Privacy Policy

This Privacy Policy explains how Bukki Technologies Limited (“Bukki”, “we”, “us”, or “our”) collects, uses, shares, and protects personal data when you visit our website, create an account, or use our accounting and financial-management services. We process personal data in accordance with the Nigeria Data Protection Act 2023 (the “NDP Act”) and other applicable laws.

Scope and responsibility

This policy applies to business owners, accountants, invited workspace members, customers who receive documents from a Bukki user, and visitors to our website. The organisation that controls a workspace decides who may access its records and is responsible for ensuring that personal data it enters intoBukki was collected lawfully. Bukki acts as a controller for account, billing, product-usage, and support data, and as a processor when handling workspace data on a customer’s instructions.

Personal data we collect

• Account and profile data: your name, email address, authentication credentials, user category, firm name, and account preferences.
• Workspace and business data: business names, contact details, team roles, invitations, customers, suppliers, invoices, bills, expenses, inventory, budgets, approvals, tax records, reports, and ledger entries.
• Connected financial data: account names, account numbers, institution details, balances, transactions, and connection metadata supplied by an authorised open-banking connection.
• Files and AI content: documents, spreadsheets, PDFs, images, prompts, and conversations you submit to Bukki AI, together with extracted text and generated results.
• Billing data: plan, subscription, payment status, customer and authorization references, and billing history. Payment-card details are handled by our payment provider and are not stored by Bukki.
• Technical and usage data: IP address, browser, device, session, feature interaction, diagnostics, and security-event data.
• Communications: support requests, feedback, survey responses, and email preferences.

How we collect data

We collect data directly from you, from people who invite you to a workspace, from your use of the service, and from providers you choose to connect, including Mono and Paystack, as well as from analytics providers such as Microsoft Clarity. We may also receive information when a customer or supplier is added to a workspace or receives an invoice, approval request, or other document.

Why we process personal data

Depending on the circumstances, we rely on performance of a contract, compliance with legal obligations, consent, and our legitimate interests in operating, securing, and improving Bukki. We use personal data:

• To create accounts, authenticate users, manage permissions, and provide workspaces.
• To import and organise transactions, maintain books and ledgers, and produce invoices, reports, summaries, and tax-related records.
• To operate AI-assisted categorisation, document analysis, and chat features.
• To process subscriptions, maintain billing records, and deliver plan entitlements.
• To send transactional messages, security notices, service updates, and summaries you may control in your settings.
• To investigate abuse, protect accounts, troubleshoot failures, and maintain the reliability of the service.
• To comply with lawful requests and accounting, tax, fraud-prevention, and data-protection obligations.

Bank connections

When you choose to connect an account, Mono provides the connection interface and sends Bukki the financial data you authorise. Your online-banking credentials are entered through Mono’s connection flow, not into Bukki. Bukki uses this access to retrieve account information and does not use it to initiate transfers. You can disconnect a linked account from the service; previously imported records may remain in your workspace until you delete them or the workspace, subject to legal retention requirements.

AI-assisted features

We send only the workspace context reasonably needed to fulfil an AI request to providers that process it on our behalf. This may include transaction descriptions, financial totals, your prompt, and content extracted from an uploaded file. AI results may be incomplete or inaccurate and must be reviewed. Suggestions do not automatically become final accounting records merely because a model generated them. You can avoid AI chat and file analysis by not using those features, although automated transaction suggestions may form part of a plan’s bookkeeping workflow.

Analytics

We use Microsoft Clarity to understand how our website and app are used. Clarity collects technical and usage data — such as pages visited, clicks, scrolling, and other interactions — and may record session replays and heatmaps of those interactions. It uses a first-party cookie to recognise a returning browser. We configure Clarity to mask content we consider sensitive, and content entered into input fields is masked by Clarity by default. Data collected by Clarity is processed by Microsoft on our behalf in accordance with the Microsoft Privacy Statement. We use this data to diagnose problems, measure performance, and improve Bukki. You can clear or block cookies in your browser settings, and blocking cookies does not affect your ability to use the service.

When we share data

We do not sell personal data. We disclose it only where reasonably necessary to provide the service, follow your instructions, protect our users, or comply with law. Recipients may include hosting and database providers, Mono, Paystack, email-delivery providers, AI processing providers, analytics and security vendors (including Microsoft for Clarity analytics), professional advisers, regulators, and law-enforcement bodies where disclosure is legally required. Workspace data is also visible to members whom a workspace owner or administrator authorises.

International transfers

Some providers may process data outside Nigeria. Where personal data is transferred internationally, we use contractual, organisational, and technical safeguards required by applicable law and assess whether the recipient can protect the data appropriately.

Retention and deletion

We retain personal data for as long as needed to provide the service, maintain security and audit records, resolve disputes, and meet legal obligations. Retention periods vary by record type. Deleting a workspace removes its active financial records and connections from the service, but limited information may remain in backups, fraud-prevention records, billing records, or records we must preserve by law. We delete or anonymise such information when the applicable retention period ends.

Security

We use access controls, workspace-level authorization, encryption in transit, protected infrastructure, two-factor authentication, audit records, and other safeguards designed to prevent unauthorised access, loss, alteration, or disclosure. No online service is risk-free. Please use a strong password, enable two-factor authentication, and report suspicious activity promptly. More information is available on our security page.

Your privacy rights

Subject to applicable law, you may ask to be informed about our processing, access your personal data, correct inaccurate data, request deletion or restriction, object to certain processing, obtain portable data, withdraw consent, or request human review of a significant automated decision. You may also lodge a complaint with the Nigeria Data Protection Commission. We may need to verify your identity and may retain information where an exception or legal obligation applies.

Children

Bukki is a business service and is not directed to children. You must be at least 18 years old to create an account. If you believe a child has provided personal data to us, contact us so we can investigate.

Changes and contact

We may update this policy as the service or law changes. We will post the revised version and update the date above, and we will provide additional notice where a change materially affects your rights. To exercise a privacy right or ask a question, email privacy@getbukki.com.