MartBooks

Privacy Policy

Effective date: 2026-08-01

Fincepto Solutions Nigeria Limited ("Fincepto", "we") is the data controller for personal data processed by MartBooks. This notice explains what we collect, why, and the rights you have under the Nigeria Data Protection Act 2023 ("NDPA") and the associated NDPR framework.

1. What we collect

  • Account data — name, email, phone, hashed password, company details.
  • Business data — products, customers, sales, journals, receipts. You upload these; you own them.
  • Usage data — pages visited, actions performed, IP address, browser type. Used for security auditing and product improvement.
  • Payment data — subscription payments are processed by Flutterwave. We store the transaction ID and status; we do NOT store card numbers.

2. Why we process it

  • To provide the Service you subscribed to (performance of contract).
  • To keep the Service secure — detect abuse, investigate incidents (legitimate interest).
  • To send service-related emails: password reset, security alerts, billing notices.
  • To comply with legal obligations (tax records, audit requests from regulators).

We do NOT sell your personal data. We do NOT use your business data to train machine-learning models for other customers.

3. Where we store it

MartBooks hosts data on servers located in Nigeria or the European Union, selected for regulatory alignment. Backups are encrypted at rest and replicated off-site. Data is not transferred outside your chosen region without your knowledge.

4. Who we share it with

  • Sub-processors we use to run the Service:
  • • Flutterwave — payment processing
  • • Resend / Postmark — transactional email
  • • Our hosting provider (as disclosed on request)
  • We share data with law enforcement only under a valid legal order.

5. How long we keep it

  • Business data: for the life of your account.
  • After account termination: 30 days exportable, then permanent deletion.
  • Audit logs: 7 years (Nigerian tax record retention).
  • Encrypted backups purged within 60 days of account termination.

6. Your rights under the NDPA

You may:

  • Access the personal data we hold about you.
  • Correct inaccurate data.
  • Delete data (subject to legal-retention obligations above).
  • Export your data in a machine-readable format.
  • Object to processing based on legitimate interest.
  • Lodge a complaint with the Nigeria Data Protection Commission (NDPC).

Exercise any of these rights by emailing [email protected]. We respond within 14 days.

7. Security

Passwords are hashed with bcrypt. All traffic uses TLS 1.2+. Access tokens are short-lived; refresh tokens rotate on use. Multi-factor authentication is available for every account and enforceable at the company level. We publish a security-issue disclosure address at [email protected].

8. Cookies

We use a small number of first-party cookies required for authenticated sessions and CSRF protection. We do not use third-party advertising cookies. No analytics cookies are set until you explicitly consent (Settings → Privacy).

9. Changes to this notice

We announce material changes by email at least 14 days before they take effect. The current version is always at this URL.

10. Contact

Data Protection Officer: [email protected] · Fincepto Solutions Nigeria Limited, Lagos, Nigeria.