Privacy Policy

1. Who we are

Flowpoint ("we", "us") is e-invoicing and NRS compliance software at tryflowpoint.com and app.tryflowpoint.com.

This policy explains what personal data we handle, why, and the rights you have under the Nigeria Data Protection Act 2023 (NDPA).

2. Our role

For the people who use Flowpoint and the people who contact us, we decide how their data is used, so we are the data controller.

For the invoice data a business puts into Flowpoint, including details of its own customers and suppliers, that business is the data controller. We process that data on its instructions, including submitting invoices to the Nigeria Revenue Service (NRS) as its System Integrator. If an invoice was issued to you, contact the business that issued it; we will help it respond.

3. Data we collect

• Account details: name, work email address, phone number, role, password (stored only as a one-way hash), sign-in codes and sign-in history.
• Business details: business name, TIN, RC number, address, contact details, the bank details a business chooses to show on its invoices, its NRS Business ID and Service ID, and its NRS API key, secret and cryptographic keys.
• Invoice data: invoices, credit notes and debit notes, including customer and supplier names, TINs and addresses, items, amounts, taxes, IRNs, QR codes, NRS responses and approval history.
• Files you upload: CSV, Excel and PDF invoices.
• Support messages: what you send us through the contact form or by email.
• Technical data: IP address, browser and device information, request logs and security events.

4. How we use it

We do not send marketing emails without your consent, and we do not sell personal data.

We use personal data only for these purposes, each with a lawful basis under the NDPA:

5. Automated processing

Validation rules check each invoice before it is submitted to NRS. When a business uploads a PDF invoice, an AI document-extraction service reads it into a draft, which a person reviews before anything is submitted.

We do not make decisions that have legal or similarly significant effects on individuals solely by automated means.

6. Who we share it with

We share personal data only with:

• NRS, and the NRS-recognised Access Point Provider that transmits invoices to it, to validate, sign and report invoices, as the law requires and on the business's instruction.
• Service providers that help us run Flowpoint: cloud infrastructure, network and security, transactional email, and AI document extraction (used only when a PDF is uploaded). Each is bound by data-protection terms and may use the data only to provide its service to us.
• Integrations a business connects, such as accounting software, which receive only the data the business chooses to sync.
• Authorities, where the law requires it.
• A list of our named service providers is available on request from [email protected].

7. Transfers outside Nigeria

Some of our service providers process data outside Nigeria. Where they do, we rely on the safeguards the NDPA requires for cross-border transfers, such as contractual data-protection commitments. You can ask us for details at [email protected].

8. How long we keep it

• Account details: while the account is active, then deleted or anonymised within a reasonable period unless the law requires us to keep them longer.
• Invoice and NRS submission records: 7 years, as tax records.
• Support messages: as long as needed to resolve the request and keep a record of it.
• Technical logs: for a limited period for security and troubleshooting, then deleted.

9. Security

Data is encrypted in transit and at rest. NRS API keys and secrets are additionally encrypted by Flowpoint before they are stored. Sign-in uses a one-time code sent by email, access follows each user's role, accounts are created only by invitation, and important actions are recorded in an audit trail.

If a personal data breach affects you, we will notify you and the Nigeria Data Protection Commission (NDPC) as the NDPA requires.

10. Your rights

Under the NDPA you have the right to:

• be told how your data is used (this policy);
• get a copy of your data;
• have inaccurate data corrected;
• have your data deleted where we no longer need it or have no lawful basis to keep it;
• restrict or object to some processing;
• receive your data in a portable format;
• withdraw consent where processing is based on consent;
• not be subject to decisions based solely on automated processing that have legal or similarly significant effects;
• complain to the Nigeria Data Protection Commission.

11. Cookies

This website does not use analytics or advertising cookies. The Flowpoint portal uses only the cookies and browser storage needed to keep you signed in and secure and to remember your preferences. We do not use third-party tracking.

12. Children

Flowpoint is a business service and is not intended for anyone under 18.

13. Changes

We will update this policy when our practices change and show the date of the latest version above. We will tell business customers about material changes by email.

14. Contact

To exercise your rights or ask about this policy, email [email protected]. We aim to respond within 30 days.