Dalufy · Legal
Privacy Policy
Version 1 · Updated 2026-09-30
This Policy explains how Dalufy processes personal data for Nigeria Data Protection Act (NDPA) purposes. Profile financial records are tenant-scoped and not shared across unrelated profiles.
1. Controllers and contact
The Dalufy operator acts as controller for account identity data. Where you use a Business profile, the Business Entity is the controller of that profile’s financial records; Dalufy processes them as a processor under your instructions.
DPO contact is configured via DPO_CONTACT / NEXT_PUBLIC_DPO_CONTACT in deployment.
2. What we process
- Account identifiers (email and/or phone), authentication and session data
- Profile membership, roles, and audit events
- Ledger transactions, imports, attachments, and tax calculation artefacts you create
- Support and security events needed to operate the service
3. Purposes
Provide the ledger and related CFO/tax tools, secure accounts, meet legal obligations, and improve reliability. We do not sell your ledger data.
4. Processors
Hosting, object storage, and message delivery (email/SMS when configured) may process data under contract. A current processor list is maintained by operations for your deployment.
5. Retention and rights
You may export or request deletion via product controls, subject to legal holds and retention. Access, correction, and complaint rights under NDPA apply.