Privacy Policy

Effective date: 21 July 2026

AjoHub ("we", "us", "the platform") is a record-keeping and coordination platform for rotational savings groups (ajo/esusu/stokvel) and cooperative societies. This policy explains what personal data we collect, why, and what your rights are. It is written to comply with the Nigeria Data Protection Act (NDPA) 2023 and to respect equivalent protections wherever our users are.

The most important thing to understand

AjoHub does not hold your money. Contributions move directly between group members and their group admin — by bank transfer, cash, or a payment provider such as Paystack. AjoHub records, verifies, and displays those transactions; it is not a bank, a wallet, or a money-transmission service. Because of that, the data we hold is records about your savings activity, not the funds themselves.

What we collect

Account data — name, email address, phone number (optional), password (stored only as a salted bcrypt hash — we cannot read it).

Identity verification (KYC) data — ID type, ID number, and home address, submitted by you when you verify your identity. Group creators undergo stricter verification than members.

Financial activity records — contributions you log, payouts recorded to you, savings group memberships, cooperative shares/savings/loans where you use those features, and receipt images you choose to upload as payment evidence.

Trust & reputation data — your Ajo Score (computed from your on-time contribution history, completed groups, KYC tier, and guarantor history), guarantor relationships you enter into, and dispute records you file or are named in.

Technical data — IP address (used for login security and rate limiting), authentication cookies, your language and theme preferences, and an audit log of financially material actions on your account.

Referral data — if you sign up through another member's invite link, we record who referred you.

What we use it for

• Operating your groups: showing members who contributed, who was paid, and when — the core purpose of the platform.
• Identity verification, fraud prevention, and the guarantor/trust system that keeps groups safe.
• Security: login protection, brute-force lockouts, session management, and a tamper-evident audit trail of financial actions.
• Communications: transactional emails (password resets, contribution reminders, guarantor requests) and in-app notifications. We do not send marketing email without separate consent.
• Legal compliance and dispute resolution.

We do not sell your personal data. Ever.

Who we share it with

We use a small number of processors to run the service:

• Hosting & database — our application and database hosting providers store the data described above.
• Paystack — if you pay through Paystack, your payment is processed under Paystack's own privacy policy; we receive confirmation of the payment, not your card details.
• Cloudinary — receipt images you upload are stored there.
• Email delivery provider — to send you transactional email.
• Sentry — error monitoring; configured not to receive personally identifying information by default.

Within your group, other members can see your display name (or your alias, if the group allows anonymity and you chose one), your slot, contribution status, and your Ajo Score. Your email is visible only to your group admin. Your KYC details are visible only to platform administrators.

Data retention

Financial records (contributions, payouts, memberships, audit entries) are retained even after you leave a group, because every other member of that group has a legitimate interest in a complete, unalterable record of what happened with the group's money. Membership records are marked as ended rather than erased for the same reason. If you close your account, we will remove or anonymise personal data that is not part of another member's financial record or required for legal compliance.

Your rights

Under the NDPA you have the right to access the personal data we hold about you, correct it, ask for deletion (subject to the retention principle above), object to processing, and lodge a complaint with the Nigeria Data Protection Commission.

Access and deletion are self-service, from your Profile page: Export my data downloads everything we hold about you as a file; Delete my account clears your name, email, and phone permanently and signs you out everywhere. Your contribution/payout history and KYC records stay on file under an anonymised identity — they're financial and compliance records other members and regulators have a legitimate interest in, not contact details, so they're retained rather than erased, per the paragraph above. For corrections, objections, or anything not covered by those two self-service actions, contact us at the address below.

Cookies

We use strictly necessary cookies only: session authentication (httpOnly), CSRF protection, and your language preference. Your theme choice is stored in your browser's local storage. We do not use advertising or cross-site tracking cookies. If we add privacy-respecting product analytics, it will be cookieless or covered by an update to this policy.

Children

AjoHub is for adults. You must be 18 or older to create an account.

Changes

We will post any material change to this policy here and update the effective date. Continued use after a change takes effect constitutes acceptance.

Contact

Questions, requests, or complaints: support@osherlabs.com