Privacy
Policy.

Fitly Technologies Limited is a Nigerian software company. We build software products, and this policy covers this website together with every product we build or operate.

Our first product is Fitly, a financial wellness and money-management application that helps users organise their finances, including budgeting, expense tracking, debt repayment planning, emergency savings tracking, tax reserve planning, land-and-build planning, and Ajo/Esusu contribution tracking. We have also built PositionTools, an automatic trading tool that has not yet been released, and we have Traders Companion in development and a LinkedIn tool in early stages.

Data controller. Fitly Technologies Limited (RC 9592303), a private company limited by shares incorporated in Nigeria under the Companies and Allied Matters Act, 2020 on 4 June 2026.

• Registered or operating address: 0, Ehigiegba Street, Ekosodin, Benin City, Edo State, Nigeria.
• Support email: hello@fitly.com.ng
• Privacy email and DPO contact: dpo@fitly.com.ng

If Fitly is required under applicable law to appoint or designate a Data Protection Officer or privacy contact person, the details above serve as the relevant contact channel unless otherwise stated.

This Privacy Policy is intended to comply with the Nigeria Data Protection Act, 2023 ("NDPA"), and other applicable privacy and consumer protection laws.

This Privacy Policy applies to personal data processed through:

• this company website, fitly.com.ng, including its contact and waitlist forms;
• the Fitly mobile application and any Fitly web application;
• PositionTools, Traders Companion, the LinkedIn tool, and any other product we build, release or operate;
• onboarding, registration, and account management processes;
• optional bank account linking and transaction import features;
• customer support channels; and
• notifications, communications, and marketing where permitted.

Where a product shows its own privacy notice, that notice adds to this one and does not replace it. Where a product is still in development, this policy describes only what it does today, and we update this policy before that product begins handling anything new.

This policy has three layers. The first applies to everyone who touches Fitly, whether through this website or a product. The second applies only to people who use the Fitly budgeting application. The third explains where our trading and productivity products stand while they are being built. Sections that apply to one product say so in their first line, so you never have to guess whether a paragraph is about you.

A. Information you give us directly. This applies to this website and to every product. We may collect: your name; email address; login credentials or authentication-related information; the name, email address and message you send through our website contact form; the email address you give when you join a product waitlist, together with the product and the page you joined from; profile details you choose to add; communications you send to us, including support requests, complaints, feedback, and survey responses; and any other information you choose to submit while using a Fitly product.

B. Financial planning information you enter. This applies to the Fitly budgeting application. We may collect the financial planning information you manually enter, such as budgets, incomes, debts, savings goals, tax reserve targets, land-and-build records, Ajo/Esusu records, notes, and categories.

C. Financial account and transaction information. This applies to the Fitly budgeting application, and only if you choose to connect a financial account through a third-party integration partner such as Mono. We may then receive read-only financial data relating to the connected account, which may include: bank name; masked account details; account metadata; transaction history; transaction descriptions; balances or balance-related information where made available by the provider; and account connection status and sync timestamps. Fitly uses this information only to help users categorise spending, monitor financial habits, generate summaries, and support budgeting and planning features inside the application. Fitly does not use your connected account access to move money, debit your account, or instruct your bank to carry out payments or transfers.

D. Identity and verification-related data. Where identity-related information is involved in an account-linking workflow, such information may be handled primarily by the integration provider. Fitly may receive limited identifiers, masked information, or connection tokens needed to support the connection and maintain account integrity. Fitly does not collect or store raw bank passwords, banking PINs, card PINs, OTPs, or similar banking credentials used within the provider's connection flow. Fitly also does not intend to store raw BVN or raw NIN details unless a specific product feature, legal requirement, or express in-product notice says otherwise.

E. Device, technical, and usage data. This applies to this website and to every product. We may automatically collect: device type, device model, operating system, and app version; IP address or approximate location derived from IP where necessary; browser type and language settings; app usage data, feature interaction data, session events, and clickstream information; crash logs, diagnostics, performance data, and error reports; and push notification tokens where notifications are enabled.

F. Cookies and similar technologies. On our website and in our applications, we may use cookies, SDKs, local storage, and similar technologies to support authentication, preferences, analytics, security, and service performance.

