Privacy Policy

This policy explains how Akojo Digital Systems Limited (“Akojo”, “we”, “us”) handles personal data, in line with the Nigeria Data Protection Act 2023 and the General Application and Implementation Directive 2025 (together, “the Act”). It covers akojo.finance, the Akojo app at app.akojo.finance, and anyone who writes to us.

This is a notice, not a contract. You are not being asked to consent to it, and agreeing to our Terms of Use is not consent to anything here. Where we do need your consent, we ask for it separately (section 7).

1. (a)Personal data means information that identifies you or could be used to identify you.
2. (b)Connected account means a bank or wallet account you link through Mono.
3. (c)Provider means a company that handles personal data for us, named in section 8.
4. (d)The Commission means the Nigeria Data Protection Commission.

Akojo is a personal finance product run from Lagos, Nigeria by Akojo Digital Systems Limited, a company registered in Nigeria under RC 9854069. We decide how your personal data is used, which makes us its data controller. We are registered with the Commission as a data controller of major importance, registration NDPC/DCP/15119.

Our registered office is at 18A, Creek Haven Estate, Off Harris Drive, Ikota, Lagos State, Nigeria.

Our Data Protection Officer keeps this policy correct and answers questions about it, at dpo@akojo.finance.

We handle personal data fairly, lawfully and openly. We collect it for a stated purpose and do not use it for another that does not fit. We keep only what that purpose needs, keep it accurate and secure, and do not keep it longer than necessary.

We do not sell your data and we do not share it for advertising. We run no advertising at all, so there is no second half to that sentence. Our providers are bound by contract and may use your data only for the job we give them.

1. (a)To show you your own money: reading what you connect and send, naming and sorting transactions, and working out balances, spending and net worth.
2. (b)To answer you, when you ask the assistant something.
3. (c)To run your account: signing you in, keeping your devices and settings, and sending messages your account needs.
4. (d)To keep Akojo working and secure: finding faults, preventing abuse and investigating anything suspicious.
5. (e)To improve how Akojo reads money. We learn general patterns, such as how a bank lays out a statement or what a merchant sells, and use them for everyone. Those patterns are not about you and do not identify you.
6. (f)To meet the law, and to keep the record of what you agreed to and when.

Each of these handles only what its job needs.

Company and where

What it does, and what it sees

Supabase, France

Our database and file storage. Holds your account, transactions and files.

Vercel, servers in France, company in the United States

Runs the website and the app. Your requests pass through it.

Mono, Nigeria

Connects your bank account and retrieves balances and transactions, only for accounts you link yourself.

Anthropic, United States

Powers the assistant, reads your receipts and investment documents, and helps with statements, alerts and merchant names our own rules cannot read. It does not use your data to train its models.

Amazon Web Services, Ireland

Receives the bank alert emails you forward.

Resend, Ireland

Sends account emails such as sign-in codes and password resets.

Google, United States

Signs you in, only if you choose Sign in with Google.

Logo.dev, United States

Supplies merchant logos. It receives merchant names and web addresses, and your browser's IP address when it fetches a logo, but no amounts and nothing naming you.

TronGrid, outside Nigeria

Reads a Tron wallet's balance, and receives its address, only if you ask us to track one.

Exchange rates and the prices of stocks, crypto and gold come from market data services. We ask them for a symbol or a currency, and tell them nothing about you.

We use cookies to keep you signed in and to remember small things, such as your display currency and which notices you have seen. We do not use advertising cookies or third-party analytics cookies, so there is nothing to opt out of. Blocking cookies in your browser will stop you being able to sign in.

Apart from the providers in section 8, we share personal data only:

1. (a)when a law, a court or a regulator with authority over us requires it, and we will tell you unless we are forbidden to;
2. (b)when we need to, to investigate fraud or a breach of our Terms of Use, protect someone's safety, or establish or defend a legal claim; or
3. (c)if Akojo is sold or merged, with the new owner, who must keep to this policy. We will tell you before that happens.

Your data is stored and processed outside Nigeria, mainly in France, Ireland and the United States, because that is where our providers run. We make these transfers under sections 41 to 43 of the Nigeria Data Protection Act.

We use only providers bound by contract to protect your data, limited to the job we give them, and we send only what that job needs. Sending your data to them is also necessary to give you the service you asked us for. You can ask us for details of the safeguards at privacy@akojo.finance.

Answering the assistant and reading documents are the transfers most likely to include your transaction details. They go to Anthropic in the United States. Section 16 explains when.

What

How long

An address that asked for an invite

Until we have dealt with the request, or you ask us to remove it

Your account, transactions, budgets, receipts and everything you add

Until you delete them or close your account

Statement files, and the raw text read from them

90 days after you upload them. The transactions they produced stay.

Forwarded alert emails

The email's body for 30 days, or 90 if we could not read it. A record of its arrival, including the subject, stays while your account is open.

Transactions you delete

Recoverable for 90 days by default, then removed. You can change that period in Settings.

A closed account

Deleted straight away, along with your files and the record of what you agreed to. Your bank connections are ended at Mono too.

Copies in our database provider's routine backups expire on the provider's schedule and are not restored for any other purpose. If a law requires us to keep a particular record for longer, we keep that record only, only for as long as the law says, and delete it afterwards.

While we hold your personal data, you can:

1. (a)ask for a copy of it, or download it yourself with Export everything in Settings;
2. (b)have anything wrong corrected;
3. (c)have it deleted, which you can do yourself by deleting your account;
4. (d)ask us to restrict how we use it;
5. (e)object to our using it, including for direct marketing or automated processing;
6. (f)have it moved to another organisation, in a common format;
7. (g)withdraw any consent you gave; and
8. (h)complain to the Commission (section 18).

Write to privacy@akojo.finance. We will answer within the time the Act allows, and pass your request on to any provider it affects.

Your data is encrypted on its way to us and while stored. Account numbers have a further layer of encryption of their own. Files are held in private storage, and a copy you download comes through a link that lasts an hour. You can turn on two-factor sign-in, and see and end the sessions on your account.

No system is perfectly secure, and we will not tell you otherwise. If a breach is likely to put your rights at risk, we will report it to the Commission within 72 hours of learning of it, and tell you promptly if the risk to you is high, including what happened and what you can do.

We send messages your account needs, such as sign-in codes, security notices and notices you have turned on. You can manage the optional ones in Settings. We will send marketing email only if you have opted in, and every one will carry a way to stop.

The assistant answers questions about your own money, so answering one means sending the relevant parts of your data to Anthropic, in the United States. If you ask what you spent on fuel last month, the transactions needed to work that out go with the question.

It is not used to train their models. We send what is needed to answer and no more, and nothing goes to the assistant until you ask something.

Answers can be wrong. The assistant works from the data we hold, and that data comes from your bank, so an answer is only as current as the last time your accounts updated. It is a faster way to read your own records, not a second opinion on them.

We categorise your transactions and detect patterns such as recurring bills and your pay rhythm, automatically. This is profiling in the sense the Act uses, and it exists to describe your money back to you.

It produces no decision with a legal or similarly significant effect. We do not make lending decisions, we do not score you, and we do not pass any assessment of you to anyone else. You can correct any categorisation, and your correction takes precedence.

If you are unhappy with how we have handled your data, tell our Data Protection Officer at dpo@akojo.finance. You also have the right to complain directly to the Nigeria Data Protection Commission, at ndpc.gov.ng, at any time, whether or not you have come to us first.

When we change this policy, we publish a new version with a new date at the top of this page. If a change affects how we use your data, we will tell you before it takes effect and, where the Act requires it, ask you again.