Privacy Policy

Spendhood Ltd. operates a fundraising platform for Nigerian nonprofit organizations.

• Spendhood is the data controller for personal data collected to operate the platform itself: organization and user accounts, platform security, fraud prevention, statutory reporting, and platform communications.
• Each organization using Spendhood is an independent data controller for the donor and campaign data it collects through its campaigns — including donor names, donation amounts, and campaign communications. When you donate, the receiving organization decides the purposes of that campaign's processing.
• Spendhood acts as a data processor for those organizations: we store and process donor data on their behalf, at their direction, under the retention and privacy settings they configure.

Contact: privacy@spendhood.com (data protection contact) · support@spendhood.com (general support).

If you are a donor:

If you are an organization or staff user: name, email, password (stored only as a bcrypt hash), profile photo, two-factor authentication settings, team bio (if you choose to publish one), organization contact details, CAC registration number, and — for payout setup — bank account details (stored encrypted; we display only a masked version).

Providing your data when donating is necessary to complete the donation; withholding it means we cannot process it. Identity-verification data is required only where the law mandates it for the specific transaction.

• We keep a donation history per donor so organizations can steward their donors and so you can see your own giving in the Donor Dashboard.
• We compute engagement and giving-pattern insights for organizations from donors' interactions with campaigns. You can turn off donor-analytics tracking from your privacy dashboard or preferences; transactional financial records are always retained as financial records, independent of this setting.
• Payments pass through automated fraud and AML screening (risk rules on amounts, velocity, device/IP reputation). Flags are reviewed by staff before actions such as holds, refunds or suspicious-transaction reports; no decision with legal or similarly significant effect is made about you by purely automated means.

We do not sell your personal data. We share it only with:

• The organization you donate to — your name, email, amount and any message (unless you donate anonymously).
• Payment processors — Paystack and Flutterwave (licensed Nigerian payment service providers): donor name, email, amount, reference and campaign metadata, to process the payment. They run the checkout page under their own security and privacy policies. For recurring donations, the processor may send you invoice notifications directly.
• Revlos Limited — our payment collection partner. Card donations (including international card donations) are collected through the Flutterwave merchant account of Revlos Limited under a written collection services agreement with Spendhood Ltd. For that purpose Revlos Limited receives the donor name, email, amount and transaction reference necessary to collect, reconcile and settle the payment, and processes them on our instructions only, with the same protections this policy requires of us. It uses them for no other purpose.
• Messaging providers — to deliver the communications you have opted into: Resend (email), Maytapi and WhatsApp by Meta (WhatsApp), SendChamp and Termii (SMS), Instagram/Facebook (Meta). They receive the recipient contact detail (email/phone) and the message content needed to deliver it.
• SCUML (Special Control Unit against Money Laundering) — transaction details for reportable transactions, as required by Nigerian anti-money-laundering law.
• NDPC and other authorities — where disclosure is required by law, or to protect rights and safety.
• Our hosting and infrastructure providers — the cloud infrastructure that runs the platform, object storage and caching (see section 6).

No advertising networks, data brokers or social media trackers receive your data (see section 8).

The Spendhood application, its database and its file storage are operated for Spendhood Ltd. Some of the service providers listed in section 5 operate infrastructure or support functions outside Nigeria — in particular our email delivery provider and Meta's platforms — so personal data (typically your email address or phone number and message content) may be accessed from, stored in, or processed in those countries for the purposes described in this policy.

Where your personal data is transferred outside Nigeria, we do so only where we are satisfied that appropriate protections are in place — including selecting providers that offer commitments consistent with the NDPA's transfer conditions — or, for organizations that enable cross-border features, with donors' explicit consent. We keep these arrangements under review. You may contact privacy@spendhood.com for information about the destinations and safeguards applicable to your data.

Deletion requests are honored except where we must retain data by law (e.g., AML/CFT record-keeping) — in those cases we tell you what we must keep and why.

• Essential only, by default. The platform sets an essential authentication cookie when you sign in (session). No third-party advertising, analytics or tracking cookies are used on Spendhood — we do not run Google Analytics, Meta Pixel or any similar third-party tracker.
• Cookie consent banner. On your first visit you can accept or reject optional cookie categories (analytics, functional). Your choice is stored on your device and recorded (with your IP address and browser type, as proof of the choice). You can change it anytime via the banner or your browser settings.
• Local storage. Donor dashboard sessions and preferences are stored in your browser's local storage for convenience (session expires after 24 hours). The donation widget temporarily holds your email during checkout and clears it when the checkout completes or fails.
• Offline support. Our web app can cache pages for offline use; cached data lives only on your device and is refreshed when you reconnect.

Under the NDPA you have the right to: access your data; correct it; delete it (subject to legal retention duties); receive it in a portable, machine-readable format (JSON/CSV); object to processing, including direct marketing; and withdraw consent at any time (without affecting prior lawful processing). You may also lodge a complaint with the NDPC (section 11) and seek judicial remedies.

Deletion is actioned once any in-flight donation, recurring mandate or open dispute is settled; we will tell you if anything must be retained by law.

Encryption at rest (AES-256-GCM) of account credentials, payment-provider secrets, and organization payout bank account details (see Section 2 — we never store donors' card or bank details), password hashing (bcrypt), two-factor authentication (TOTP) for accounts, per-organization database isolation (row-level security), signed payment webhooks, rate limiting, private file storage with time-limited access links, and immutable audit logging of privacy-relevant actions. In the event of a personal data breach, we follow the NDPA regime: notification to the NDPC within 72 hours of becoming aware of a notifiable breach, and communication to affected data subjects without undue delay where the breach is likely to result in high risk to you.

We would welcome the chance to resolve any concern first — contact privacy@spendhood.com. You also have the right to complain to the Nigeria Data Protection Commission.

Spendhood is intended for adults. Donations and accounts require an adult's legal capacity; where the law requires parental consent for a data subject under 18, we rely on that consent and take reasonable steps to verify it. If you believe a child's data was collected without appropriate consent, contact privacy@spendhood.com and we will delete it.

Material changes update the Effective Date/Version above; we notify registered users by email or in-platform notice and, where required, seek your consent before the change takes effect.

Spendhood Ltd. · Data protection contact: privacy@spendhood.com · Support: support@spendhood.com