Privacy Policy

Overview

This Privacy Policy explains how Owelet ("we," "us," or "our") collects, uses, stores, and protects your personal information when you use the Owelet mobile application and any related services (collectively, the "Service").

By downloading or using Owelet, you agree to the collection and use of information as described in this Privacy Policy. If you do not agree, please do not use the Service.

We are committed to protecting your privacy and handling your personal information in accordance with the Nigeria Data Protection Regulation (NDPR) 2019, issued by the National Information Technology Development Agency (NITDA), and other applicable data protection laws.

Information We Collect

1. Information You Provide Directly

When you create an account and use Owelet, you may provide us with:

• Account information: Your full name and email address, provided when you create an Owelet account.
• Business information: Your business name and business phone number, if you choose to add these for receipt branding (Pro feature). This is optional.
• Debt records: The names, phone numbers, amounts, descriptions, due dates, and payment histories of your credit customers that you enter into the app.
• Payment records: Details of payments made by your customers, including amounts, dates, and any notes you attach.
• Notes and descriptions: Any additional text you enter when creating or updating debt records.

2. Information Collected Automatically

When you use the Service, we may automatically collect certain technical information:

• Device information: Your device type, operating system version, and unique device identifiers. This is used to ensure the app functions correctly on your device.
• Usage data: Information about how you use the app, such as which features you use and when you use them. This helps us improve the product.
• Error logs: Crash reports and error logs that help us identify and fix technical problems. These may include device state at the time of a crash but do not include your personal debt records.
• App version: The version of Owelet you are running, so we can provide relevant support.

3. Information from Third Parties

If you use Google Sign-In or another third-party authentication method to create your account (where available), we receive basic profile information from that provider, typically your name and email address, as permitted by their terms. We do not receive your passwords or payment information from these providers.

4. Contact Information (with Your Permission)

If you use the "Import from Contacts" feature, Owelet requests permission to access your device's contact list. See the Contact Access section below for full details on how this works.

How We Use Your Data

We use the information we collect for the following purposes only:

To Provide the Service

• Creating and managing your Owelet account
• Storing and syncing your debt records across your devices
• Generating payment receipts and business reports
• Sending payment reminder notifications to your device
• Enabling WhatsApp and SMS receipt sharing
• Processing subscription payments via Paystack

To Improve the Service

• Analysing aggregated, anonymised usage patterns to improve app performance and features
• Diagnosing and fixing technical errors and crashes
• Testing new features before broad release

To Communicate With You

• Sending transactional emails such as account verification, password resets, and subscription confirmations
• Notifying you of important changes to the Service, these Terms, or our Privacy Policy
• Responding to your support requests sent to info@owelet.ng

For Legal Compliance

• Complying with applicable laws and regulations in Nigeria
• Responding to lawful requests from government authorities
• Enforcing our Terms of Use and protecting the rights of Owelet and our users

Data Sharing

We do not sell your personal data. We do not trade your data. We share your information only in the following limited circumstances:

Service Providers

We work with a small number of trusted third-party service providers who help us operate Owelet. These providers process your data only on our behalf and under our instructions, and are contractually prohibited from using your data for their own purposes:

• Supabase (database and authentication): Your account data and debt records are stored on Supabase's infrastructure. Supabase is hosted in the European Union. See Supabase's Privacy Policy.
• Paystack (payment processing): Subscription payment information is processed by Paystack. Owelet does not store your card details. See Paystack's Privacy Policy.

Legal Requirements

We may disclose your information if we believe in good faith that disclosure is necessary to:

• Comply with a valid legal obligation, court order, or lawful government request under Nigerian law
• Protect the safety of any person from harm
• Prevent fraud or address security threats to Owelet or our users
• Enforce our Terms of Use

Where legally permitted, we will notify you before disclosing your information in response to a legal request.

Business Transfers

If Owelet is involved in a merger, acquisition, or sale of assets, your personal data may be transferred as part of that transaction. We will notify you via email and a prominent notice in the app before your data is transferred and becomes subject to a different privacy policy.

With Your Consent

We may share your information for any other purpose with your explicit prior consent.

Data Storage and Security

Where Your Data is Stored

Your Owelet data is stored in two places:

• On your device: Debt records are stored locally on your phone using an encrypted local database (Hive). This allows Owelet to work fully offline, even without an internet connection.
• In the cloud: When you are connected to the internet, your data is automatically synced to our secure cloud database hosted by Supabase in the European Union (Frankfurt, Germany). This enables data backup and access across multiple devices.

How We Protect Your Data

We implement industry-standard security measures to protect your information:

• Encryption in transit: All data transmitted between the app and our servers is encrypted using TLS (Transport Layer Security).
• Encryption at rest: Your data stored in our cloud database is encrypted at rest by Supabase.
• Row-Level Security: Our database is configured so that each user can only access their own data. It is technically impossible for one Owelet user to view another user's debt records.
• Authentication: Access to your account requires email and password verification. You can optionally add a PIN lock for additional device-level security.
• PKCE authentication flow: We use the Proof Key for Code Exchange (PKCE) standard for secure mobile authentication.

No Security is Absolute

While we take data security seriously and implement strong protections, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee the absolute security of your data. If you believe your account has been compromised, please contact us immediately at info@owelet.ng.

Contact Access

Owelet includes an optional "Import from Contacts" feature that allows you to quickly fill in a debtor's name and phone number by selecting them from your phone's contact list.

What We Access

When you use this feature, Owelet requests permission to read your device contacts. We access only the name and phone number of the specific contact you select.

