Resend — sending emails.

Some providers process data outside Nigeria (e.g., in Europe/US). Where we transfer data internationally, we take steps to ensure it is protected under safeguards consistent with the NDPA.

The Service is for people 18 and over. We do not knowingly collect data from anyone under 18 who registers independently. A minor may appear only as a family member added by a parent/guardian, who consents to and is responsible for that data.

We keep your data while your account is active. You can request deletion at any time, and we will delete your personal data, except limited records we must keep for legal, accounting, or fraud-prevention reasons (e.g., payment records).

You have the right to access, correct, delete, or port your data, to object to or restrict certain processing, and to withdraw consent. To exercise these, email support@isiroego.com. You may also complain to the Nigeria Data Protection Commission (NDPC).

We protect your data with hashed passwords, encryption in transit, tokenized (never raw) card storage, access controls, and rate-limiting. No system is perfectly secure, but we work to keep your data safe and will notify you and the NDPC of a breach where required.

We may update this policy and will post the new version, with notice for material changes.

Questions or data requests: support@isiroego.com. You may also contact the Nigeria Data Protection Commission (NDPC).