Privacy Policy
Draft for review by a Nigerian data-protection lawyer before public launch. Items in [brackets] must be completed.
Last updated: [date]. This policy explains how Silvawheel Digital Services Ltd ("we"), which operates TaxTrail, collects and uses personal data, in line with the Nigeria Data Protection Act 2023 (NDPA) and the General Application and Implementation Directive (GAID) 2025.
Who is responsible
For your account data (name, email, sign-in), we are the data controller. For the records you keep about your business, its customers and its employees, your business is the controller and we process that data on its behalf. Data Protection Officer: [name], privacy@taxtrail.ng. NDPC registration: [number].
What we collect
| Data | Why | Lawful basis |
|---|---|---|
| Email, password (hashed), optional authenticator factor | Your account and security | Contract |
| Business profile (name, Tax ID, RC/BN, address, VAT number) | Tax computations and reports | Contract |
| Bank transactions, invoices, receipts and documents you upload | Bookkeeping, tax computation, audit file | Contract |
| Payroll: employee names, TINs, state, pay | PAYE, pension and NHF schedules | Your legal obligation as employer; we process on your instruction |
| Payment references (no card details) | Paid plan | Contract |
| Error reports and basic usage events | Keeping the app working | Legitimate interest |
| Phone notification token (if you turn reminders on) | Deadline reminders | Consent |
Who else processes it
We use these service providers, under contract, only to run TaxTrail:
- Supabase — database, sign-in and file storage (region: [region])
- Vercel — hosting the web app
- Paystack — subscription payments (we never see your card)
- Resend — reminder emails; Expo — phone notifications
- Cloudflare — bot protection on sign-in (if enabled)
- Mono — bank connections you choose to make (read-only)
- Anthropic — reading receipts and suggesting categories, only when you press those buttons; the file or narration is sent for that request only; Anthropic does not use API data to train its models by default
- Your chosen e-invoicing access point provider — invoices you submit to NRS
Some providers store data outside Nigeria. Where they do, we rely on the transfer safeguards in Part VIII of the NDPA (adequacy or contractual safeguards).
How long we keep it
Business records are kept while your account exists so you can meet the six-year record-keeping rule. When you delete your account, businesses you alone own are deleted with their records and files; backups roll off within [30] days.
Your rights
You can access and download your data (Settings → Your data & account), correct it, delete your account, object to processing and withdraw consent (e.g. turn reminders off). Employees and customers of a business using TaxTrail should contact that business first. You may complain to the Nigeria Data Protection Commission.
Security
Encryption in transit, row-level access rules so only invited members can open a business, optional two-factor sign-in, an unalterable activity log, and limits on uploads and requests. No system is perfectly secure; we will notify you and the NDPC of a breach as the law requires.
Contact
privacy@taxtrail.ng · [postal address]