G. Our trading and productivity products. PositionTools is built and is not yet released. Traders Companion is in development, and the LinkedIn tool is in early stages. Today, the only personal data we hold about you in relation to them is what section A describes, such as a waitlist email address. If any of those products will handle more, such as trading account details, exchange or broker credentials, market or position data, or LinkedIn profile data, we will tell you before that product launches and update this policy at the same time.

We may use personal data to: create and manage your account with us; authenticate users and protect accounts against unauthorised access; provide the features of whichever product you are using, including budgeting, debt tracking, savings planning, tax reserve, land-and-build, and Ajo/Esusu tracking in the Fitly application; import, display, organise, categorise, and analyse transaction data from linked accounts where you have enabled account connection; deliver AI-assisted educational insights, coaching, prompts, and user support; personalise a product and improve the relevance of in-app guidance; reply to messages sent through the company website and tell people on a waitlist when the product they asked about is ready; send service-related communications, alerts, security notices, reminders, and account updates; process subscription, billing, and payment-related events where premium services are offered; provide customer service and respond to requests, disputes, or complaints; monitor, troubleshoot, secure, and improve our website, applications, and underlying systems; detect abuse, fraud, misuse, or suspicious activity; comply with legal, regulatory, reporting, audit, and law-enforcement obligations; and enforce our Terms of Use and other applicable policies.

Depending on the context, we may process your personal data on one or more of the following lawful bases recognised under applicable law:

• Consent: where you voluntarily grant permission, including for optional account linking, certain notifications, analytics preferences where required, and similar choices.
• Contract: where processing is necessary to provide the Fitly product you requested or to take steps before entering into that relationship.
• Legal obligation: where we must process data to comply with applicable law, lawful requests, regulatory obligations, or dispute-handling requirements.
• Legitimate interests: where processing is reasonably necessary for service security, fraud prevention, support, product improvement, diagnostics, internal administration, or responsible business operations, provided your rights and freedoms are not overridden.

Where we rely on consent, you may withdraw that consent at any time, subject to legal or operational limits. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

This section applies to the Fitly budgeting application. The same rule applies to any future Fitly product that offers bank connectivity.

Where Fitly offers bank account connectivity: account linking is optional; the connection is intended to be read-only; the connection flow is provided by the third-party partner, not by Fitly directly; Fitly uses the connection to retrieve financial information for budgeting and planning purposes; Fitly does not request your bank to debit, transfer, or hold funds on your behalf; and you may disconnect a linked account, although previously imported records may be retained where necessary for continuity, compliance, dispute resolution, or legitimate record-keeping.

Fitly is not a bank and does not accept deposits, hold customer funds, or initiate debits or transfers from your bank account. Before you connect an account, Fitly presents a clear notice explaining that Mono or another named partner is handling the connection flow, that the connection is read-only, that Fitly does not see the banking credentials entered in that third-party flow, and that the resulting data is used for budgeting, planning, and account insight purposes within Fitly.

Fitly products may offer AI-powered educational or coaching features to help users better understand spending patterns, financial planning, and platform content. When you use these features: we may process your prompts, usage events, and relevant account context necessary to generate a response; responses are intended for informational and educational support within the product experience; AI outputs may be generated using third-party technology providers engaged by Fitly; Fitly does not rely on AI alone to make legally significant decisions about you; and users should not treat AI-generated content as legal, tax, investment, medical, or regulated financial advice.

If Fitly introduces any form of solely automated decision-making that has legal or similarly significant effects, Fitly will provide any notices required by applicable law.

We do not sell your personal data.

We may share personal data only as reasonably necessary with the following categories of recipients:

• Service providers and processors that help us operate our products, such as hosting providers, authentication providers, analytics providers, customer support tools, communication tools, cloud infrastructure providers, payment processors, and database providers.
• Financial data integration partners used to facilitate read-only account connection and transaction retrieval, such as Mono, where you choose to use that feature.
• AI and technology providers engaged to support in-app coaching, automation, or product functionality.
• Professional advisers such as lawyers, auditors, insurers, consultants, and compliance providers where necessary.
• Regulators, law enforcement, courts, and competent authorities where disclosure is required by law, lawful request, or to protect rights, safety, and security.
• Corporate transaction participants in connection with a merger, acquisition, restructuring, financing, or sale of assets, subject to appropriate confidentiality and lawful safeguards.

