Privacy Policy

Savey Technologies Ltd ("Savey", "we", "our") takes the protection of your personal information seriously. This Privacy Policy explains how Savey processes your personal data and the lawful bases we rely on for that processing. Where consent is required, we will ask for it separately and transparently, and you can withdraw it at any time.

We collect information you give us directly, such as your name, date of birth, BVN, NIN, phone number, email address and residential address when you create an account. As part of identity verification, which CBN KYC rules require, we also collect a facial image (selfie) and a liveness check result to confirm you are a real person and that you match your verified identity record. We tell you about this before your camera opens. If you apply for a higher account tier, we also collect supporting documents such as a utility bill or bank statement as proof of address. We also collect transaction data, device information, IP addresses and usage patterns automatically when you use the app. If you use Rainy Day or Savings Pots, we also collect the names and targets of your pots, the amounts you set aside, and your automatic set-aside settings.

Your Bank Verification Number and National Identification Number are used to verify your identity in line with CBN Know Your Customer (KYC) regulations. BVN and NIN lookups are done through licensed third-party identity verification providers operating under Nigerian law. Your BVN and NIN are stored securely, encrypted at rest and accessible only to authorised systems, for as long as your account is active and for seven (7) years after it is closed, in line with CBN and AML/CFT recordkeeping requirements (see Section 10). We use them only for identity verification and regulatory compliance, and we do not share them beyond what Section 7 describes. Your selfie and liveness result are handled the same way: they are encrypted, they are processed only by Savey and our licensed identity verification provider, and they are kept with your KYC record (see Section 10).

We use your information to create and manage your Savey account; to process transactions and payments; to run Rainy Day and Savings Pots, including setting aside and releasing your money; to give you personalised budgeting and savings insights through Seva AI; to send you transactional notifications and security alerts; to comply with legal and regulatory obligations; and to improve our services through anonymised analytics.

We process your personal data only where we have a valid legal basis under the Nigeria Data Protection Act (NDPA) 2023. Depending on the activity, that is one of the following. • Contract: to create and manage your account and provide the core Savey service, including processing transactions, maintaining your wallet and running Rainy Day and Savings Pots, because this is necessary to perform our agreement with you. • Legal obligation: to collect and verify your NIN and BVN, to confirm your identity with a selfie and liveness check, and to report information to regulators, because CBN KYC and AML/CFT rules require it. Because the selfie check is a legal requirement for opening an account, we do not ask for your consent to it; we explain it to you before your camera opens. • Consent: where you have explicitly agreed. This covers activating Seva AI and optional marketing messages. You can withdraw consent at any time, and withdrawing does not affect processing that happened before you withdrew. • Legitimate interest: for fraud prevention and security monitoring, where we have assessed that this does not override your rights and interests. You can object to processing on this basis (see Section 11). Where we rely on legitimate interest, our Data Protection Officer assesses whether that basis is appropriate and whether your rights are unreasonably affected.

Seva is Savey's AI assistant. This section explains what it does with your data, what it does not do, and the choices you have. What Seva analyses. Seva analyses your in-app transaction history, and the pots and set-aside amounts you have created, to produce personalised spending and savings insights. Profiling. Yes, this is profiling. Seva builds a picture of your spending patterns so that its insights are relevant to you. That is all the profile is used for. Decisions. Seva looks at your transactions when you ask it to, and uses what it sees to choose which insights and suggestions to show you. That is a choice about content, not a decision about you. Seva does not approve or decline anything, does not set or change your account limits or tier, does not move money for you, does not affect whether you can use any Savey product, and is not used for credit or eligibility decisions. Because no decision is made solely by automated means, no automated decision about you produces legal or similarly significant effects. If that ever changes, we will update this policy first, ask for your explicit consent, and give you a way to have a person review the outcome and contest it. Human review. Because Seva chooses what to show you and does not decide anything about your account or access, there is nothing to review in the way a loan refusal would need review. If you think an insight is wrong or you want to question how it was produced, write to legal@getsavey.com and a member of our team will look at it. Your permission. When you open Seva, it asks for your permission before you can go further, and it does not analyse your data until you allow it. You can withdraw permission at any time by switching Seva off in Settings in the app. Analysis stops from that point. External AI providers. Seva runs on infrastructure that Savey controls. Your transaction data is not sent to any external AI provider. Retention. The insights and profile Seva derives from your data are kept only while you have given permission. If you withdraw permission, we delete or anonymise them (see Section 10). Selling data. We do not sell your data to third parties for advertising.

