Privacy Policy

1. Scope

This Policy explains how HopperTax collects, uses, stores, and shares personal data when you use hoppertax.com and the HopperTax application. It is written to comply with the Nigeria Data Protection Act, 2023 (NDPA) and, where applicable to diaspora users, the GDPR and similar laws.

The data controller is HopperTax Nigeria Limited, RC 9774390, No. 34B Itesi Ajabe Street, Somorin, Obantoko, Abeokuta, Ogun State, Nigeria. Contact for any privacy matter: hello@hoppertax.com.

2. What we collect

Account data: name, email, phone, password (stored as a cryptographic hash, we never see it).

Tax profile data you choose to provide: TIN, NIN, BVN, passport number, address, marital status, dependents, occupation, employer, income, deductions, and residency information.

Documents you upload: payroll, bank statements, receipts, invoices, certificates, plus the data we extract from them.

Technical data: device and browser information, IP address, and usage events needed to secure and operate the Service.

Login location: for every sign-in, we record a coarse location derived from your IP address (never shown to you or to any other customer). For tax agents specifically, we also compare this against the work location declared on their application, and may ask an agent's browser for a precise location, with their consent, for the same fraud-prevention purpose.

3. Why we process it (lawful bases)

To provide the Service you asked for, preparing computations, storing documents, tracking refunds (performance of contract).

To secure accounts, prevent fraud (including checking that a tax agent is filing from their declared work location), and meet record-keeping duties (legal obligation and legitimate interest).

To send service messages such as deadline reminders and receipts (performance of contract); marketing messages only with your consent, which you can withdraw anytime.

Analytics and marketing cookies, and the Google tags that go with them, are used only on the basis of your consent. Nothing of that kind runs until you say yes in the cookie banner, and you can withdraw consent at any time through Cookie settings (in the site footer and in Settings), as easily as you gave it. Withdrawing does not affect anything done before.

We do not sell your personal data. Ever.

4. Automated processing

Uploaded documents and assistant questions are processed automatically, using automated language and document-processing services (including services provided by Anthropic), to extract figures and generate answers. Content sent to those processors is used to provide the feature, and under our agreements it is not used to train their models. Every extraction is shown to you for confirmation before it affects your filing.

5. Where your data lives and how it's protected

Data is stored with our infrastructure providers (Supabase/AWS, EU-West region) with encryption in transit (TLS) and at rest. Access is protected by row-level security, each account can only read its own records, plus optional two-factor authentication. Documents live in a private, encrypted storage vault.

Some of our processors, and Google if you accept analytics or marketing cookies, may handle data outside Nigeria and outside the UK and European Economic Area, including in the United States. Where that happens we rely on the safeguards the NDPA and the GDPR allow: an adequacy decision where one exists, otherwise the standard contractual clauses (with the UK addendum for UK users) in our processors' agreements, together with encryption and access controls. Ask hello@hoppertax.com for a copy of the safeguards that apply to you.

6. Sharing

We share data only with: (a) processors that run the Service (hosting, email delivery, automated document processing, payments); (b) a professional you explicitly link to your account (e.g. your accountant); (c) tax authorities, when you direct us to file or pay; and (d) authorities where the law compels us. Payment card details go directly to licensed processors (e.g. Paystack), we never receive them.

7. Retention

Tax records have statutory relevance for years, so we retain filings and supporting documents while your account is active. If you delete your account, your profile, documents, and drafts are permanently erased after a 30-day grace period; minimal payment records may be retained where financial regulations require.

8. Your rights

Under the NDPA, and the GDPR and UK GDPR where they apply to you, you may access, correct, restrict, object to processing of, or delete your personal data, and withdraw consent. You also have the right to data portability: to receive the data you gave us in a structured, commonly used, machine-readable format, and to have it passed to another provider where that is technically feasible. Most of these are self-service in Settings; for the rest, email hello@hoppertax.com, we respond within 30 days.

You may complain to the Nigeria Data Protection Commission (NDPC). If you are in the European Union or the United Kingdom you also have the right to lodge a complaint with the supervisory authority in the country where you live, work or believe an infringement took place (in the UK, the Information Commissioner's Office), and we would welcome the chance to put things right first.

9. Cookies

When you first visit, a banner asks about cookies. Reject all is as easy as Accept all, and Choose lets you switch each category on or off. Nothing is switched on in advance.

There are three categories. Strictly necessary items keep you signed in, protect your account and remember your cookie choice and the answers you are typing; they are always on because the site cannot work without them. Analytics items count visits so we can improve the site. Marketing items measure whether our adverts led to a visit or sign-up. Analytics and marketing items, and the third-party Google scripts behind them, are neither stored nor loaded unless you consent, and we use Google Consent Mode so Google receives your choice before anything runs.

We keep a record of your choice (a random id, the policy version, your choices, the time, your browser type and your account if you are signed in, but never your IP address) as proof of consent. Your choice is remembered for 180 days, or until we change what we use, and you can change it at any time through Cookie settings in the footer and in Settings.

Every cookie and stored item the site uses is listed on the Cookie Policy page.

Cookie Policy: every cookie we use

10. Changes

We will notify you in-app or by email of material changes to this Policy before they take effect. Effective date: 14 October 2026.