Privacy Policy

Version 0.1-draft · Last updated 2026-05-11

This Privacy Policy explains how SnapTaxly ("SnapTaxly", "we", "us") collects, uses, and protects personal data when you use our bookkeeping and tax-compliance service. It is written to comply with the Nigeria Data Protection Act, 2023 (NDPA) and related regulations issued by the Nigeria Data Protection Commission (NDPC).

This document is a draft for closed-alpha use only. A counsel-reviewed version will replace it before public beta.

1. Who we are

SnapTaxly is operated from Lagos, Nigeria. For privacy enquiries, contact admin@snaptaxly.com.

For the purposes of the NDPA, SnapTaxly is a data controller in respect of account, billing, and product-usage data, and acts as a data processor in respect of transaction and tax data you provide while using the service.

2. Data we collect

We collect only what we need to provide the service. Categories include:

• Account information. Name, email address, password hash, phone number (optional), locale, and the marketing-communications preference you set.
• Business and tax profile data. Business name, business type (freelancer / limited company), industry, state of operation, staff and VAT status, and your Tax Identification Number (TIN) if you choose to provide one.
• Transaction data. Bookkeeping entries, statements, receipts, and other records you upload, sync, or enter manually. (Sprint 3+.)
• Computed tax data. Tax positions, obligations, and filing artifacts that SnapTaxly derives from your transaction data.
• Authentication and session data. Sign-in events, device and IP metadata, and active session identifiers.
• Support communications. Messages you send us and our responses.
• Audit logs. A record of mutations to sensitive entities (transactions, tax obligations, TIN records, tax profile versions, businesses, company profiles, memberships, tax credits, user profile fields) for compliance and security investigations.

3. Why we process your data

We process personal data on the following legal bases under NDPA §25:

• Performance of a contract — to provide the bookkeeping and tax assistance you signed up for.
• Legal obligation — to retain records required by Nigerian tax and anti-money-laundering law.
• Legitimate interest — to secure the service, detect abuse, and improve the product.
• Consent — where required (e.g., marketing emails). You can withdraw consent at any time without affecting prior processing.

4. Sub-processors

We use a small set of vetted vendors to deliver the service. Each is bound by a data-processing agreement consistent with NDPA §41 cross-border-transfer safeguards.

| Sub-processor | Purpose | | ------------- | --------------------------------------------- | | Anthropic | Large-language-model inference (Claude) | | Voyage AI | Document embeddings for tax-corpus retrieval | | Supabase | Managed Postgres + file storage (Cape Town) | | Railway | Container hosting for API and worker services | | Vercel | Static and edge hosting for the web app | | Resend | Transactional email delivery |

We will update this list when sub-processors change. A material change triggers a re-prompt for your consent.

5. Where we store your data

Production data is stored in the Cape Town, South Africa region of our Postgres provider (Supabase on AWS af-south-1). NDPA §41 permits cross-border transfer where appropriate safeguards are in place; storing in Cape Town keeps data on the African continent and minimises latency for Nigerian users.

6. Retention

• Active account data is retained for as long as your account is active.
• Account-deletion grace period. When you request deletion, your account is suspended and your data is purged after a 30-day grace period. During that window you may cancel the deletion request from a one-time link sent to your email.
• Audit logs are retained for the longer of seven years or the period required by applicable tax legislation.
• Backups are encrypted at rest and rotated on a rolling schedule.

7. Your rights under NDPA §35

You have the right to:

• Access — request a copy of the personal data we hold about you. Use Settings → Account → Download my data.
• Rectify — correct inaccurate or incomplete personal data. Use Settings → Profile and Settings → Business.
• Erase — request deletion of your account and associated data. Use Settings → Account → Delete account.
• Portability — receive your data in a structured, machine-readable format (JSON). The same export is used for both access and portability.
• Object / restrict — object to or restrict certain processing, including marketing. Use Settings → Notifications.
• Withdraw consent — where processing is consent-based, withdraw consent at any time.
• Complain to the NDPC — lodge a complaint with the Nigeria Data Protection Commission if you believe your rights have been violated.

We will respond to rights requests within 30 days.

8. Security

We protect personal data with the following measures:

• TIN encryption. Tax Identification Numbers are encrypted at the application layer with AES-256-GCM before storage. Decryption is gated by an explicit reveal flow that emits an audit log entry on every read.
• Multi-tenancy enforcement. Every database query is scoped to the active business via a Prisma middleware so one customer cannot read another customer's data.
• Audit logging. Mutations to sensitive entities are recorded automatically, including the actor identity and source.
• Transport security. All connections use TLS 1.2 or higher.
• Secret management. No secrets are stored in source code; production secrets are held in an encrypted vault and rotated on schedule.

9. AI processing

SnapTaxly uses third-party AI models (Anthropic Claude, Voyage AI embeddings) to categorise transactions, retrieve tax-corpus answers, and assist with filings. AI-driven mutations to your data require your opt-in and are recorded in the audit log with the model identifier. You can review and reverse AI-suggested actions before they take effect.

10. Children

SnapTaxly is not directed at children. You must be at least 18 years old to create an account.

11. Changes to this policy

When we publish a new version of this Privacy Policy, you will be asked to review and accept the updated version on next sign-in. The current version identifier is shown in the footer.

12. Contact

For privacy questions or rights requests, contact admin@snaptaxly.com.

This Privacy Policy is governed by the laws of the Federal Republic of Nigeria.

Version 0.1-draft · Last updated 2026-05-11