Privacy Policy

We collect the following categories of data:

• Identity data: Full name, email address, phone number.
• Financial data: Annual income, income sources (salary, freelance, investment), tax identification number (TIN), state of residence.
• Usage data: Pages visited, features used, device/browser type, IP address, session timestamps.
• Payment data: Subscription tier, payment reference numbers. We do NOT store card numbers , payments are processed by Paystack (PCI-DSS Level 1 compliant).
• Filing data: Tax returns, supporting documents, filing history, NRS submission references.

We use your data solely to:

• Provide the KudiTax tax calculation and filing service.
• Pre-fill and submit tax returns to the relevant state Internal Revenue Service (IRS) and/or the Nigeria Revenue Service (NRS).
• Process subscription payments through Paystack.
• Send transactional emails (filing confirmations, payment receipts, OTP codes). We do not send unsolicited marketing emails.
• Improve the platform through aggregated, anonymised analytics.
• Comply with legal obligations under Nigerian tax law and the NDPA 2023.

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

We share your data only in the following limited circumstances:

• Tax authorities: Your filing data is transmitted to the relevant state IRS and/or NRS as required to complete your tax return. This is the core purpose of the service.
• Service providers: Supabase (database hosting , data encrypted at rest and in transit), Paystack (payment processing), Resend (transactional email), Railway (application hosting), Cloudflare (CDN and DDoS protection). All are bound by data processing agreements.
• Legal compliance: We may disclose data if required by Nigerian law, a court order, or legitimate regulatory authority.

We implement the following security measures:

• All data is encrypted in transit (TLS 1.3) and at rest (AES-256 via Supabase).
• Row-Level Security (RLS) on our database ensures you can only access your own records.
• Authentication uses one-time passwords (OTP) via email , no passwords are stored.
• Access to production systems is restricted to authorised KudiTax engineers with multi-factor authentication.
• We conduct periodic security reviews and aim to comply with NITDA audit requirements.

No system is 100% secure. If you suspect unauthorised access to your account, contact us immediately at privacy@kuditax.ng.

Under the Nigeria Data Protection Act 2023, you have the following rights:

• Right to access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your account and associated data (subject to our legal retention obligations under Nigerian tax law , 6-year minimum).
• Right to data portability: Receive your data in a structured, machine-readable format.
• Right to object: Object to processing based on our legitimate interests.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting prior processing.

To exercise any of these rights, email privacy@kuditax.ng. We will respond within 14 business days.

KudiTax uses the following cookies and local storage:

• Authentication cookies (essential): Supabase session tokens to keep you logged in. These are strictly necessary and cannot be disabled.
• Analytics (optional): Aggregated, anonymised usage analytics. No cross-site tracking. You can opt out via your account settings.

We do not use advertising cookies or share data with ad networks.

We retain your data for as long as your account is active, plus a minimum of 6 years after account closure to comply with Nigerian tax record-keeping requirements (Companies and Allied Matters Act 2020, FIRS guidelines). After the retention period, data is securely deleted or anonymised.

KudiTax is intended for users aged 18 and above. We do not knowingly collect data from minors. If you believe a minor has created an account, contact privacy@kuditax.ng and we will delete the account promptly.

We may update this policy from time to time. We will notify you of material changes via email and/or a prominent notice on the platform at least 14 days before the change takes effect. Continued use of KudiTax after that date constitutes acceptance of the updated policy.

For privacy-related queries, requests, or complaints, contact our Data Protection Officer: