⚠ DRAFT — REQUIRES LEGAL REVIEW BEFORE PUBLISHING
This is a first-pass draft prepared to give qualified NDPR counsel a starting point. It reflects FinSight's actual data practices as currently designed, but has not been reviewed by a lawyer and must not be published or relied upon as a compliant privacy notice until it is.
1. Who we are
FinSight Digital Technologies, Inc. ("FinSight," "we," "us") provides financial intelligence services, including income verification and affordability scoring, to individuals and institutional partners in Nigeria. This policy explains what personal data we collect, why, and what rights you have over it, in accordance with the Nigeria Data Protection Regulation (NDPR) and applicable Nigerian data protection law.
2. What we collect
Information you provide directly
- Account details: name, email address, phone number.
- Identity information used for verification purposes (e.g., a hashed reference derived from a national identification number — we do not store the raw ID number).
Information from your connected bank account
- With your explicit, revocable consent, we access up to 90 days of transaction history via our licensed open-banking partner. This connection is read-only — we cannot initiate payments, transfers, or withdrawals.
- We do not store your bank login credentials. These are handled entirely by our open-banking partner.
Payment information
- Payments are processed by our licensed payment service providers. FinSight does not store your card number or full payment credentials — these are handled entirely by our payment processors under their own PCI-DSS certified systems.
3. Why we process your data
- To calculate your income verification and affordability score.
- To generate the reports you request (Income Verification, Loan Affordability, Rent Affordability, Visa-Ready Summary).
- To share a report with an institution, but only where you have chosen to share it.
- To maintain records required for regulatory compliance and dispute resolution.
4. Consent & your control over data access
Before any bank data is accessed, you are shown exactly what will be shared, for what purpose, and for how long, and asked to explicitly authorize it. You may revoke this consent at any time from your account settings. Revoking consent immediately stops further data access, but does not delete reports already generated before revocation.
5. How long we keep your data
- Raw transaction data is retained only as long as needed to support an active report — by default, 90 days.
- Generated reports remain valid and accessible for 60 days from generation.
- Records of data access and consent (audit logs) are retained indefinitely for compliance and dispute-resolution purposes, and cannot be deleted on request, consistent with our regulatory obligations.
6. Who we share data with
- Institutions you choose to share a report with — only the specific report, not your raw transaction data.
- Our open-banking data partner — to facilitate the bank connection itself.
- Our payment service providers — to process payments for reports and subscriptions.
- We do not sell your personal data to third parties.
7. Your rights
Subject to applicable law, you have the right to access the personal data we hold about you, request correction of inaccurate data, request deletion of data we are not otherwise required to retain, and withdraw consent at any time. To exercise these rights, contact us at the details below.
8. Security
All data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Access to personal data is restricted and logged. No security system is perfect, and we cannot guarantee absolute security, but we are committed to promptly investigating and responding to any suspected breach.
9. Children's data
FinSight's services are not directed at, and are not knowingly used by, anyone under the age of 18. We do not knowingly collect personal data from minors.
10. Changes to this policy
We may update this policy from time to time. Material changes will be notified to registered users before they take effect.
11. Contact us
For any questions about this policy or to exercise your data rights, contact our Data Protection Officer at [DPO email — to be assigned] or write to us at our registered Lagos, Nigeria address.