Privacy Policy

1. Scope

This Policy explains how HopperTax collects, uses, stores, and shares personal data when you use hoppertax.com and the HopperTax application. It is written to comply with the Nigeria Data Protection Act, 2023 (NDPA) and, where applicable to diaspora users, the GDPR and similar laws.

HopperTax is the data controller. Contact: hello@hoppertax.com.

2. What we collect

Account data: name, email, phone, password (stored as a cryptographic hash, we never see it).

Tax profile data you choose to provide: TIN, NIN, BVN, passport number, address, marital status, dependents, occupation, employer, income, deductions, and residency information.

Documents you upload: payroll, bank statements, receipts, invoices, certificates, plus the data our AI extracts from them.

Technical data: device and browser information, IP address, and usage events needed to secure and operate the Service.

3. Why we process it (lawful bases)

To provide the Service you asked for, preparing computations, storing documents, tracking refunds (performance of contract).

To secure accounts, prevent fraud, and meet record-keeping duties (legal obligation and legitimate interest).

To send service messages such as deadline reminders and receipts (performance of contract); marketing messages only with your consent, which you can withdraw anytime.

We do not sell your personal data. Ever.

4. AI processing

Uploaded documents and assistant questions are processed by AI models (including models provided by Anthropic) to extract figures and generate answers. Content sent to our AI provider is used to provide the feature, under our agreements it is not used to train their models. Every extraction is shown to you for confirmation before it affects your filing.

5. Where your data lives and how it's protected

Data is stored with our infrastructure providers (Supabase/AWS, EU-West region) with encryption in transit (TLS) and at rest. Access is protected by row-level security, each account can only read its own records, plus optional two-factor authentication. Documents live in a private, encrypted storage vault.

Cross-border transfer safeguards required by the NDPA are addressed through our providers' standard contractual protections.

6. Sharing

We share data only with: (a) processors that run the Service (hosting, email delivery, AI processing, payments); (b) a professional you explicitly link to your account (e.g. your accountant); (c) tax authorities, when you direct us to file or pay; and (d) authorities where the law compels us. Payment card details go directly to licensed processors (e.g. Paystack), we never receive them.

7. Retention

Tax records have statutory relevance for years, so we retain filings and supporting documents while your account is active. If you delete your account, your profile, documents, and drafts are permanently erased after a 30-day grace period; minimal payment records may be retained where financial regulations require.

8. Your rights

Under the NDPA you may access, correct, export, restrict, object to processing of, or delete your personal data, and withdraw consent. Most of these are self-service in Settings; for the rest, email hello@hoppertax.com, we respond within 30 days. You may also complain to the Nigeria Data Protection Commission (NDPC).

9. Cookies

We use strictly necessary cookies for login sessions and your theme preference. We do not run third-party advertising cookies. Optional analytics is off by default and controlled in Settings → Privacy.

10. Changes

We will notify you in-app or by email of material changes to this Policy before they take effect. Effective date: 24 July 2026.