Privacy policy

Vintran Receipt is run by Vintran (“we”, “us”). For the data in your own account, we are the data controller under the NDPA. You can reach us about anything in this policy at [email protected].

We play a different part depending on whose data it is.

• Your account. The details you give us about yourself and your business. We decide how this is used, so we are its controller.
• Your customers' data. The customers you add and the documents you issue to them. Your business decides what to record and why, so your business is the controller and we are its processor. We use this data only to provide the service to you, never for our own purposes.

If you run a business on Vintran Receipt, you need a lawful reason to record your customers' details, and you should tell them how you use those details.

If you are a customer of a business that uses Vintran Receipt, contact that business first to see, correct or delete your details. If you can't reach them, email [email protected] and we'll help where we can.

We don't take card payments in the app. If we add them, a payment provider will handle your card details, and we won't store them.

The NDPA lets us use personal data only with a lawful basis. This is what we use it for, and on what basis.

We don't send marketing emails. If we start, we'll ask you first, and every one will have an unsubscribe link.

Every document gets a private share link, so a business can send it to a customer. Anyone who has the link can view the document without signing in, including the customer's name, the items and the amounts. Links are long and random, so they can't be guessed, but they work for whoever holds them.

Documents also carry a verification code and QR code. Anyone who enters the code on our document check page sees the issuing business's name and can open the document, to confirm it's genuine.

Share documents only with the people they're meant for. If one reaches the wrong person, the business owner can delete it, and its link and code stop working. Copies already downloaded stay with whoever has them.

We share personal data only with the providers that run parts of the service for us, under contract, and only what each needs to do its job.

We may also share personal data:

• when the law requires it, or to protect people from fraud or harm;
• with a buyer if Vintran Receipt is sold or merged. They'd be bound by this policy, and we'd tell you first.

We never sell personal data or share it for advertising.

Some of our providers store or process data outside Nigeria, including in the European Union and the United States. Cloudflare and Resend are US companies.

When data leaves Nigeria, we rely on the grounds in Part VIII of the NDPA. Either the destination has adequate data protection law, or the provider's data processing terms commit it to protecting the data to that standard.

Tax law may require your business to keep its records for several years. Download the documents you need before you close your account.

• Passwords and sign-in codes are stored only as one-way hashes. Codes expire after 10 minutes and stop working after 5 wrong attempts.
• Each login can be signed in on two devices at most, and you can sign other devices out.
• Staff see only what the business owner allows them to.
• Bank statements and other evidence are stored under unguessable names and never linked publicly. Our review team opens them only through links that expire after 15 minutes.
• Data travels between your device and our servers over encrypted connections (HTTPS).

No system is perfectly secure. If a breach puts personal data at risk, we'll report it to the Nigeria Data Protection Commission within 72 hours of finding out. If it's likely to put you at high risk, we'll tell you without delay.

Under the NDPA you have the right to:

• Access the personal data we hold about you, and get a copy.
• Correct data that is wrong or incomplete. You can edit most of it yourself in your settings.
• Delete your data and close your account.
• Restrict how we use your data, for example while a complaint is resolved.
• Object to uses based on our legitimate interests.
• Port your data: get it in a common, machine-readable format.
• Withdraw consent where we rely on it. This doesn't affect what we did before you withdrew.
• Not be subject to decisions made solely by automated means that significantly affect you.

To use any of these rights, email [email protected] from the address on your account. We may need to confirm it's you. We'll reply within 30 days, free of charge.

If you're unhappy with how we've handled your data, you can complain to the Nigeria Data Protection Commission. We'd appreciate the chance to fix it first.

Accreditation is the only place we use automated checks. Each day, the app measures every business's activity against the published criteria. The check never awards or refuses accreditation on its own. A member of our team reviews every business it refers, together with the evidence the business submits.

We use only the cookies and storage the app needs to work, or that remember your own choices. We don't use advertising or analytics cookies, so we don't ask for cookie consent.

Vintran Receipt is for businesses and isn't meant for anyone under 18. If you believe a child has opened an account, email [email protected] and we'll remove it.

When we change this policy, we update the date at the top. If a change significantly affects how we use your data, we'll tell you by email or in the app before it takes effect.

Questions, requests or complaints about your data: [email protected]. Signed-in users can also raise a ticket from Support in the app.