What We Do Not Do

• We do not upload your contact list to our servers
• We do not store your contacts beyond the single name and phone number you choose to add to a debt record
• We do not scan, analyse, or retain your full contact list
• We do not use your contacts for marketing or share them with any third party

This Feature is Optional

You can use Owelet fully without granting contact access. You can type debtor names and phone numbers manually at any time. If you previously granted contacts permission and wish to revoke it, you can do so in your phone's app settings at any time.

Payment Data

Owelet Pro subscriptions are processed by Paystack, a third-party payment processor.

What Owelet Receives

When you subscribe, Paystack sends us a webhook notification confirming your payment was successful. This notification includes:

• Your email address (to identify your account)
• The subscription plan you chose (monthly or annual)
• A transaction reference number
• The amount charged

We use this information only to activate and manage your Pro subscription in Owelet.

What Owelet Does Not Receive or Store

• Your card number, CVV, or expiry date
• Your bank account details
• Any other sensitive payment credentials

All sensitive payment data is handled exclusively by Paystack on their secure PCI-DSS compliant infrastructure. Please review Paystack's Privacy Policy for details on how they handle your payment information.

Subscription Records

We maintain records of your subscription history — when you subscribed, which plan, and when it expires, for the purpose of managing your access to Pro features and for financial record-keeping as required by law.

Children's Privacy

Owelet is not intended for use by children under the age of 18. We do not knowingly collect personal information from anyone under 18 years of age.

If you are a parent or guardian and believe your child has provided personal information to Owelet without your consent, please contact us immediately at info@owelet.ng. We will take steps to delete such information promptly.

Your Rights

Under the Nigeria Data Protection Regulation (NDPR) and applicable law, you have the following rights regarding your personal data:

Right to Access

You have the right to request a copy of the personal data we hold about you. You can access most of your data directly through the Owelet app. For a complete data export, contact us at info@owelet.ng.

Right to Rectification

You have the right to request correction of inaccurate or incomplete personal data. You can update your account information directly in the app under Settings. For other corrections, contact us.

Right to Erasure

You have the right to request deletion of your personal data and Owelet account. To delete your account and all associated data, contact us at info@owelet.ng with the subject line "Account Deletion Request." We will complete the deletion within 7 business days and confirm when done.

Please note that we may retain certain information as required by law (such as subscription payment records for tax purposes) for the legally required period even after account deletion.

Right to Data Portability

You have the right to receive your data in a portable format. Owelet supports this through our built-in JSON and CSV export features, accessible in Settings → Export, Backup & Reports. You can export all your debt records at any time.

Right to Object

You have the right to object to certain types of processing, such as processing for direct marketing purposes. Owelet does not conduct direct marketing using your personal data.

Right to Withdraw Consent

Where we process your data based on your consent (such as contact access), you may withdraw that consent at any time through your device settings without affecting the lawfulness of processing before withdrawal.

How to Exercise Your Rights

To exercise any of these rights, contact us at info@owelet.ng. We will respond to all requests within 30 days. We may need to verify your identity before processing your request.

Data Retention

We retain your personal data for as long as your account is active or as necessary to provide you with the Service.

• Account data: Retained for the duration of your account and deleted within 7 business days of an account deletion request.
• Debt and payment records: Retained as long as your account exists. Deleted when you delete your account.
• Subscription records: Retained for 7 years after the subscription ends, as required by Nigerian financial record-keeping regulations.
• Error logs: Automatically deleted after 90 days.
• Usage analytics: Aggregated and anonymised after 12 months. Individual usage data is deleted after 12 months.

When data reaches the end of its retention period, we securely delete or anonymise it.

Third-Party Services

Owelet integrates with or links to the following third-party services. Each has its own privacy policy that governs their use of your data:

• Supabase Database and authentication. Privacy Policy
• Paystack Payment processing. Privacy Policy
• Google Fonts Typography (loaded from Google's CDN). Privacy Policy
• WhatsApp When you share a receipt via WhatsApp, the content is handled by WhatsApp/Meta. We do not control how WhatsApp processes shared content. WhatsApp Privacy Policy

We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.

Nigeria Data Protection Compliance

Owelet is committed to full compliance with the Nigeria Data Protection Regulation (NDPR) 2019 issued by the National Information Technology Development Agency (NITDA).

Lawful Basis for Processing

We process your personal data on the following lawful bases under the NDPR:

• Contract performance: Processing necessary to provide you with the Owelet Service you have agreed to use, including storing your debt records and processing your subscription.
• Consent: Processing based on your explicit consent, such as accessing your device contacts. You may withdraw consent at any time.
• Legitimate interests: Processing necessary for our legitimate business interests, such as improving the app and preventing fraud, where these interests do not override your rights.
• Legal obligation: Processing required to comply with applicable Nigerian law.

Data Protection Officer

For NDPR-related enquiries, you may contact us at info@owelet.ng. We will respond within 30 days.

Cross-Border Data Transfers

Your data is stored on servers in the European Union (Frankfurt, Germany) operated by Supabase. The EU maintains data protection standards that are broadly comparable to the NDPR. These transfers are conducted under appropriate safeguards as required by NDPR Article 41.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. When we make changes:

• We will update the "Last updated" date at the top of this page
• For significant changes, we will notify you by email and/or by a prominent notice in the app at least 14 days before the changes take effect
• For minor changes (such as clarifications), we will update the policy without individual notification

Your continued use of Owelet after any changes to this Privacy Policy constitutes your acceptance of the revised policy. If you do not agree to the revised policy, you should stop using the Service and may request deletion of your account.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

• Email: info@owelet.ng
• App: Owelet is available on Google Play
• Response time: We aim to respond to all privacy enquiries within 5 business days and no later than 30 days.