Privacy Policy

Personal Information:

• Full name and email address
• Phone number and WhatsApp number
• Business name, registration number, and business address
• Payment information (processed by Paystack, not stored by Xpens)
• Profile photo (optional)

Financial Data:

• Expense records you create
• Invoice and client data
• Bank transaction data (via Mono API)
• Payroll and employee information
• Tax records and returns

Technical Data:

• IP address and device information
• Browser type and operating system
• Pages visited and features used
• Log files and error reports

We use your information to:

• Provide, operate and improve the Xpens platform
• Sync your bank transactions automatically (via Mono API with your consent)
• Send invoices and payment notifications via WhatsApp (via Twilio)
• Process payments via Paystack
• Generate payroll, tax returns and financial reports
• Send important service notifications
• Provide customer support
• Comply with legal obligations in Nigeria
• Prevent fraud and ensure security

We do NOT:

• Sell your personal data to third parties
• Use your financial data for advertising
• Share data with competitors
• Store your bank login credentials

We share data only with:

Mono Technologies (Bank Data): Purpose — bank account connection and transaction synchronisation. Data shared — bank account identifiers. Privacy — mono.co/privacy

Paystack (Payments): Purpose — payment processing for Pro subscriptions. Data shared — email and payment intent. Privacy — paystack.com/privacy

Twilio (WhatsApp/SMS): Purpose — sending invoices and notifications. Data shared — phone numbers and message content. Privacy — twilio.com/legal/privacy

OpenAI (AI Features): Purpose — expense categorisation and AI insights. Data shared — anonymised transaction descriptions. Privacy — openai.com/privacy. Note: no personally identifiable information is shared with OpenAI.

Vercel (Hosting): Purpose — application hosting and delivery. Data shared — request logs. Privacy — vercel.com/legal/privacy-policy

Neon (Database): Purpose — secure data storage. Data shared — your platform data. Privacy — neon.tech/privacy-policy

We protect your data through:

• AES-256 encryption at rest
• TLS 1.3 encryption in transit
• Regular security audits
• Role-based access controls
• Secure session management
• Bank credentials never stored (handled entirely by Mono)

As a data subject under Nigerian law, you have:

Right to Access: Request a copy of all personal data we hold about you.

Right to Rectification: Request correction of inaccurate data.

Right to Erasure: Request deletion of your data (subject to legal retention requirements).

Right to Data Portability: Export your data in CSV format from Settings → Export at any time.

Right to Object: Object to processing of your data for specific purposes.

Right to Lodge a Complaint: Contact NITDA at nitda.gov.ng if you believe your rights have been violated.

To exercise any right, email privacy@xpens.com.ng. We respond within 30 days.

Active accounts: Data retained while the account is active.

Cancelled accounts: Data retained for 90 days then permanently deleted.

Financial records: May be retained for 7 years to comply with Nigerian tax law (FIRS requirements).

Anonymised analytics: Retained indefinitely.

We use essential cookies only:

• Session authentication cookies
• Security tokens
• User preference cookies

We do not use advertising or tracking cookies.

Xpens is not intended for users under 18 years of age. We do not knowingly collect data from minors.

We will notify you of material changes via email or in-app notification at least 14 days before they take effect.

Data Controller:
Careerlinkk Digital Ventures Ltd (RC 9652318)
Lagos, Nigeria
www.careerlinkk.com

Privacy enquiries: privacy@xpens.com.ng
General: admin@xpens.com.ng
WhatsApp: +2349025941488

Supervisory Authority:
National Information Technology Development Agency (NITDA)
nitda.gov.ng