We may share your data with licensed payment processors, banks and other financial institutions to carry out transactions; with identity verification providers for KYC; with regulators when the law requires it; and with cloud infrastructure providers that are bound by data processing agreements. Some of your data is processed on infrastructure run by our hosting provider, which is located outside Nigeria, in the United States and/or Europe. Where this happens, we make sure the transfer meets the cross-border requirements of the NDPA 2023, including appropriate contractual and technical safeguards with our processors. We do not sell your personal information to anyone.

Savey uses industry-standard security measures, including 256-bit AES encryption for data at rest, TLS 1.3 for data in transit, and risk-based multi-factor authentication: an OTP is sent to your registered phone and email on new-device sign-in and for sensitive account actions. Your transaction PIN is stored as a one-way hash and cannot be read by Savey staff. We run an ongoing information security programme that includes periodic internal assessments.

A personal data breach is any event that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data we hold. We have an incident response process to deal with one, and this is how it works. • Identify and contain. Breaches are reported to us by our team, our systems, customers or partners, and we log each one. We act first to stop it: closing the access route, isolating affected systems and securing accounts. • Assess. We work out what happened, which data and which users are affected, and how serious the risk is to the people involved. • Notify the regulator. Where a breach is likely to put people's rights and freedoms at risk, we notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of it. We also inform our banking and payment partners and any other regulator where we are required to. • Notify you. Where a breach is likely to result in a high risk to you, we tell you directly and without undue delay, using the contact details on your account. Our message will say what happened, what data was involved, the likely consequences, what we are doing about it, and what you can do to protect yourself, such as changing your PIN or watching for suspicious messages. Savey will never ask you for your PIN or an OTP by call, SMS or email. • Fix and review. We remove the cause, restore affected services and check they work normally, then review what went wrong and change our controls. We keep an internal record of every incident, including those we decide do not need to be reported. If you suspect a problem with your account or data, contact us at legal@getsavey.com straight away.

We keep different categories of personal data for different periods, depending on why we collected it and on Nigerian regulatory requirements. • Account and KYC information (NIN and BVN verification records, identity documents, proof-of-address documents for Tier 2/3 upgrades): kept while your account is active and for seven (7) years after closure, in line with CBN and AML/CFT recordkeeping requirements. • Transaction records: kept for seven (7) years from the date of each transaction, as Nigerian AML/CFT regulations require. • Selfie and liveness verification data: kept with your KYC record, for the same period: while your account is active and for seven (7) years after closure, in line with CBN and AML/CFT recordkeeping requirements. We use it only for identity verification and regulatory compliance. • Rainy Day and Savings Pots: records of amounts set aside and released are transaction records, kept with your transaction history for seven (7) years. Pot names, targets and automatic set-aside settings are deleted within 90 days of an account-deletion request, like the other data we are not required to keep. • Seva AI insights and profile: kept only while you have given permission for the feature; deleted or anonymised if you withdraw it. • Marketing consent records: kept until you withdraw consent, plus a short period afterwards to show we complied. • Identity checks for rights requests: the information we use to confirm who you are when you make a request under Section 11 is not kept beyond what is needed to handle the request and keep a record that we dealt with it. Account deletion: deletion vs anonymisation. When you ask us to delete your account we split your data into two groups. First, records we are legally required to keep (transaction history, NIN/BVN verification records, identity documents) are anonymised, not deleted. We strip out your name, contact details and other direct identifiers so the remaining record can no longer be linked to you, and we keep the underlying transaction and verification data for the seven (7)-year regulatory period, after which it is permanently deleted. Second, all other personal data we are not required to keep (profile information, pot names and settings, Seva AI insights, marketing preferences, device and usage data) is permanently deleted within 90 days of your request. Once your data has been anonymised or deleted it is removed from active use across the app and cannot be used to identify you.

