Privacy Policy

1. Who We Are

Ollorix is a product of Ollorix Limited, a company registered in the Federal Republic of Nigeria under the Companies and Allied Matters Act (RC No. 9700341).

We provide AI-powered bookkeeping and business management software for Nigerian small and medium enterprises, delivered through WhatsApp and a web dashboard.

2. Information We Collect

Information you provide directly:

• Your name and business name
• WhatsApp phone number and Telegram username
• Business financial data you record through the bot (sales, purchases, expenses, customer balances)
• Customer and supplier names you mention in transactions
• Opening balances entered during the setup wizard
• Bank account details (bank name and account number) you add to the dashboard

Information collected automatically:

• Message content sent to the Ollorix bot (WhatsApp or Telegram)
• Timestamps of messages and transactions
• Session state data (temporary, for multi-step conversations)
• Usage logs and error logs for service reliability

3. How We Use Your Information

We use the information we collect to:

• Record and organise your business transactions in double-entry accounting format
• Generate financial reports (P&L, Balance Sheet, debtors, creditors, invoices)
• Process and respond to your messages through the bot
• Maintain session state for multi-step conversations (e.g. setup wizard)
• Send you bot responses and updates related to your recorded transactions
• Improve the accuracy of our AI parser using anonymised patterns
• Provide customer support when you contact us
• Comply with applicable laws and regulations in Nigeria

We do not use your financial data for advertising, profiling, or sale to third parties.

4. Intended Use of WhatsApp Messages

Ollorix is designed exclusively for business accounting automation. When you connect your WhatsApp Business number to Ollorix, the service operates as follows:

The service WILL:

• Read messages sent to the Ollorix bot number by you (the business owner) or your customers
• Extract transaction data (amounts, customer names, product names, dates) from those messages
• Record extracted transactions as double-entry accounting entries in your account
• Send automated responses confirming recorded transactions

The service WILL NOT:

• Access your personal WhatsApp account or personal chats
• Read messages between you and other contacts outside the bot conversation
• Store raw message content beyond what is needed to extract transaction data
• Share message content with any third party except as required to process transactions (Groq AI for parsing, as described in Section 7)
• Send unsolicited promotional messages to your customers
• Use your business data to train AI models without your explicit consent

5. Legal Basis for Processing

Under the Nigeria Data Protection Regulation (NDPR) 2019, the Nigeria Data Protection Act (NDPA) 2023, and the General Application and Implementation Directive (GAID) 2025, we process your personal data on the following lawful bases:

6. Data Storage and Retention

Your data is stored in Supabase (PostgreSQL database hosted on AWS infrastructure). All data is encrypted at rest and in transit using TLS 1.2 or higher.

If you request account deletion, we will delete your personal data within 30 days, except where retention is required by law.

7. Third-Party Services

We share data with the following third-party providers who assist in delivering our service:

• Meta Platforms (WhatsApp Business API) — message delivery. Messages you send to the Ollorix WhatsApp number are processed by Meta under their WhatsApp Privacy Policy.
• Telegram — message delivery for Telegram bot users. Governed by Telegram's Privacy Policy.
• Groq, Inc. — AI language model (primary). Your transaction messages are sent to Groq's API to extract financial data. Groq does not retain inputs for model training by default.
• Google (Gemini AI) — AI language model (fallback). Used only when the primary AI is unavailable. Governed by Google's Privacy Policy.
• Vercel, Inc. — web hosting and serverless functions. Our dashboard and webhook endpoints run on Vercel's infrastructure.
• Supabase, Inc. — database and authentication. All your stored business data lives in Supabase.
• Mono Technologies Nigeria Ltd. — bank account linking (opt-in only). Where you choose to connect your bank account via Mono Connect, your account balance and transaction history are fetched from Mono's API. Mono is licensed by the Central Bank of Nigeria (CBN). Governed by Mono's Privacy Policy.

We enter into data processing agreements with all third-party processors and require them to handle your data in compliance with applicable law.

8. Data Sharing

We do not sell, rent, or trade your personal data to any third party.

We may disclose your information only in the following circumstances:

• With your explicit consent
• To comply with a lawful order from a Nigerian court or government authority
• To protect the rights, safety, or property of Ollorix Limited, our users, or the public
• In connection with a merger, acquisition, or sale of company assets (you will be notified)

9. Security

We implement appropriate technical and organisational measures to protect your data, including:

• TLS encryption for all data in transit
• AES-256 encryption at rest in Supabase
• Row-level security (RLS) policies — each user can only access their own data
• API keys and secrets stored as environment variables, never in source code
• Access to production data restricted to authorised personnel only

No system is 100% secure. If you believe your account has been compromised, contact us immediately at support@ollorix.com.

10. Your Rights Under NDPR / NDPA

As a data subject under Nigerian law, you have the following rights:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate or incomplete data
• Right to erasure — request deletion of your data, subject to legal retention requirements
• Right to restrict processing — request that we limit how we use your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — where processing is based on consent, withdraw it at any time

To exercise any of these rights, contact us at support@ollorix.com. We will respond within 30 days.

If you believe your rights have been violated, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpb.gov.ng.

11. Children's Privacy

Ollorix is not intended for use by persons under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with data, please contact us and we will delete it promptly.

12. International Data Transfers

Your data may be processed by our third-party service providers (Groq, Vercel, Supabase) on servers located outside Nigeria, including in the United States and European Union. Where such transfers occur, we ensure adequate safeguards per NDPA 2023 Section 43, including Standard Contractual Clauses and binding processor agreements. Only data strictly necessary for service delivery is transferred.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via the Ollorix bot (WhatsApp or Telegram) at least 14 days before the changes take effect. The updated date at the top of this page will reflect the latest revision.

Continued use of Ollorix after the effective date constitutes acceptance of the updated policy.

14. Contact Us