Privacy Policy

Haaja is the data controller for the personal data of registered users (business owners who create a Haaja account) described in this Policy. Contact details for privacy-related requests are provided in Section 13.

An important distinction: when you use Haaja to record information about your own customers (name, phone number, WhatsApp handle, Instagram username, email, or address), you — the business owner — act as the data controller for that customer information, and Haaja acts as a data processor on your behalf. You are responsible for having a lawful basis (such as your customer's consent, or the necessity of processing to fulfil an order) before entering someone else's personal data into Haaja.

2.1 Information you provide directly

• Account information: full name, email address and phone number (or authentication credentials).
• Business profile information: business name, category, currency, business address, bank account details and WhatsApp number.
• Business records you create: sales, products and inventory levels, expenses, invoices, receipts, and reminders.
• Your customers' information, where you choose to enter it: name, phone number, WhatsApp availability, Instagram username, email, address, and free-text notes.
• Payment information for Pro subscriptions, processed by our third-party payment processor (see Section 4). Haaja does not store full card or bank account numbers.
• Communications you send us, such as support requests or feedback.

2.2 Information collected automatically

• Usage data: features used, screens viewed, and actions taken within the App.
• Notification preferences: stored locally on your device.
• Device and technical data: device type, operating system, app version, and unique device identifiers, collected for security, diagnostics, and app performance.

2.3 Information processed by Ask Haaja (AI assistant)

If you use Ask Haaja, the questions you ask and the relevant business data needed to answer them (such as sales totals, expense categories, or product names) are sent to our AI service provider (Google Gemini) to generate a response. We do not use your business data to train shared or public AI models.

Ask Haaja may also propose write actions — such as adding a product, recording an expense, or creating an order — which are displayed for your review and executed only upon your explicit confirmation. Data created through Ask Haaja is stored in your account exactly as if you had entered it manually. See Section 4 for more on third-party processors.

We process personal data on the following lawful bases under the NDPA:

• Performance of a contract — to create your account, operate core features (sales, inventory, expense tracking, invoicing), and provide customer support.
• Consent — for optional features such as marketing communications, or use of Ask Haaja.
• Legitimate interests — to maintain the security and reliability of the App, prevent fraud, and improve features, balanced against your rights and interests.
• Legal obligation — to comply with applicable law, respond to lawful requests from public authorities, or enforce our Terms of Service.

We do not sell your personal data. We share information only in the following circumstances:

• Service providers (data processors): cloud hosting, payment processing, and our AI service provider (Google Gemini), each bound by a written data processing agreement consistent with NDPA requirements.
• WhatsApp and Instagram sharing: when you tap "Share to WhatsApp" or "Share to Instagram," Haaja uses your device's native share function or a pre-filled message link. Haaja does not transmit your data to Meta directly — the share happens through your own device and account, governed by WhatsApp's and Instagram's own privacy policies.
• Legal and safety reasons: where required to comply with a law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Haaja, our users, or the public.
• Business transfers: if Haaja is involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction, subject to continued protection under this Policy or a policy at least as protective.

We retain personal data for as long as your account remains active and as necessary to provide the App, comply with legal, tax, and accounting obligations, resolve disputes, and enforce our agreements.

When you delete your account, your live business data is deleted immediately from our active servers. A secure archive of your financial records (sales, expenses, invoices, and related data) is retained for 7 years following account deletion, as required by the Nigeria Revenue Service (NRS). This archived data is not accessible to you or any other user, and is permanently purged after the 7-year period.

We use industry-standard safeguards to protect personal data, including encryption of data in transit and at rest, access controls limiting who can view your data, and regular security review of our systems. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We will notify affected users and, where required, the NDPC, without undue delay and in any event within the statutory timeframe in the event of a data breach likely to result in a risk to your rights.

Subject to applicable law, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete personal data.
• Delete your personal data, subject to legal retention obligations.
• Receive a copy of your data in a structured, commonly used, machine-readable format (data portability).
• Object to or restrict certain processing of your personal data.
• Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your rights have been violated.

To exercise any of these rights, contact us using the details in Section 13. We will respond within the timeframe required by the NDPA.

Haaja is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us immediately.

Some of our service providers (such as cloud hosting or AI processing infrastructure) may process data outside Nigeria. Where this occurs, we take steps required under the NDPA to ensure an adequate level of protection, including entering into standard contractual clauses or relying on your explicit consent where required.

The Haaja mobile app may use similar technologies to remember your session and preferences and to understand app usage through analytics tools. We do not currently serve advertising, and do not use tracking technologies to build advertising profiles.

We use the following third-party services to operate Haaja:

• Clerk (clerk.com) — handles authentication, including email verification and optional Google / Apple Sign-In. Clerk processes your email address and name. See Clerk's Privacy Policy at clerk.com/legal/privacy.
• Supabase (supabase.com) — stores your business data securely in a PostgreSQL database with row-level security. All data is isolated per business account. See Supabase's Privacy Policy at supabase.com/privacy.
• Google Gemini (Google AI) — powers the Ask Haaja AI assistant. When you use Ask Haaja, your questions and relevant business context are sent to Google's Gemini API to generate a response. We do not use your business data to train shared or public AI models. See Google's Privacy Policy at policies.google.com/privacy.
• Expo / EAS (expo.dev) — used to build and distribute the mobile application.

When you use Google Sign-In or Apple Sign-In, your authentication is handled by Google or Apple respectively. We receive only a token confirming your identity — we do not receive your Google or Apple password.

Haaja integrates with WhatsApp and Instagram for sharing purposes only. Your use of those platforms is governed by their own privacy policies and terms, which we encourage you to review.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the App or by email before the changes take effect. The "Last updated" date at the top of this Policy indicates when it was last revised.

If you have questions about this Privacy Policy or how we handle your data, please contact us at: hello@haaja.app