Privacy Policy

1. Data Controller

2. Information We Collect

You provide directly:

• Full name and phone number (required for AjoLedger)
• Password (stored as bcrypt hash — never in plain text)
• Email address (optional)
• Profile photo (optional)
• National Identification Number — only when you voluntarily verify identity on AjoLedger
• Business name and details (ProfitTrack)
• City, state, biography (optional)

Generated through use:

• Savings circle details, contribution records, payment history (AjoLedger)
• Sales records, inventory data, staff activity (ProfitTrack)
• Messages within your circles
• Reputation score from payment behaviour (AjoLedger)

3. NIN Verification (AjoLedger — Optional)

NIN verification on AjoLedger is entirely voluntary. When you choose to verify:

• You submit your 11-digit NIN
• We send it to Dojah (dojah.io) via encrypted API for a name-to-NIN lookup against NIMC
• We store only: the result (verified/not), a masked reference, and the name NIMC returned
• Your NIN is encrypted at rest using AES-256
• No photographs, selfies, or biometric data are involved
• Every admin access to your NIN record is permanently logged

4. How We Share Your Data

Within your circles (AjoLedger):
Other circle members can see your name, photo, contribution status, reputation score, and messages. They cannot see your phone number, email, or NIN.

Service providers:

• Dojah — NIN name lookup (only when you verify on AjoLedger)
• Twilio — WhatsApp/SMS reminders
• Paystack — Payment processing (PCI DSS certified)
• Cloudinary — Photo and file storage
• Neon / Render — Database and backend hosting

5. Your Rights (NDPA 2023)

• Access — request a copy of all your data within 30 days
• Rectification — correct inaccurate information
• Erasure — request account and data deletion within 30 days
• Portability — receive your data in JSON or CSV format
• Object — opt out of marketing and profiling at any time
• Withdraw consent — for NIN verification or marketing, at any time

6. Data Security

• All data in transit: TLS 1.2+
• Passwords: bcrypt hash
• NIN: AES-256 encryption at rest
• No biometric data collected or stored
• Immutable audit log — all actions permanently recorded
• Superadmin access to identity data requires mandatory logged reason

Data breach notification: NDPC within 72 hours, affected users without undue delay (NDPA 2023, Section 40).

7. Children's Privacy

All Profit Apps products are for adults aged 18 and above only.

• Users must confirm their age at registration — this is a legal declaration
• Accounts discovered to belong to minors will be immediately suspended and deleted
• Parents/guardians should report suspected underage accounts to support@ajoledger.ng

8. Contact Us