Any third party processing personal data on our behalf is expected to do so under appropriate confidentiality, security, and data protection obligations.

Fitly may use service providers or infrastructure located in Nigeria and in other jurisdictions. As a result, personal data may be processed outside Nigeria. Where we transfer personal data across borders, we take reasonable steps to ensure that such transfer occurs in accordance with applicable law and that appropriate safeguards are in place, including contractual protections, adequacy considerations, technical controls, or other recognised transfer mechanisms where required.

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to: provide our products; maintain user records and account history; comply with legal, accounting, audit, and regulatory obligations; resolve disputes; enforce agreements; and preserve legitimate business records and security evidence.

Retention periods differ depending on the type of data, the feature used, user requests, legal requirements, and operational necessity. When personal data is no longer required, we delete, anonymise, or securely archive it in accordance with applicable law and our retention practices.

A message sent through the company website stays with us for as long as we need it to handle the conversation and keep a fair record of it. A waitlist email stays until that product launches, or until you ask us to remove you, whichever comes first.

We implement reasonable technical, organisational, and administrative safeguards designed to protect personal data against unauthorised access, misuse, disclosure, alteration, or destruction. These measures may include: access controls and role-based permissions; authentication and session controls; encryption or similar protective measures in transit and at rest where appropriate; logging and monitoring of critical systems; secure development and infrastructure practices; incident management processes; and vendor due diligence for key service providers.

No method of transmission or storage is completely secure. While we take reasonable steps to protect personal data, we cannot guarantee absolute security.

Subject to applicable law and any lawful limitations, you may have the right to: be informed about how your personal data is processed; request access to personal data we hold about you; request correction of inaccurate, incomplete, or outdated personal data; request deletion or erasure of personal data in appropriate circumstances; request restriction of processing in appropriate circumstances; object to certain forms of processing, including direct marketing where applicable; request portability of personal data where applicable; withdraw consent where processing is based on consent; and lodge a complaint with the Nigeria Data Protection Commission or another competent supervisory authority.

We may need to verify your identity before acting on a request, and we may keep certain data where we have a lawful basis or obligation to do so. To exercise your rights, contact us using the details in the "Contact us" section below.

Where permitted by law, we may send updates, newsletters, product announcements, and promotional messages. You may opt out of marketing communications at any time by using the unsubscribe option provided or by contacting us. We will continue to send service, security, billing, and account-related communications where necessary even if you opt out of marketing.

We may use cookies and similar technologies for: essential website functionality; keeping users signed in; remembering preferences; performance measurement; analytics and service improvement; fraud prevention and security; and diagnosing errors and improving reliability. Where required, we request consent before deploying non-essential cookies or similar technologies. You may also control certain cookie preferences through your browser settings or in-product controls where available.

The company website itself currently places no advertising or analytics cookies on your device. Our hosting provider keeps standard server logs of the requests it receives, which is how the site is kept running and secured.

Our website or applications may contain links to third-party websites, tools, or services. This Privacy Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party service you use.

Our products are not intended for children under the age of 18 unless we expressly state otherwise and have implemented the lawful safeguards required for such processing. If we learn that we have collected personal data from a child in a manner inconsistent with applicable law, we will take appropriate steps to delete or otherwise handle that data lawfully.

We may update this Privacy Policy from time to time to reflect changes in our products, legal obligations, business practices, or technology stack. When we make material changes, we may notify users through the website, an application, email, or other appropriate channels. The "Last updated" date at the top of this page shows when this Privacy Policy was last revised.

If you have any questions, requests, or complaints about this Privacy Policy or how your personal data is handled, please contact Fitly Technologies Limited (RC 9592303), 0, Ehigiegba Street, Ekosodin, Benin City, Edo State, Nigeria.

• Privacy and data requests: dpo@fitly.com.ng
• Support: hello@fitly.com.ng

If you believe your complaint has not been adequately resolved, you may contact the Nigeria Data Protection Commission (NDPC) through its official channels at ndpc.gov.ng.