Who we are
RevoPass is operated by Revo Space Enterprise Ltd, a company registered in Nigeria. We are the data controller for information about you as a RevoPass user.
Decide before launch: Add the RC number, registered office address, and the email address privacy questions should go to. Confirm with your lawyer whether the NDPA requires you to appoint a Data Protection Officer at your size, and name them here if so.
What we collect from you
When you create an account we store your name, email address and, if you give one, your phone number. We store your password only as a hash — we cannot read it, and neither can anyone who obtains our database.
For your business we store the name, address, email, phone number, tax identification number and logo you enter, because these appear on the invoices and receipts you issue.
We also record ordinary technical information such as sign-in times and IP addresses, which we use to keep accounts secure and to investigate problems.
Information you enter about other people
RevoPass lets you store records about your own customers: their name, email address, phone or WhatsApp number, address and tax identification number. You may also photograph receipts, which can contain the name of a merchant and what was bought.
For those records your business is the controller and RevoPass is the processor. We hold them on your behalf, we do not use them for our own purposes, and we do not contact your customers except to deliver a document you have chosen to send them. Making sure you are entitled to hold that information is your responsibility.
Camera and photographs
The RevoPass mobile app asks for access to your camera and photo library for one purpose: attaching a picture of a receipt to an expense. Nothing else uses it. Receipt images are stored in a private location that only members of your business can open, and they are never made public.
RevoPass does not currently read your receipts automatically. The merchant, amount and VAT are the figures you type in.
Payments
Card payments — both your RevoPass subscription and any invoice your customer pays online — are processed by Squad, operated by Guaranty Trust Holding Company (GTCO). Card numbers are entered on Squad’s own secure page and never reach RevoPass. Their privacy terms apply to the payment itself.
What we keep is the amount, the currency, our own reference, the provider’s transaction reference, and whether the payment succeeded or failed. That is what lets us show you a payment history and reconcile a disputed transaction.
Where your data is stored
RevoPass runs on Supabase, which hosts our database and file storage. Every business’s records are separated at the database level so one business cannot read another’s.
Decide before launch: State the region your Supabase project is hosted in. If it is outside Nigeria — it usually is — the NDPA requires you to name the lawful basis for that transfer. Your lawyer should word this.
How long we keep it
While your account is open we keep your records so the app can show them to you. Financial records are the point of the product, so we do not delete them on our own initiative.
When you close your account your business and its records are hidden immediately and your login is deleted, so you can no longer sign in. The records themselves are held for a short recovery period before being removed for good, so that an accidental deletion can be undone.
Decide before launch: Set the recovery period — 30 days is common — and state it here as a number. Also confirm with your accountant whether Nigerian tax law obliges you to retain any of it for longer, which would override this.
Your rights
Under the Nigeria Data Protection Act you may ask for a copy of the information we hold about you, ask us to correct it if it is wrong, and ask us to delete it. You can also complain to the Nigeria Data Protection Commission.
You do not have to ask us to delete your account: you can do it yourself in Settings, which closes your business and removes your login.
Cookies and analytics
RevoPass sets a cookie to keep you signed in. That is what it is for, and removing it signs you out.
We do not use third-party advertising or analytics trackers, and we do not sell your information or your customers’ information to anyone.
Decide before launch: This is true of the code today. If you later add analytics, error reporting or a marketing pixel, this section has to change first — leaving it as written would make the policy false.
Changes to this policy
If we change this policy we will update the date at the top of this page.
Decide before launch: Decide whether material changes are also emailed to users, and say so here. Committing to notice you do not actually send is worse than promising none.