Privacy Policy

1. Two kinds of data, two roles

• Your account data: your name, email, password and business details. We decide how this is used, so we are the data controller.
• Your customers' data: the names, emails, phone numbers and addresses you put on quotations and invoices. You decide how this is used, so your business is the controller and we process it on your behalf, only to provide PayTrail, under our Data Processing Agreement.

2. What we collect

• Account details: name, email address, password (stored securely by our login provider; we never see it in plain text).
• Business details: business name, address, phone, tax ID, logo, brand colour, bank details you choose to print on invoices.
• Documents and records: quotations, invoices, receipts, line items, hidden cost lines, payments and activity history.
• Customer details you enter, and a customer's name if they accept a quote.
• Payment provider connection details: your secret keys are encrypted before storage and are never shown back to anyone.
• Payment results from providers (amount, currency, reference, status). We do not receive or store card numbers; customers enter those on the provider's own page.
• Basic technical data such as IP address and browser type, used for security, preventing abuse and fixing problems.

3. Why we use it

• To provide PayTrail: create your documents, send them, show your customers their link, and record payments (to perform our contract with you).
• To bill you for your PayTrail plan (contract).
• To keep PayTrail secure and prevent fraud (legitimate interests and legal obligations).
• To send service emails such as sign-up confirmation, password resets, invitations and documents you choose to send (contract).
• To answer support requests (legitimate interests).

We don't sell personal data, and we don't use your customers' data for our own marketing.

4. Who we share it with

Only with service providers who help us run PayTrail, under agreements that protect the data. The full, current list is on our sub-processors page.

• Hosting and database (for example Supabase and Vercel), which store and serve the app and its data.
• Email delivery providers, to send account emails and the documents you choose to email.
• Payment providers you connect (Stripe, Paystack, Flutterwave or Bachs), to take payments for you, and the provider we use to bill PayTrail plans.
• Authorities, where the law requires it.

5. International transfers

Some of our providers store or process data outside Nigeria (for example in the EU or the US). When that happens we rely on safeguards permitted by the Nigeria Data Protection Act, such as contractual protections and providers with recognised security standards.

6. How long we keep it

We keep your account and business records while your account is open, so your documents and receipts remain available. When an owner deletes a business, it and everything in it (customers, documents, payments, receipts, logo) is permanently deleted 30 days later; backups expire shortly after. When you delete your own account, your login and profile are removed immediately. We keep records of payments made to PayTrail for plans for 6 years, as Nigerian tax law requires.

7. How we protect it

• Each business's data is separated at the database level, so one business can't read another's records.
• Hidden cost lines are only visible to team members allowed to see them.
• Payment provider keys are encrypted at rest, and all traffic uses HTTPS.
• Customer document links use long random codes that can't be guessed.

8. Your rights

You can ask to access, correct, delete or receive a copy of your personal data, object to or restrict how we use it, and withdraw consent where we rely on it. Most of this you can do yourself: edit your details in the app, and in Settings → Privacy & data download a complete copy of your data or delete your business or account. For anything else, email us and we'll reply within 30 days. If you're one of our users' customers, contact that business first; we'll help them respond. You can also complain to the Nigeria Data Protection Commission (or your local data protection authority).

9. Cookies

PayTrail uses only essential cookies, to keep you signed in and secure. Your light or dark display choice is saved in your browser. We don't use advertising cookies.

10. Children

PayTrail is for businesses and isn't meant for anyone under 18.

11. Changes

We may update this policy. If a change is significant, we'll tell you by email or in the app.

12. Contact

Privacy questions or requests: support@paytrail.app.