Legal
Last updated: May 2026 · NDPA 2023 Compliant
Your data is protected under the Nigeria Data Protection Act 2023. We are committed to transparency about how we handle your information.
Splitrr ("we", "us", or "our") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you use our platform at www.splitrr.ng. This policy is issued in compliance with the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Regulation 2019 (NDPR).
The data controller is Splitrr, operated by Michael Afolayan, Lagos, Nigeria. For data protection enquiries contact: dpo@splitrr.ng. For general support: support@splitrr.ng.
From Coordinators: full name, email address, phone number, bank account number (encrypted at rest), bank name, and split details. From Payers: full name, email address, and payment amount. Automatically: IP address, browser type, device type, and pages visited. Payment card details are processed directly by Paystack and never stored on our servers.
We use your data to: create and manage your account; process payments and facilitate fund collection; create Paystack subaccounts for coordinator payouts; verify bank account details; send transaction receipts; provide customer support; detect and prevent fraud; comply with legal obligations including AML requirements; and improve our platform. We do not sell your data or use it for unsolicited marketing.
We process your data on the following legal bases: contractual necessity (to provide requested services); legal obligation (to comply with applicable laws); legitimate interests (fraud prevention, security, platform improvement); and consent (where explicitly given, such as for marketing communications). You may withdraw consent at any time.
We share your data only with: Paystack (to process payments and create subaccounts — Paystack's Privacy Policy applies); legal authorities (when required by law, court order, or to protect user safety); and successors in business transfers. We do not share data with advertisers or data brokers.
We implement: AES-256-GCM encryption for bank account numbers at rest; HTTPS/TLS for all data in transit; role-based database access controls; no exposure of sensitive credentials to client-side code; and infrastructure hosted on SOC 2 compliant providers (Supabase EU West, Vercel). No system is completely secure — we cannot guarantee absolute security of data transmitted over the internet.
Account data is retained for the duration of your account and 7 years after closure (financial record-keeping requirements). Transaction records are retained for 7 years. IP and access logs are retained for 90 days. After applicable retention periods, data is securely deleted or anonymised.
You have the right to: access your personal data; rectification of inaccurate data; erasure (subject to legal retention); data portability; object to processing; withdraw consent; and lodge a complaint with the Nigeria Data Protection Commission (ndpc.gov.ng). Contact dpo@splitrr.ng to exercise these rights. We will respond within 30 days.
We use essential cookies only: session cookies (maintain login state), security cookies (prevent CSRF), and preference cookies (dark/light mode). We do not use advertising, tracking, or third-party analytics cookies that share data externally.
Splitrr is not directed at individuals under 18 years of age. We do not knowingly collect data from minors. If you believe a minor has provided us data, contact support@splitrr.ng immediately.
Your data is stored on servers in EU West (Ireland) via Supabase and on Vercel's global CDN. These transfers comply with the NDPA's provisions on cross-border data transfers with appropriate safeguards in place.
We may update this policy periodically. Material changes will be communicated via email at least 30 days before taking effect. The "Last updated" date reflects the most recent revision.
Privacy enquiries: dpo@splitrr.ng. General support: support@splitrr.ng. To file a complaint: Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.