Privacy notice

Two different roles

finpo handles two kinds of personal data, and our responsibilities differ for each. The distinction runs through the whole of this notice, so it is worth setting out first.

Your own account. When you sign up, we decide what to collect and why. In data protection terms we are the controller, and this notice is our notice to you.

Your staff and your customers. The names, phone numbers, sales and formulas that live inside your business are held on your instructions. You are the controller and we are your processor. What we may do with that data is set by our data processing agreement, not by this notice, and the notice your staff and customers should read about your own use of finpo is yours to give, not ours.

Who we are

Nikcano Global Services, trading as finpo. For anything in this notice, write to support@nikcano.com.

What we collect about you

• Your account. Your name, email address and password. The password is never stored, only an argon2id hash of it, so nobody at finpo can read or recover it.
• Your business. Its name, industry template, account number, hosting region and the plan it is on.
• Billing. Your plan, invoices, payments and credit balance. Card details are handled by Flutterwave and never reach our servers.
• What was done in your business. An audit record of significant actions, holding who acted, what they changed, the IP address and browser the request came from, and whether it was taken by finpo staff on your behalf.

What we hold on behalf of your business

This is data about the people who work for you and the people you sell to. You decide what finpo records for your business and how long you keep it, within the limits below. We hold it because you asked us to.

• Staff. A name, phone number, the username and account number they sign in with, which branches they work at, and a hashed PIN. A member of staff never gives us a password we can read, only a one-time temporary one they replace on first sign-in.
• Webcam snapshots. Taken on risky checkout actions and periodically during a shift, where you have that switched on. Staff see and accept a notice about this the first time they sign in. Only you, as the owner, can view them.
• Customers. A name and phone number where one is taken for a receipt, a credit account or a debt record.
• Sales, stock and cash. Every sale, stock movement, count, adjustment and shift, written into a signed, tamper-evident ledger. This is your business record, and we hold it as one.
• Recipes and procedures. The formulas, colours and step-by-step instructions you put in the Playbook app. Where a recipe is marked secret, its quantities are hidden from everyone but you and anyone you specifically grant access to. That redaction happens on our server before the response leaves it, not in your browser.

Why we are allowed to hold it

• To provide the service you signed up for. Running your checkout, your ledger and your account is performance of our contract with you.
• To keep the service safe and working. Rate limits, audit records and error logs rest on our legitimate interest in a service that is not abused and can be repaired when it breaks.
• Because the law requires it. Financial records are kept for as long as tax and company law require.
• On your instructions. Staff and customer data is held for you, under our agreement with you, and you are responsible for having a lawful basis for recording it, including telling your staff about webcam monitoring where your local law requires more than the in-app notice.

Who else sees it

We do not sell personal data and we do not share it for advertising. We do use these:

• Flutterwave. Payments. They receive your billing details directly.
• Our email provider. To send alerts, sign-in codes and, where a shop chooses to, emails to its own customers. We do not send text messages or WhatsApp messages at this time; if that changes, this list changes first.
• Our hosting and storage providers. They hold the database and uploaded files. They do not use the data for anything of their own.
• Our email provider. Sends verification, password reset and notification email.
• The AI add-on, when you turn it on. Off by default, per business. When it is on, a question you or a member of staff asks is sent to a language model through OpenRouter, along with playbook content you have separately marked shareable. Content from a recipe marked secret can never be marked shareable, and nothing is sent to any model while the add-on is off.

We may also disclose data where the law compels us to, and to a buyer if the business is sold, in which case this notice travels with it.

How long we keep it

• Your account. While it is open.
• Sales, stock and ledger events. Kept as your permanent business record. These are signed and chained for tamper evidence, the same reason a paper checkout roll is not torn up; they are not something we delete on request, only as part of closing your business entirely.
• Audit trail. 90 days. The audit trail records who did what in your workspace. After 90 days the rows are deleted automatically.
• Webcam snapshots. 90 days, unless a snapshot is attached to an open theft finding, in which case it is kept until that finding is resolved.
• Temporary staff passwords. 72 hours, then they stop working whether or not they were used.
• A closed business. Marked for deletion and permanently erased 30 days later. The window is deliberate: it is the undo, for the case where somebody closed the wrong business.
• Financial records. As long as the law requires, which is longer than the rest.

Where it is held

Our database and uploaded files are held on servers we operate, and are not shared with other customers of ours. Our primary hosting is in Nigeria.

Several of the providers named above operate outside Nigeria, so a payment involves your data crossing a border. Where that happens we rely on the transfer safeguards in our agreements with them.

How it is protected

• Passwords, temporary passwords and PINs are hashed with argon2id and are never stored or logged in the clear.
• Ledger events are cryptographically signed and chained, and the database itself refuses an update, delete or bulk erase of one once written. This is not just a rule we follow. The database enforces it on its own.
• Recipe quantities and cost prices are stripped from the response on our server, before it reaches a browser, for anyone who is not the owner or specifically trusted with them.
• Every business is isolated. Queries are scoped to a business, and access is refused rather than filtered when a request does not belong to one.
• Traffic is served over TLS.
• Public endpoints are rate limited, per visitor and per business.
• finpo staff can enter a workspace to support it. Doing so is recorded in your audit log and marked as staff access, and a banner is shown on every screen for as long as it lasts.

Your recipe quantities are encrypted in the database itself, each recipe under a key of its own, and those keys under a key belonging to your business that we hold separately from your data. Nobody reading the database sees a formula. When you delete your business we destroy that key first, which is what makes the deletion real in our backups too, and not only in the live database.

Being direct about the limits: apart from those quantities, the ledger’s tamper evidence and the redaction described above, the rest of your business data (staff and customer names and phone numbers included) is not separately encrypted column by column. It is protected by the safeguards above and by restricting who can reach the database at all, which is a normal arrangement for a product of this kind. If your business has a compliance requirement for field-level encryption beyond this, write to us before relying on finpo for it.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict what we do with it, or to object to it. Write to support@nikcano.com and we will respond within 30 days.

If you are a member of staff or a customer of a business using finpo, please contact that business first. The data is theirs, we hold it for them, and we will pass your request to them rather than act on it ourselves.

If you are not satisfied with our answer, you may complain to the Nigeria Data Protection Commission, or to your own supervisory authority if you are elsewhere.

Cookies

We set four cookies. All are HttpOnly, so scripts on the page cannot read them. None is used for advertising, and none is shared with another company.

• A session cookie, so that you stay signed in. It lasts for your session.
• A staff access cookie, set only when finpo staff are supporting a workspace, and cleared when they leave.
• A visitor cookie (fv), set on your first visit, signed in or not, and kept for 400 days. It is a random code. It lets us count how many different people use finpo and see which pages and features they use, so we can fix what is hard and stop building what nobody opens. When you sign up, we link the code to your account.
• A visit cookie (fs), which groups what you do in one sitting. It ends after 30 minutes of quiet.

With these we record the pages you open, the buttons and features you use, errors you meet, and your screen size and language. We do not record your IP address, what you type into fields, or any sale, customer or stock detail. The owner of a business can turn off this recording for that business in Settings. We keep the records for 13 months.

Children

finpo is a product for businesses and is not directed at children. We do not knowingly collect data from anybody under 18. If you believe a child has given us data, write to us and we will remove it.

Changes

If we change this notice materially we will tell account holders by email before it takes effect. The date at the top is always the date of the last substantive change.

Contact

Nikcano Global Services, trading as finpo. Email support@nikcano.com.