Privacy Policy

Taxflow is a Nigerian tax preparation service that reads your bank and fintech transactions, separates taxable income from money that was never income in the first place, and prepares figures you can file with. Throughout this policy, “Taxflow”, “we” and “us” mean the company operating taxflow.com.ng.

We are the data controller for the personal information described here. You can reach our data protection contact at support@taxflow.com.ng.

We collect only what we need to work out your tax position:

• Account details — your name, email address, phone number and password hash.
• Identity information — your BVN or Tax Identification Number where you provide one, used to discover the accounts held in your name and to prepare filings.
• Financial data — transaction history, balances and account metadata from the banks and fintechs you choose to connect, or from bank statements you upload.
• Documents — receipts, invoices and statements you add to support a deduction.
• Usage data — device type, browser, pages viewed and approximate location derived from your IP address, used to keep the service secure and working.

We do not collect or store your internet banking passwords, card PINs or one-time passcodes. Account connections are made through licensed open-banking providers that return read-only access.

• To classify your transactions and calculate what is genuinely taxable.
• To identify deductions and allowances you are entitled to claim.
• To generate tax reports, summaries and filing-ready documents.
• To answer your questions through our in-app assistant and support channels.
• To detect fraud, abuse and unauthorised access to accounts.
• To meet our obligations under Nigerian tax, anti-money-laundering and company law.

We do not sell your data, and we do not use your financial data to build advertising profiles.

Under the Nigeria Data Protection Act 2023 we rely on: your consent when you connect an account or upload a statement; performance of a contract when we deliver the service you have subscribed to; legal obligation where record-keeping or reporting is required of us; and our legitimate interests in keeping the platform secure and improving how well it classifies transactions. You may withdraw consent at any time, which will end the processing that depends on it.

We share personal data only in these situations:

• Open-banking and payment partners that establish read-only connections to your accounts on your instruction.
• Infrastructure providers for hosting, storage, email delivery and error monitoring, all bound by written data-processing terms.
• Tax authorities where you ask us to prepare or submit a filing on your behalf.
• Regulators, courts or law enforcement where we are legally compelled to disclose.
• An acquirer if the business is sold or reorganised, subject to this policy continuing to apply.

Data is encrypted in transit with TLS and at rest with AES-256. Access to production systems is limited to named staff, protected by multi-factor authentication and logged. Account connections are read-only by design: Taxflow cannot initiate transfers, withdrawals or any other transaction on your accounts. We test our systems regularly and will notify you and the Nigeria Data Protection Commission of any breach affecting your rights within the timeframe the law requires.

We keep your account and tax records for as long as your account is active, and for six years after closure where Nigerian tax law requires records to be retained. Data that we are not required to keep is deleted or irreversibly anonymised within 90 days of your request. Disconnecting a bank account stops any further transaction data being collected from it immediately.

You have the right to:

• Access the personal data we hold about you and receive a copy of it.
• Have inaccurate or incomplete data corrected.
• Have your data deleted where we have no overriding legal obligation to keep it.
• Restrict or object to particular processing.
• Receive your data in a portable, machine-readable format.
• Withdraw consent, and to disconnect any linked account at any time.
• Lodge a complaint with the Nigeria Data Protection Commission if you believe we have handled your data unlawfully.

Write to support@taxflow.com.ng to exercise any of these. We respond within 30 days.

We use strictly necessary cookies to keep you signed in and to protect forms against abuse. We use privacy-respecting analytics to understand which pages are useful; these do not follow you across other websites. You can block cookies in your browser, though signing in will not work without the necessary ones.

Taxflow is not intended for anyone under 18. We do not knowingly collect data from children, and will delete any such data promptly if we discover it.

If we change this policy we will update the date at the top of this page, and for material changes we will email registered users at least 14 days before the change takes effect.