Privacy Policy

We collect the information you give us directly and information created by using the app:

• Account information — name, email address, and password, handled for us by our authentication provider (WorkOS).
• Tax profile — state of residence, filing type, industry, VAT registration status, and similar facts you tell us so transactions can be classified correctly.
• Bank statement data — statements you upload, or accounts you connect via our banking data partner (Mono), including transaction descriptions, amounts, dates, and balances.
• Communications — your WhatsApp number if you opt in to receive tax questions there, and the content of support requests you send us.
• Device information — push-notification subscriptions, and standard technical data such as IP address and browser type.
• Payment information — handled entirely by our payment processor (Paystack); we do not store your card details.

• To categorise your transactions and estimate your tax position using AI.
• To ask you clarifying questions about transactions the AI can't confidently classify — in-app, by push notification, by email, or on WhatsApp if you've opted in.
• To generate your filing summary and, where you request it, connect you with a tax accountant.
• To send account, security, and service notifications (for example, a password change or a completed statement upload).
• To improve the accuracy of our AI classification over time.
• To meet our legal and regulatory obligations, including under Nigerian tax law.

We do not sell your personal data. We share it only with:

• Service providers who process data on our behalf — WorkOS (authentication), Mono (bank data), Paystack (payments), Resend (email delivery), and our cloud infrastructure and AI model providers — bound by contracts that limit their use of your data to providing the service.
• A tax accountant you choose to connect with, for the specific engagement you request.
• Regulators or authorities where required by law.

We keep your account and transaction data for as long as your account is active, and for a reasonable period afterward to meet tax record-keeping and legal obligations. You can request deletion of your account and associated data at any time — see Section 6.

We use industry-standard safeguards — encryption in transit, access controls, and least-privilege service credentials — to protect your data. No system is perfectly secure, and we encourage you to use a strong, unique password.

Under the Nigeria Data Protection Act (NDPA) and its regulations, you have the right to access, correct, or request deletion of your personal data, and to withdraw consent for optional processing (such as WhatsApp messages) at any time from Settings. To exercise these rights, contact us using the details in Section 8.

We may update this policy as the product changes. Material changes will be highlighted in-app; continued use of CoCash after a change means you accept the updated policy.

Questions about this policy or your data — reach us at privacy@cocash.app.