Privacy Policy

1. Who we are and how to reach us

VaultCova is operated by VaultCova Technologies Ltd. ("VaultCova", "we", "us"), a company registered in Nigeria (RC 9717836), registered office 11 Samuel Ajayi Str., Eyita Estate, IKR-NG. VaultCova lets you log and track the things you own, understand what they are worth, insure them through licensed underwriters, and manage claims. In arranging insurance, we act as an intermediary; the underwriter carries the risk.

For the purpose of the Nigeria Data Protection Act 2023 (NDPA), VaultCova Technologies Ltd. is the data controller of your personal data. Our Data Protection Officer can be reached at support@vaultcova.com, or by writing to the registered office above.

This Privacy Policy explains what personal data we collect, why, how we use and share it, and the rights you have. We process personal data in line with the NDPA and its subsidiary regulation, and, where insurance is involved, in a manner consistent with the National Insurance Commission (NAICOM) framework.

2. The data we collect

• Identity and contact details: your name, email address, phone number and residential or business address.
• Verification (KYC) details: for individuals, your National Identification Number (NIN); for businesses, your RC number and business name. These are required before cover can be bought, in line with "know your customer" and anti-money laundering obligations. Your NIN is handled in accordance with the NIMC Act and is verified only through approved channels. We also keep a copy of the identity document you upload and a photo of you taken with your device's camera during a short head-movement check; both are kept privately and seen only by Cova's checks and, where needed, our verification team.
• Biometric sign-in: if you enable fingerprint or face sign-in (a passkey), the biometric itself never leaves your device and we never receive or store it; we hold only the public key your device creates for logging you in.
• Asset information: what you log in your VaultLog, its value, location, photos, receipts, valuations and any documents you upload. When you upload a photo we store a fresh copy of the picture with the hidden data your phone adds removed (such as GPS location and camera details). We keep only the time the camera says the photo was taken, for our team to use when checking claims; it is not shown to anyone else.
• Insurance and claims information: cover you request or hold, risk-assessment answers, and details of any claim, including supporting evidence.
• Payment information: we do NOT store your card details (they are handled by our payment partner). To pay money out to you (a refund or a wallet withdrawal) we hold your bank account details only for as long as needed to make and confirm the payment, then remove the account number.
• Team members (business accounts): if you add team members, we hold their name, role, email and phone on your behalf.
• Usage and device information: how you use the app, your notification/device tokens if you turn on push, and technical/log data used to keep the service secure and working. To protect accounts we keep sign-in and security signals in scrambled form only (a device identifier and the network you sign in from), and delete them after 180 days.
• Rewards and invitations: your VaultRewards cashback and VaultCoins activity. If you invite someone, or join with someone's invitation, we keep the link between the two accounts and check it for misuse.

3. How we use your data

• To provide the service: build your VaultLog, produce schedules and certificates, arrange and manage cover, and process claims.
• To meet legal and regulatory duties: identity verification, anti money laundering and anti-fraud checks, record-keeping and regulatory reporting.
• To take payments and pay money owed to you (refunds, wallet balances, cashback), and to run our rewards programmes (VaultRewards cashback, VaultCoins and invitations).
• To communicate with you about your account, cover, renewals and claims (service messages), and, where you have not opted out, occasional product updates.
• To improve and secure the service, and to provide Cova, our in-app assistant.

4. Lawful bases

We rely on: performance of our contract with you; compliance with a legal obligation; our legitimate interests (to run, secure and improve the service and prevent fraud), balanced against your rights; and, where required, your consent (which you may withdraw at any time). Marketing messages are sent only on consent, and you can opt out at any time.

5. Automated decisions and AI

Some steps are automated. Cova, our assistant, and some risk-pricing and claims steps use automated processing, and simple, clean claims may be settled automatically. Cova also reads the photos and documents you upload (including identity documents and claim evidence) to check that they match what you have told us. Cova is provided using a third-party AI service, so the content of your questions and the relevant account context needed to answer are processed by that provider on our instructions.

Where an automated decision has a significant effect on you (for example the price of cover or the outcome of a claim), you have the right to ask for a human to review it and to contest the result. Contact us in the app and a person will look at it.

6. Who we share it with

• Underwriters and their agents, to obtain quotes, bind cover and settle claims.
• Service providers who act on our instructions: payment processing, email delivery, cloud hosting and the AI provider that powers Cova. They may process data only for the purposes we set.
• Regulators, law-enforcement and other authorities where the law requires or permits it.
• A successor entity in the event of a reorganisation, merger or sale, subject to this Policy.
• The person who invited you, or the people you invite: we show them your first name and whether you have joined and started using VaultCova, and nothing else.

We do not sell your personal data.

7. Sending data outside Nigeria

Some of our providers (for example cloud hosting and the AI service that powers Cova) process data outside Nigeria. When we transfer personal data abroad we do so only where the NDPA allows it: to a country or provider offering adequate protection, under appropriate safeguards (such as contractual data-protection terms), or on another lawful basis such as your consent or the necessity of the transfer to provide the service you asked for.

8. How long we keep it

We keep personal data for as long as you have an account and thereafter only as long as needed for legal, regulatory, tax and dispute-resolution purposes. Anti money laundering and insurance records are kept for the periods the law requires (for anti money laundering records, this is at least five years after the relationship ends). When data is no longer needed it is deleted or anonymised.

9. Your rights

Subject to the NDPA, you may ask to access, correct, delete or port your data, object to or restrict certain processing, withdraw consent, and ask for human review of an automated decision. You can exercise most of these in the app (Settings) or by contacting our DPO. We respond within the time the NDPA allows. You also have the right to lodge a complaint with the Nigeria Data Protection Commission.

10. Security

We protect your data with technical and organisational measures, including encryption in transit and at rest, access controls and audit logging. No system is perfectly secure, but if a breach occurs that is likely to put you at risk we will notify the NDPC (within 72 hours of becoming aware, as the NDPA requires) and tell you where the risk to you is high.

11. Cookies and local storage

We use a small number of cookies and similar storage:

• Essential: to keep you signed in and your account secure, including a sign-in security cookie that helps us spot unusual sign-ins (we keep only a scrambled form of it).
• Invitations: if you open a friend's VaultCova invitation link, a cookie remembers the invitation for up to 30 days so it can be credited when you sign up.
• Preferences and offline use: your device's local storage keeps settings such as your language and theme, messages you have not sent yet, and a copy of your vault so the app works offline.
• Analytics: privacy-friendly analytics that count visits without cookies and without identifying you. They run only if you allow them in the privacy notice, on every device: computer, phone and our apps. You can change your choice at any time in Settings, under Security.

We do not use advertising or cross-site tracking cookies. When you pay, the payment is handled in our partner's secure form, which may set its own cookies for that purpose.

12. Other people's data and children

If you upload a document or file a claim that contains someone else's personal data, you confirm you may share it with us for that purpose. The service is for people aged 18 and over; we do not knowingly collect data from children, and will delete it if we learn we have.

13. Changes to this Policy

We may update this Policy from time to time. We will post the updated version here with a new effective date and, for material changes, tell you in the app.

14. Contact us

Data questions or requests can be raised in the app or sent to our DPO at support@vaultcova.com. You can also message us from the chat or notifications area in the app.