Privacy Policy

Akojo is a personal finance product operated from Lagos, Nigeria. We are the data controller for the personal data described here, and we are registered with the Nigeria Data Protection Commission.

Needs legal review · Registered company name, RC number, registered address and NDPC registration number. The Act requires a controller to publish an address, not only an email.

Our Data Protection Officer can be reached at dpo@akojo.finance.

Your account. Your name, email address and a password you choose. If you sign in with Google, we receive your name, email address and whether that address is verified. We never receive your Google password.

Your bank data, when you connect an account. Your balances, your transaction history, the name on the account and the account number. This comes from your bank through Mono, after you authorise it.

We never see your bank login. At no point do we receive the username, password, PIN or token for any account you connect. You enter those with Mono, who are licensed to hold them. What reaches us is the data your bank releases afterwards, and nothing that could be used to sign in anywhere.

Statements you send us. The PDF itself and everything it contains.

Bank alerts you forward. Only the emails your own forwarding rule sends to your personal Akojo address. We have no access to your mailbox and hold no credential for it. We cannot read anything you do not forward.

How you use the product. Pages opened and actions taken, so we can tell what is broken.

To give you the product, which is performance of our contract with you. Showing you your own money is the service you signed up for. Reading the accounts you connected, categorising your transactions and working out your balances are all necessary to deliver it.

To keep the product working and secure, which is our legitimate interest. Diagnosing failures, preventing abuse, and keeping records of the consents and agreements we are required to be able to prove.

Anything optional, which is your consent, asked for separately. We do not bundle consent into our Terms. Where we need it, we ask for it on its own, with nothing pre-ticked, and you can withdraw it without losing the product.

We do not sell your data and we do not share it for advertising, and that sentence has no small print after it. Comparable products say they never sell your financial data and then explain that passing your profile to advertising networks counts as “selling” under some laws. We run no advertising at all, so there is no second half to this.

We use the following processors, each under contract and each only for the purpose named.

Mono (Nigeria) connects your bank account and retrieves your balances and transactions, only for accounts you link yourself.

Supabase (database and file storage, hosted in France) stores your account, your transactions and any statements you send.

Amazon Web Services (Ireland) receives the bank alert emails you forward.

Resend (Ireland) sends you account emails such as sign-in codes and password resets.

Anthropic (United States) powers the assistant and parts of our statement reading. When you ask the assistant a question, the information needed to answer it is sent to Anthropic. It is not used to train their models.

This means your data is stored and processed outside Nigeria. We rely on the transfer provisions of the Nigeria Data Protection Act, and we use providers that offer contractual data protection terms.

Needs legal review · Which transfer mechanism under the NDPA we are relying on for each destination, and whether an adequacy determination covers France and Ireland. Also whether the Anthropic transfer needs its own basis given the sensitivity of transaction data.

The assistant answers questions about your own money, so answering one means sending the relevant parts of your data to Anthropic, in the United States. If you ask what you spent on fuel last month, the transactions needed to work that out go with the question.

It is not used to train their models. We send what is needed to answer and no more, and nothing is sent until you ask something.

Answers can be wrong. The assistant works from the data we hold, and that data comes from your bank, so an answer is only as current as the last time your accounts updated. It is a faster way to read your own records, not a second opinion on them.

We categorise your transactions and detect patterns such as recurring bills and your pay rhythm, automatically. This is profiling in the sense the Act uses, and it exists to describe your money back to you.

It produces no decision with a legal or similarly significant effect. We do not make lending decisions, we do not score you, and we do not pass any assessment of you to anyone else. You can correct any categorisation, and your correction takes precedence.

Your account data stays while your account is open. Delete your account and we delete it, along with your transactions, statements, receipts and the record of what you agreed to.

Deleted items sit in a recoverable state for 90 days by default, so a mistake is reversible, and are then removed permanently.

Needs legal review · Whether any retention is mandated after account closure by Nigerian financial or tax rules. If so, what and for how long, which would override the paragraph above.

You can ask us for a copy of your data, correct it, delete it, object to or restrict what we do with it, withdraw any consent you gave, and ask for your data in a portable format.

Write to privacy@akojo.finance and we will respond within the time the Act allows.

If you are not satisfied, you have the right to complain to the Nigeria Data Protection Commission.

When we change this notice we publish a new version with a new date. Where a change affects how we use your data, we will tell you and, where the Act requires it, ask you again.