Privacy Policy

Kredo, operated by Ifeony Innovations (RC: 2984583, Victoria Island, Lagos, Nigeria), respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, share, and safeguard information when you use our platform, in compliance with Nigeria's National Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Act (NDPA) 2023.

1. Who We Are

Kredo is a business management SaaS platform operated by:

• Company: Ifeony Innovations
• RC Number: 2984583
• Registered Address: Victoria Island, Lagos, Nigeria
• Data Controller Email: hello@trykredo.com
• WhatsApp: +234 703 055 5998

As a data controller, we determine the purposes and means of processing your personal data. Where you store your customers' data on Kredo, we act as a data processor on your behalf.

2. What Data We Collect

We collect the following categories of personal data:

Category	Examples	Source
Identity Data	Full name, business name, profile photo	You (registration / profile)
Contact Data	Email address, phone number, business address	You (registration / profile)
Authentication Data	Hashed password, Google/LinkedIn OAuth tokens	You (registration) / OAuth providers
Financial Data	Revenue figures, invoice amounts, expense records	You (business activity)
Transaction Data	Payment references, subscription records, billing cycle	You + Paystack
Technical Data	IP address, browser type, device info, session ID	Automatic (platform logs)
Usage Data	Pages visited, features used, actions, timestamps	Automatic
Customer Data	Your customers' names, emails, phone numbers, purchase history	You (CRM input)
Staff Data	Staff names, roles, contact info, HRM records	You (staff management)
Communications	Support ticket content, messages sent to us	You
Referral Data	Referral / affiliate code, referring partner ID	URL parameter + cookie
API Usage Data	API keys generated, webhook endpoints, request logs	You (API configuration)

We do not collect special categories of sensitive data (health information, biometrics, political opinions, or religious beliefs). We do not knowingly collect data from individuals under 18 years of age.

3. How We Use Your Data

We process your data under the following legal bases:

• Contract performance: To deliver the Kredo services you subscribed to — document creation, invoicing, inventory management, HRM, accounting, etc.
• Legitimate interests: To improve our platform, prevent fraud, ensure platform security, and conduct product analytics
• Legal obligation: To comply with Nigerian financial, tax, and data protection laws
• Consent: For optional marketing communications (you may opt out at any time)

Specific uses include:

• Processing documents, receipts, invoices, purchase orders, and payroll on your behalf
• Sending transactional emails (welcome, password reset, document delivery, subscription alerts, receipts)
• Sending automated debt reminders (email, SMS, or WhatsApp) to your customers on your explicit instruction
• Processing subscription payments via Paystack and maintaining billing records
• Generating analytics, dashboards, and AI-powered forecasts for your account
• Detecting and preventing security threats, fraud, and unauthorized access
• Providing customer support and responding to enquiries
• Sending service announcements, product updates, and changelog notifications
• Tracking referrals and calculating affiliate commissions
• Processing API requests and delivering webhook events to your configured endpoints

4. Who We Share Your Data With

We do not sell your personal data. We share data only in the following circumstances, and only to the extent necessary:

• Paystack: For payment processing, subscription management, and refunds. Paystack's own Privacy Policy applies to data shared with them.
• Termii / SMS Providers: For sending automated SMS debt reminders and OTP messages on your instruction. Your customers' phone numbers are transmitted solely to deliver the requested SMS.
• WhatsApp / Meta Business Platform: For WhatsApp receipt sharing and customer notifications (Growth and Business plans). Meta's privacy terms apply to WhatsApp message delivery.
• SMTP / Email Service Provider: For transactional and notification email delivery. Email addresses are transmitted only to send the relevant emails.
• Hosting & Infrastructure Provider: Our cloud infrastructure provider stores data on servers located in Nigeria / West Africa where technically feasible.
• Google / LinkedIn: If you register via Google or LinkedIn OAuth, these providers share your name and email with us under your consent. We do not store OAuth access tokens long-term.
• Legal Authorities: We may disclose data if required by a valid Nigerian court order, subpoena, regulatory request, or law enforcement directive. We will notify you of such requests where legally permitted to do so.

All third-party processors are bound by appropriate data processing agreements. We do not share your data with advertisers.

5. Cookies & Tracking

Kredo uses only the following types of cookies and local storage:

• Session cookies: Required for authentication state management (login sessions). These expire when you close your browser or after 30 minutes of inactivity.
• Security cookies: CSRF tokens to protect against cross-site request forgery attacks.
• Preference cookies: Store UI preferences such as theme or language settings.
• Referral cookies (kredo_ref): Store an affiliate/referral code (if you arrived via a referral link) for up to 30 days to attribute registrations to the correct partner. See Section 6 below.

We do not use advertising cookies, cross-site tracking cookies, Google Analytics, Facebook Pixel, or any third-party analytics or remarketing scripts on our platform.

6. Referral & Affiliate Code Tracking

If you visit any Kredo page via a referral link (e.g., trykredo.com?ref=PARTNERCODE), the referral code is:

• Stored in your browser session for the duration of your visit
• Stored in a first-party cookie (kredo_ref) on your device for up to 30 days

This cookie is used solely to attribute any account registration you complete within 30 days to the referring affiliate partner, so they receive appropriate commission. No personal data is shared with affiliate partners as part of this tracking — only an anonymized commission event is recorded on our end.