Under the NDPA 2023 you have the rights below. They are not absolute in every case, and where a legal obligation limits a right, we say so. • Be informed. To know what we collect, why, who we share it with and how long we keep it. This policy is that information; ask us if anything is unclear. • Access. To get a copy of the personal data we hold about you, and to know where we got it. • Rectification. To have inaccurate or incomplete data corrected. You can edit most details in the app; for details tied to your BVN or NIN, the correction has to match the official record. • Erasure. To ask us to delete your data. We will do this unless the law requires us to keep it. Transaction and KYC records, including your verification selfie, are covered by the seven-year retention rule in Section 10, so those are anonymised and not deleted until that period ends. • Restriction. To ask us to pause processing of your data while a dispute about its accuracy or our lawful basis is resolved. • Objection. To object to processing that relies on legitimate interest or is for direct marketing. Objection to marketing is always honoured. • Portability. To receive the data you gave us in a commonly used electronic format, or to ask us to send it to another provider where that is technically possible. • Withdraw consent. To withdraw any consent you gave at any time. You can switch Seva off yourself in Settings; for marketing messages, email us. Withdrawal does not affect what was done before. • Automated decisions. To not be subject to a decision based solely on automated processing, including profiling, that has legal or similarly significant effects on you, and to ask for human review if one is ever made. Section 6 explains our position today. • Complain. To lodge a complaint with the Nigeria Data Protection Commission (NDPC), whether or not you have contacted us first (ndpc.gov.ng). We would still like the chance to put things right. How to make a request. Email legal@getsavey.com from the email address registered on your account. Tell us which right you want to use and give enough detail for us to act on it. Confirming it is you. Before we release or change anything, we confirm your identity so that your data does not reach someone else. We use the information we already hold: the request must come from your registered email address, and we then send an OTP to your registered phone number. We do not ask for new copies of your ID unless we cannot confirm your identity any other way, and if we do, we tell you exactly what we need and why, and we do not keep it longer than the request requires. How long it takes. We acknowledge your request promptly and respond within 30 days of receiving it, once we have confirmed your identity. If a request is complex or we have received several from you, we may extend this by a further period, and we will tell you before the 30 days are up and explain why. Cost. We do not charge for requests. We may charge a reasonable fee, or decline, only if a request is clearly unfounded or excessive, and we will explain our reasons. If you ask for a copy of your data in a special format that costs us extra to produce, we may ask you to cover that cost. If we say no. Where we cannot do what you ask, for example because a law requires us to keep the data, we tell you which right was affected, why, and that you can complain to the NDPC.

Savey is for people aged 18 and over. We do not offer our services to children, and we do not knowingly collect personal data from anyone under 18, which is the age of a child under Nigerian law. We ask for your date of birth when you create an account, and we do not knowingly open accounts for people under 18. If we find that we hold personal data about a child, for example because someone gave a false date of birth or a parent or guardian tells us, we take reasonable steps to deal with it promptly: we suspend the account, stop processing the data, and delete it, other than anything we are legally required to keep, which we keep only for as long as the law requires and use for no other purpose. We do not use a child's data for marketing or for Seva AI. If you are a parent or guardian and think your child has given us their information, contact legal@getsavey.com and we will act on it.

The Savey app uses anonymised analytics to understand how people use our features. We do not use advertising cookies. Analytics data is aggregated and cannot be used to identify individual users. You can opt out of analytics in Settings → Privacy at any time.

We may update this Privacy Policy to reflect changes in our practices or the law. We will tell you about material changes through an in-app alert at least 30 days before they take effect. If a change means we need your consent for something new, we will ask for it then, and we will not treat your continued use of the app as consent.

Savey Technologies Ltd is the data controller for your personal information and is registered with the Nigeria Data Protection Commission (NDPC) as a Data Controller/Processor (Registration ID: NDPC/DCP/14688). For privacy questions or to use any of your rights, contact our Data Protection Officer at legal@getsavey.com.