Privacy & Data Protection Policy

CreditPrint helps informal and small business owners in Nigeria turn their bank statements into a verifiable credit profile that lenders can review. Doing that means we handle real financial data, so this page explains — plainly — what we collect, why, who can see it, and how it's protected.

If you sign up as a business owner:

• Your name, email address, and phone number
• Your business name, type, and location
• The bank statements you upload (PDF or CSV)
• The credit signals extracted from those statements — net cash flow, transaction frequency, inflow diversity, obligation regularity, and account tenure

If you sign up as a lender:

• Your name, email address, phone number, and company details
• Verification documents you upload during onboarding — CAC certificate, means of ID, and license certificate
• Your company logo and public profile information (industry, years in operation, company size)

• To analyse uploaded bank statements and generate your credit profile
• To let business owners share their credit profile with lenders, and let approved lenders review it
• To verify lender accounts before they can browse or request access to any business owner's profile
• To communicate with you about your account (e.g. verification emails, processing status)

We do not sell your data, and we do not use your bank statements for any purpose beyond generating your credit profile and, where you choose to share it, showing that profile to lenders.

We may use anonymous, aggregated information to improve CreditPrint, develop new features, and produce market insights. This information cannot be used to identify you or your business.

• You can always see your own data.
• A lender can only see a business owner's credit profile after the business owner shares it directly, or after the business owner approves that lender's access request. A lender never sees anything before that approval.
• Once approved, a lender can view the five credit signals and download the two most recently uploaded bank statements, plus a summary PDF — nothing older, and nothing beyond what's needed to assess the profile.
• CreditPrint staff can access platform data to operate the service, verify lender documents, and provide support.

We use a small number of trusted service providers to run CreditPrint. We don't sell or share your data beyond what's needed for them to provide these services:

• OpenAI — processes the text of your uploaded bank statement to extract your credit signals. Your statement text is sent to OpenAI's API for this analysis only.
• Supabase — hosts our database, authentication, and file storage.

• Bank statements and lender verification documents (CAC, ID, license) are stored in private storage — they are never publicly accessible by a bare URL.
• When a lender downloads a statement, we generate a short-lived, single-purpose link after checking that lender genuinely has approved access — the link expires shortly after.
• Only a Naira-denominated bank statement is accepted; we also automatically reject documents that don't appear to be genuine bank statements.
• Passwords are handled entirely by our authentication provider and are never stored or visible to CreditPrint staff.

You can, at any time:

• Request a copy of the data we hold about you
• Ask us to correct inaccurate information
• Ask us to delete your account and associated data
• Withdraw your consent to processing — though this may mean we can no longer generate or maintain your credit profile

To exercise any of these rights, contact us using the details below.

We retain your data for as long as your account is active, or as needed to provide the service. If you delete your account, we remove your uploaded statements, documents, and generated credit profile, except where we're required to retain limited records for legal or regulatory reasons.

Questions about this policy or how your data is handled? Reach us at privacy@creditprint.app.

We may update this policy as CreditPrint evolves. If we make material changes, we'll let you know through the app or by email before they take effect.