B2B Capital Limited ("B2B Capital", "we", "us", or "our") operates the Kashlet mobile and web application (the "App"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our App.
By using Kashlet, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the App.
1. Information We Collect
1.1 Information You Provide Directly
- Account information: Name, email address, and phone number when you register.
- Identity verification (KYC): Bank Verification Number (BVN) or National Identification Number (NIN). We store only a one-way cryptographic hash — the raw number is never retained.
- Employment verification: Employer name, salary range, work email (optional), and payslip document for members who wish to join Salary Earners Circles.
- Business verification: Business name, business type, CAC certificate, and 3-month bank statement for members who wish to join Business Owners Circles.
- Payment information: Bank account details and card information processed securely by Paystack. We do not store full card numbers.
- Savings goals: Optional personal labels you attach to your circle memberships (e.g. "House rent").
1.2 Information Collected Automatically
- Device information: Device type, operating system, and a hashed device fingerprint used for fraud detection.
- Usage data: Pages visited, features used, and timestamps of activity within the App.
- IP address: Collected at login for security monitoring.
1.3 Information from Third Parties
- Identity verification providers: We use Prembly IdentityPass to verify BVN/NIN with NIBSS. We receive a verification result (pass/fail) and basic name/date-of-birth for matching — we do not receive or store full identity records.
- Authentication: We use Clerk for sign-in. Your profile picture URL may be stored if provided by Clerk.
- Payment processors: Paystack (Naira transactions) and NOWPayments (crypto transactions) provide transaction status and reference data.
2. How We Use Your Information
- To create and manage your Kashlet account and savings circles.
- To verify your identity as required by Nigerian financial regulations (KYC/AML compliance).
- To process contributions, payouts, and disbursements.
- To screen against sanctions lists and detect fraudulent activity (AML compliance).
- To review employment and business verification documents submitted by members.
- To send transactional emails (payment confirmations, verification results, circle activity).
- To provide customer support and resolve disputes.
- To improve the App and detect technical issues.
3. How We Share Your Information
We do not sell your personal information. We may share information in the following circumstances:
- Service providers: Prembly (KYC), Clerk (authentication), Paystack (payments), NOWPayments (crypto payments), Resend (email), Uploadthing (document storage), and Neon (database hosting). All are bound by data processing agreements.
- Circle members: Your first name/initial and anonymised email are visible to other members within the same savings circle for transparency of the payout rotation.
- Legal obligations: We may disclose your information where required by Nigerian law, court order, or regulatory authority (e.g. the CBN or EFCC).
- Business transfers: If B2B Capital is acquired or merges with another entity, your data may be transferred as part of that transaction.
4. Data Retention
- Account and transaction records are retained for a minimum of 5 years after account closure, as required by Nigerian AML regulations.
- Uploaded documents (payslips, CAC certificates, bank statements) are retained for 3 years after submission.
- Session and login data is retained for 90 days.
- You may request deletion of your account and personal data by contacting us. Note that legally required records cannot be deleted before the minimum retention period.
5. Data Security
- All data is transmitted over HTTPS/TLS encryption.
- BVN and NIN numbers are stored only as SHA-256 hashes — they cannot be reversed.
- Uploaded documents are stored in a secured cloud storage system with access controls.
- Staff access to member data is role-based and fully audited.
- Two-factor authentication (2FA) is available for all accounts.
Despite these measures, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.
6. Your Rights
Under the Nigeria Data Protection Act 2023 (NDPA), you have the right to:
- Access the personal data we hold about you.
- Correct inaccurate or incomplete data.
- Delete your personal data (subject to legal retention requirements).
- Object to processing of your data for certain purposes.
- Data portability — receive a copy of your data in a machine-readable format.
To exercise any of these rights, contact us at privacy@b2bcapital.com.ng.
7. Children's Privacy
Kashlet is not intended for persons under the age of 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, please contact us immediately and we will delete it.
8. Cookies and Tracking
The App uses session cookies for authentication purposes only. We do not use third-party advertising cookies or tracking pixels. Analytics, if used in the future, will be disclosed in an update to this policy.
9. Third-Party Links
The App may contain links to external websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date. Continued use of the App after changes are posted constitutes your acceptance of the revised policy.