Privacy Policy

Who we are

Ntalah is a platform for community savings groups — rotating circles (known as a stokvel, chama, susu, esusu, tontine or njangi depending on where you are), accumulating funds, goal pools, investment clubs and donation drives.

The data controller is [legal entity name and registered address — to confirm]. For any privacy question, contact [privacy contact address — to confirm].

The most important thing to know

Ntalah never holds, transfers or processes your group's money. Members pay each other directly — by mobile money, bank transfer, ATM deposit or cash — and then record that payment here. We store a record of what you tell us, not your funds. We are not a bank, a wallet or a payment processor, and we never have access to your bank or mobile-money account.

What we collect

• Account details — your email address, the display name you choose, and optionally a profile photo and phone number.
• Group activity — the groups you belong to, contributions you record, payouts and disbursements, loans and repayments, votes you cast, and the dates of all of these.
• Proof of payment — any document or photo you upload to evidence a payment.
• Country and language preference — used to choose sensible defaults for dates and currency.
• Payment records for your subscription — if you buy seats, AI credits or extra groups, our payment provider handles the card details; we store only the amount, currency, status and a reference. We never see or store your card number.

Who can see what

Access is enforced in the database itself, not just in the app, so a member cannot read data from a group they do not belong to.

• Other members of your group see your display name, profile photo, your contributions and payouts within that group, and your on-time record.
• Your phone number is private by default. It is shared with co-members only if you explicitly turn that on in Settings.
• Proof of payment defaults to being visible only to your group's admin and finance members. A group can widen this, and you can opt an individual document in or out. Every time a proof is opened we log who opened it.
• Our staff can see account-level and billing information needed to operate and support the service. Privileged staff actions are recorded in an audit log.

AI features

Group health insights and the in-app assistant send a summary of the relevant group's data to a third-party AI provider ([provider name — to confirm]) to generate a response. Only data from a group you belong to is included. These features are optional and metered — if you do not use them, nothing is sent.

Your rights

Depending on where you live, your rights are set out in POPIA (South Africa), the NDPA (Nigeria), the Data Protection Act 2019 (Kenya), Ghana's Data Protection Act, or an equivalent law. In every case you may:

• ask for a copy of the personal information we hold about you;
• ask us to correct anything inaccurate;
• ask us to delete your account;
• object to how we use your information, or withdraw a consent you gave.

One limit worth being upfront about: a savings group is a shared financial record. If you delete your account, contributions and payouts already recorded remain visible to that group, because removing them would falsify the group's books for everyone else. We remove your profile details and disconnect the record from your identity where we can.

How long we keep things

Group financial records are kept for as long as the group exists, and afterwards for [retention period — to confirm] so members can refer back to them. Proof-of-payment files are kept for the same period. Account details are deleted when you close your account, subject to the limit above.

Where your data is held

Our database and file storage are hosted by Supabase, and the application by Vercel. This means your information may be processed outside your own country. [Hosting region and cross-border transfer basis — to confirm]

Changes

If we change this policy in a way that materially affects you, we will tell you in the app before it takes effect.