1. Purpose and Commitment
Budgexa recognizes that financial data is inherently sensitive. We are committed to safeguarding personal information in strict compliance with the Nigeria Data Protection Act 2023 (NDPA) and applicable international data protection laws. This Privacy Policy sets out the categories of data we collect, the lawful bases for processing, the rights of data subjects, and the measures we adopt to ensure confidentiality, integrity, and accountability.
2. Lawful basis for processing
Budgexa processes personal data only where a lawful basis exists under the NDPA, including:
- Consent: Voluntary provision of information or connection of accounts.
- Contractual Necessity: Provision of services requested by the data subject.
- Legitimate Interests: Operation, security, and improvement of Budgexa, balanced against data subject rights.
- Legal Obligation: Compliance with statutory or regulatory requirements.
If you are located in the European Economic Area, United Kingdom, or another jurisdiction with its own data protection law, these same bases apply to processing of your data under that law as well.
Budgexa's current scale of data processing does not meet the NDPA's threshold for classification as a Data Controller or Data Processor of Major Importance. As a result, we have not yet appointed a Data Protection Officer or registered with the Nigeria Data Protection Commission (NDPC). We will do so if and when applicable thresholds are met. In the meantime, all data protection questions and requests can be directed to support@budgexa.app.
3. Consent
Where we rely on your consent, for example to connect a bank account once that feature is available, or to send you optional insights, you give that consent through an affirmative action, not a pre-selected default. You can withdraw consent at any time from your account settings. Withdrawing consent doesn't affect the lawfulness of processing that already happened before the withdrawal, and may mean we can no longer provide certain features until consent is given again.
4. Information we collect
Account information. Name, email address, location, spending patterns. If you sign in with Google, we receive your name, email, and profile photo from Google.
Financial information you provide. Transactions, budgets, savings goals, and categories you enter or import into Budgexa. Your selected currency and country, used to localize amounts and defaults.
Receipt images. If you uploaded a photo of a receipt or bank alert, the image is sent to our AI service provider to extract transaction details. The image itself is processed transiently and is not permanently stored by Budgexa, only the extracted transaction data (amount, date, merchant, category, and similar fields) is saved to your account.
Profile image. If you upload a profile photo, it is stored with our image hosting provider.
Communications. Messages you send us through the contact form or support email, including your name, email, and message content.
Technical data. We automatically collect limited technical data when you use Budgexa, such as browser type, approximate location derived from your IP address, device information, and error/diagnostic logs. This helps us keep Budgexa secure and working properly.
5. How we collect your information
Most of what we collect, you give us directly: when you create an account, enter a transaction, or upload a receipt. We also collect some information indirectly and automatically, such as the technical data described above, generated as you use the app. We do not currently receive data from a connected bank account, since bank connectivity is not yet live (see Section 10).
6. How we use your information
- To provide, operate, and maintain your account and the Budgexa service
- To generate your budgeting summaries, spending insights, and AI-generated guidance
- To extract transaction details from receipts you choose to upload
- To communicate with you about your account, product updates, and support requests
- To detect, prevent, and address fraud, abuse, and security issues
- To improve Budgexa based on aggregated, non-identifying usage patterns
- To comply with legal obligations
We will never sell your personal information. We will not use your data for purposes materially different from those listed above without your consent.
7. AI processing
Budgexa uses Artificial Intelligence (AI) to generate spending insights, answer your questions, and (where you choose to use it) extract transaction details from receipt images. To do this, we send relevant data, such as your transaction history, budget information, or an uploaded receipt image, to a third-party AI service provider that processes this data on our behalf.
Our AI service provider processes this data under its standard terms of service and an incorporated data processing agreement, under which it acts as a data processor for your transaction and budget data. We have configured our account with this provider to opt out of having your data used to train its general-purpose AI models. Your data is used only to deliver the AI features described in this section.
If we introduce an in-app feedback control (such as a thumbs up or thumbs down) on AI-generated content, we will update this policy before that feature launches, since feedback you provide directly to our AI service provider may be used by them for model training regardless of our general opt-out.
For processing that could carry higher risk to your rights, we carry out an internal data privacy impact assessment before that processing begins, in line with the NDPA.
8. Data storage & security
Your data is stored on secure cloud infrastructure, encrypted at rest and in transit using industry-standard Transport Layer Security (TLS) encryption. We use reputable third-party providers for database hosting, caching, image storage, and application hosting. Access to your data is restricted to authorized Budgexa team members only.
While we take security seriously, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.
If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of the breach, describing its nature, the categories and approximate numbers of data subjects and records affected, likely consequences, and the measures we have taken or propose to take. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly and without undue delay, in clear and plain language, with the same details and any steps you can take to protect yourself.
We maintain an internal breach response procedure and a log of security incidents to support this process.
9. Data retention
We retain your data for as long as your account is active, or as may be needed, to provide you the services. If your free trial ends and you do not subscribe to a paid plan, your access is paused but your data are retained for 90 days, giving you time to subscribe and pick up where you left off.
If you do not subscribe to the paid plan within the 90-day window, deleted your account personally or requested the deletion of your data, we will delete the data within 30 days, provided there is no need for specific statutory or contractual obligations to justify retention.
12. Your rights
Depending on your location, you have the right to:
- Access a copy of the personal data we hold about you
- Correct inaccurate or incomplete data
- Delete your personal data
- Restrict or object to certain processing
- Port your data in a structured, machine-readable format
- Withdraw consent at any time, where processing is based on consent
- Request human review of any AI-generated output that meaningfully affects your account, though Budgexa's AI features are informational and do not make automated decisions with legal or similarly significant effects on you
To exercise any of these rights, contact us at support@budgexa.app. We will respond within 30 days. You also have the right to lodge a complaint with the Nigeria Data Protection Commission or your local data protection authority.
13. Children's privacy
Budgexa is intended for adults managing their own finances and is not directed at anyone under 18. We do not knowingly collect personal data from anyone under 18. If we become aware that we have inadvertently collected such data, we will delete it promptly.
14. International data transfers
Your data may be processed and stored in countries outside Nigeria, including where our hosting and service providers operate. We take steps to ensure such transfers comply with applicable data protection laws and that appropriate safeguards are in place. For our AI service provider, this transfer is covered by standard contractual clauses incorporated into our agreement with that provider. We are in the process of putting equivalent safeguards in place with our other service providers, and will complete this before your data is transferred to any provider that does not yet have them.
15. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we do, we will update the "Last updated" date above. For material changes, we will notify you by email or in the app; continued use of Budgexa after changes took effect, signifies your acceptance of the updated policy.
16. Contact us
Questions about this Privacy Policy or our data practices? Contact us at support@budgexa.app.