Privacy policy.

01Information we collect

TaxJeje collects information needed to provide tax-compliance services to Nigerian taxpayers — freelancers, salary earners, sole proprietors, and creators.

Personal information

• Full name and email address
• Phone number (optional)
• State of residence in Nigeria
• Tax Identification Number (TIN), if you provide one
• Work type and profession

Financial information

• Income records and sources you add to the app
• Expense records and categories
• Subscription payment transactions (processed by Paystack)
• Tax calculations and filing history

Technical information

• IP address and device information
• Browser type and version
• Usage patterns and feature interactions
• Error logs and performance data

02How we use your information

We use your information to:

• Provide tax-calculation and compliance services
• Generate tax reports and filing documents
• Process subscription payments
• Send important updates about deadlines and filing requirements
• Improve the service and user experience
• Comply with legal and regulatory requirements
• Detect and prevent fraud or security issues

03Storage and security

We protect your financial and personal data with the following controls:

• All data is encrypted in transit using TLS 1.3
• Data at rest is encrypted using AES-256 on Supabase Postgres
• Supabase infrastructure is SOC 2 Type II certified
• Audit logging on every data-access and modification path
• Row-level security (RLS) enforced on every database table
• Regular security review and dependency-vulnerability scans

04Third-party services

We work with the following trusted providers:

Paystack — payment processing

We use Paystack to process subscription payments. Paystack is PCI-DSS certified. Your card details are handled directly by Paystack and never stored on TaxJeje servers.

Supabase — database and authentication

Your data is stored on Supabase, which is SOC 2 Type II certified. Database is hosted in London, United Kingdom (eu-west-2) with automated daily backups. Data processing in the UK is governed by UK GDPR, which the EU recognises as providing equivalent protection under the adequacy decision dated 28 June 2021.

Vercel — hosting and site analytics

The TaxJeje application is hosted on Vercel, which provides enterprise-grade security and performance with edge TLS termination. Vercel Analytics records which pages are visited. It runs only after you allow analytics in the cookie banner, and never on pages you are signed in to.

Sentry — error monitoring

When something breaks, Sentry records the error and the sequence of actions that led to it, which can include a reconstruction of what was on screen (Session Replay). We use it to fix faults, not to watch people.

Upstash — rate limiting

Upstash Redis counts requests so the service cannot be overwhelmed. It holds counters keyed to an account or an address, not your records.

Mono — bank connections

Where you choose to connect a bank account, Mono is the open-banking provider that reads it. This happens only if you connect an account, and the connection is read-only.

Google Analytics and the Meta Pixel — measurement

Both measure how people find and use the public pages. Both are off until you allow themin the cookie banner, and neither runs on pages you are signed in to, on invoice links, or inside the embeddable calculator. The Meta Pixel sets an advertising identifier when it is allowed to run — see section 08.

Resend — transactional email

Email confirmations, deadline reminders, and account notices are sent via Resend from noreply@taxjeje.com.

Anthropic — AI features

Several features send data to Anthropic for processing. This is more than the AI Tax Expert, and more than question text:

• AI Tax Expert: your question, plus your work type and state of residence.
• Transaction categorisation: the description, amount, date and counterparty name of transactions we could not categorise by rule — including bank-statement narrations.
• Receipt scanning and document analysis: the image or document itself. A receipt or a contract may carry names, addresses and other details printed on it.
• Deduction suggestions: your work type and your annual income and expense totals.

We do not send your name, TIN, NIN or bank details as part of any of these requests. Anthropic does not use this data to train models.

05Nigerian data protection compliance

TaxJeje complies with the Nigeria Data Protection Regulation (NDPR) and the Nigeria Data Protection Act 2023. As a data controller, we:

• Process personal data lawfully, fairly, and transparently
• Collect data only for specified, explicit purposes
• Minimise collection to what is necessary for the service
• Keep data accurate and up to date
• Retain data only as long as needed (see section 07)
• Implement appropriate security measures (see section 03)

06Your rights

Under Nigerian data-protection law you have the right to:

• Access: request a copy of the personal data we hold about you
• Rectification: request correction of inaccurate data
• Erasure: request deletion of your data, subject to legal-retention requirements
• Portability: export your data in a machine-readable format
• Object: object to certain processing
• Withdraw consent: withdraw consent where processing relies on it

To exercise these rights, contact us at dpo@fattahlabs.com.

07Data retention

We retain your data according to this schedule:

• Account data: retained while your account is active. On closure we remove your personal identifiers within 30 days.
• Financial records:kept for six years after the END OF THE TAX YEAR the record relates to, which is what NTAA 2025 section 31(5) requires — not six years from the date it was created. An invoice raised in January 2026 is kept until 31 December 2032.
• These outlive account closure. Closing your account anonymises your identifiers; the financial rows themselves are retained, because the law requires it of you as well as of us.
• Payment records: retained for 6 years for financial-compliance reasons
• Audit logs: retained for 2 years for security purposes

08Cookies and tracking

We use essential cookies for authentication and security. These are always on — the service cannot sign you in without them.

We also use analytics and advertising cookies: Google Analytics, the Meta Pixel and Vercel Analytics. The Meta Pixel sets an advertising identifier.

These are off by default.Nothing loads until you choose “Allow” in the cookie banner, and you can change your answer at any time from the same banner. They never run on pages you are signed in to, on invoice links, or inside our embeddable calculator.

09Changes to this policy

We may update this Privacy Policy periodically. We will notify you of significant changes via email or in-app notification. Continued use of TaxJeje after changes take effect constitutes acceptance of the updated policy.

10Contact information

For privacy-related inquiries or to exercise your rights, contact:

• Email: dpo@fattahlabs.com
• Address:Fattah Labs Ltd (RC 9223584)
  3rd Floor, ASD City Mall
  Independence Way, Kaduna
  Nigeria