Privacy Policy

1. Our role

• Account holders: for your own account details we are the data controller.
• Your customers: for customer details you add to invoices, your business is the controller and we process that data on your behalf, only to provide the service.

2. What we collect

• Account: your name, email address and password (stored only as a secure hash by our authentication provider).
• Business profile: business name, contact details, address, tax ID, currency, invoice settings and payment instructions.
• Customers, products and invoices: the names, emails, addresses, line items and amounts you enter.
• Payments: amounts, dates, methods and references. For online payments, Paystack processes card and bank details; we never receive or store full card numbers.
• Payout account: your bank, account name and the last four digits of the account number. The full number is sent to Paystack to create your subaccount and is not stored by us.
• Emails: records of invoice and reminder emails sent (recipient, time, delivery status).
• Technical data: IP addresses and request logs used for security, rate limiting and troubleshooting. IP addresses used for rate limiting are stored only as one-way hashes.

3. Why we use it

• To provide the service you signed up for (performance of a contract).
• To keep accounts and payments secure and prevent fraud and abuse (legitimate interests).
• To meet legal, tax and regulatory obligations (legal obligation).
• To send service messages such as password resets. We do not send marketing without your consent and we do not sell personal data.

4. Who we share it with

We use these providers to run Storvia. Each processes data only on our instructions:

• Supabase — database and account authentication (European Union (Ireland)).
• Vercel — application hosting (United States and global edge network).
• Paystack — online card, transfer and USSD payments (Nigeria).
• Resend — sending invoice and reminder emails (United States).

Some providers are outside Nigeria. Where data is transferred abroad we rely on safeguards recognised under the NDPA, such as contractual protections. When you send an invoice, the customer you send it to can see the details on it.

5. How long we keep it

We keep your data while your account is active. Invoices and payment records may need to be kept for up to six years after the year they relate to, to meet tax and accounting rules. When you close your account we delete or anonymise the rest within 90 days, except where the law requires us to keep it. Rate-limiting records are deleted after one day.

6. Security

Data is encrypted in transit, access is restricted so each business can only see its own records, payment changes are checked server-side, and we use rate limiting and security headers to protect the service. No system is perfectly secure; if a breach affects your data, we will notify you and the Nigeria Data Protection Commission as required by law.

7. Your rights

You can ask to access, correct, export or delete your personal data, object to or restrict certain processing, and withdraw consent where we rely on it. Email support@codewithfred.com.ng and we will respond within 30 days. If you are one of our users’ customers, please contact that business first. You can also complain to the Nigeria Data Protection Commission (NDPC).

8. Cookies

We only use cookies needed to keep you signed in and secure. We do not use advertising or tracking cookies.

9. Children

Storvia is for businesses and is not intended for anyone under 18.

10. Changes

We will update this policy when our practices change and show the new effective date above. Significant changes will be announced by email or in the app.