You may clear your cookies at any time to remove referral tracking.

7. WhatsApp & SMS Communications

When you use Kredo to send WhatsApp messages or SMS notifications to your customers, the following applies:

• Your customers' phone numbers are transmitted to our WhatsApp integration provider (Meta Business Platform) or SMS gateway (Termii) solely to deliver the requested message
• Message content (receipt details, invoice amounts, debt reminders) is included in the transmission
• We maintain logs of sent messages for a period of 90 days for debugging and audit purposes
• You, as the account owner, are responsible for ensuring you have valid consent from recipients before sending messages through our platform
• WhatsApp communications are additionally governed by Meta's privacy policies

8. API & Webhook Data

If you use the Kredo Developer API (Growth and Business plans):

• API requests and responses are logged for security and debugging purposes for up to 30 days
• Your API keys are stored in hashed form and are never logged in plain text
• Webhook payloads sent to your endpoint URLs may contain business data (invoice details, payment events, etc.). You are responsible for securing your webhook endpoints
• We do not retain the content of webhook deliveries beyond what is necessary for retry logic (typically 24 hours)

9. Data Retention

We retain your data for as long as your account is active, plus the additional periods required by law:

• Active account data: Retained throughout your use of Kredo
• Financial records (receipts, invoices, payments): 7 years, as required by Nigerian Companies and Allied Matters Act (CAMA) and FIRS requirements
• Support communications: 2 years after resolution
• API request logs: 30 days
• WhatsApp / SMS message logs: 90 days
• Referral cookies: Up to 30 days (or until cleared by you)
• Deleted / closed accounts: All non-legally-required data purged within 30 days of deletion request; financial records retained for the statutory 7-year period

10. Data Security

We implement robust technical and organizational measures to protect your data:

• TLS 1.2+ / HTTPS encryption for all data in transit
• AES-256 encryption for sensitive data at rest
• Password hashing using bcrypt with individual salts — we never store passwords in plain text
• Session cookies are HttpOnly, SameSite=Lax, and Secure (HTTPS-only)
• Anti-clickjacking and XSS protection headers (X-Frame-Options, X-Content-Type-Options, HSTS)
• Daily automated database backups with offsite storage
• Role-based access controls (RBAC) for all staff operations
• Comprehensive audit logging of all sensitive operations
• Automated session timeout after 30 minutes of inactivity
• Multi-tenant data isolation — each business account is completely separated from all others

11. Your Rights

Under Nigeria's National Data Protection Regulation (NDPR) and the Nigeria Data Protection Act (NDPA) 2023, you have the following rights regarding your personal data:

• Right to Access: Request a copy of all personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data (subject to legal retention requirements)
• Right to Object: Object to processing of your data for marketing or profiling purposes
• Right to Data Portability: Request your data in a structured, machine-readable format (CSV/JSON)
• Right to Withdraw Consent: Withdraw consent for any processing based on consent (e.g., marketing emails) at any time
• Right to Restriction: Request that we restrict processing of your data in certain circumstances

To exercise any of these rights, email hello@trykredo.com with the subject line “Data Rights Request”. We will acknowledge your request within 5 business days and respond fully within 30 days.

12. Children's Privacy

Kredo is strictly a business management tool intended for adults aged 18 and over. We do not knowingly collect, solicit, or process personal data from anyone under 18 years of age. If we become aware that we have inadvertently collected data from a minor, we will delete it immediately and notify the relevant guardian where required.

13. Third-Party Links & Integrations

The Kredo platform may contain links to or integrations with third-party websites and services, including Paystack, WhatsApp, Google, LinkedIn, and WooCommerce. We are not responsible for the privacy practices, content, or security of these external sites. We encourage you to review their respective privacy policies before sharing any personal information with them.

14. International Users

Kredo is primarily designed for Nigerian and African businesses. If you access our platform from outside Nigeria, please be aware that your data will be transferred to and processed in Nigeria. By using our Service, you consent to this transfer. We take appropriate safeguards to ensure your data is protected in accordance with this Privacy Policy regardless of where it is processed.

15. NDPR & NDPA Compliance

Kredo operates in full compliance with:

• National Data Protection Regulation (NDPR) 2019
• Nigeria Data Protection Act (NDPA) 2023

We have appointed a Data Protection Officer (DPO) who can be reached at hello@trykredo.com. We conduct regular Data Protection Impact Assessments (DPIAs) for high-risk processing activities. Our data processing activities are documented and available for regulatory inspection upon lawful request.

You have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng if you believe your rights under Nigerian data protection law have been violated.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or platform features. For material changes, we will notify you via email to your registered address at least 14 days before the changes take effect. Minor updates will be reflected in the “Last Updated” date above.

We encourage you to review this page periodically. Your continued use of Kredo after the effective date of a revised Privacy Policy constitutes acceptance of the changes.

17. Contact Our Data Protection Officer

For any privacy-related queries, data rights requests, or to report a suspected breach:

• Email: hello@trykredo.com
• Subject Line: “Privacy / Data Request”
• WhatsApp: +234 703 055 5998
• Response Time: Acknowledgement within 5 business days; full response within 30 days
• Address: Ifeony Innovations, Victoria Island, Lagos, Nigeria