Fitly Privacy Policy

Fitly ("we", "us", or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, share, and protect personal data when you visit our website, create a Fitly account, use the Fitly mobile application, connect third-party financial accounts, interact with our AI-powered features, or otherwise engage with our services.

This Privacy Policy is intended to comply with the Nigeria Data Protection Act, 2023 ("NDPA"), and other applicable privacy and consumer protection laws.

1. Who We Are

Fitly is a Nigerian financial wellness and money-management platform designed to help users organise their finances, including budgeting, expense tracking, debt repayment planning, emergency savings tracking, tax reserve planning, land-and-build planning, and Ajo/Esusu contribution tracking.

Fitly is not a bank and does not accept deposits, hold customer funds, or initiate debits or transfers from your bank account. Where account connection features are available, Fitly uses authorised third-party providers to access account and transaction information on a read-only basis, subject to your consent.

Fitly does not host the bank-connection screen itself. Where we offer account connection through Mono, the user is redirected into Mono's connection environment. Bank login details, PINs, passwords, OTPs, BVN entries, NIN entries, and similar credentials or sensitive identifiers entered in that connection flow are entered into the provider's environment, not Fitly's interface.

Service Operator / Data Controller
Fitly Technologies Limited (RC 9592303)
A private company limited by shares incorporated in Nigeria under the Companies and Allied Matters Act, 2020 on 4 June 2026.
Registered or Operating Address: 0, Ehigiegba Street, Ekosodin, Benin City, Edo State, Nigeria.
Support Email: hello@fitly.com.ng
Privacy Email / DPO Contact: dpo@fitly.com.ng

If Fitly is required under applicable law to appoint or designate a Data Protection Officer or privacy contact person, the details above will serve as the relevant contact channel unless otherwise stated.

2. Scope of This Policy

This Privacy Policy applies to personal data processed through:

• the Fitly website;
• the Fitly mobile application;
• onboarding, registration, and account management processes;
• optional bank account linking and transaction import features;
• customer support channels;
• notifications, communications, and marketing where permitted; and
• AI-assisted educational and coaching features made available within the service.

3. The Personal Data We Collect

The personal data we collect depends on how you use Fitly and which features you choose to enable.

A. Information You Provide Directly

We may collect:

• your name;
• email address;
• login credentials or authentication-related information;
• profile details you choose to add;
• financial planning information you manually enter, such as budgets, debts, savings goals, tax reserve targets, land-and-build records, Ajo/Esusu records, notes, and categories;
• communications you send to us, including support requests, complaints, feedback, and survey responses; and
• any other information you choose to submit while using Fitly.

B. Financial Account and Transaction Information

If you choose to connect a financial account through a third-party integration partner such as Mono, we may receive read-only financial data relating to the connected account, which may include:

• bank name;
• masked account details;
• account metadata;
• transaction history;
• transaction descriptions;
• balances or balance-related information where made available by the provider; and
• account connection status and sync timestamps.

Fitly uses this information only to help users categorise spending, monitor financial habits, generate summaries, and support budgeting and planning features inside the Fitly service.

Fitly does not use your connected account access to move money, debit your account, or instruct your bank to carry out payments or transfers. Fitly cannot use the connection to make transfers from your bank account.

C. Identity and Verification-Related Data

Where identity-related information is involved in an account-linking workflow, such information may be handled primarily by the integration provider. Fitly may receive limited identifiers, masked information, or connection tokens needed to support the connection and maintain account integrity.

Fitly does not collect or store raw bank passwords, banking PINs, card PINs, OTPs, or similar banking credentials used within the provider's connection flow. Fitly also does not intend to store raw BVN or raw NIN details unless a specific product feature, legal requirement, or express in-product notice says otherwise.

D. Device, Technical, and Usage Data

We may automatically collect:

• device type, device model, operating system, and app version;
• IP address or approximate location derived from IP where necessary;
• browser type and language settings;
• app usage data, feature interaction data, session events, and clickstream information;
• crash logs, diagnostics, performance data, and error reports; and
• push notification tokens where notifications are enabled.

E. Cookies and Similar Technologies

On our website, we may use cookies, SDKs, local storage, pixels, and similar technologies to support authentication, preferences, analytics, security, and service performance.

4. How We Use Personal Data

We may use personal data to:

• create and manage your Fitly account;
• authenticate users and protect accounts against unauthorised access;
• provide budgeting, debt tracking, savings planning, tax reserve, land-and-build, and Ajo/Esusu tracking features;
• import, display, organise, categorise, and analyse transaction data from linked accounts where you have enabled account connection;
• deliver AI-assisted educational insights, coaching, prompts, and user support;
• personalise the service and improve relevance of in-app guidance;
• send service-related communications, alerts, security notices, reminders, and account updates;
• process subscription, billing, and payment-related events where premium services are offered;
• provide customer service and respond to requests, disputes, or complaints;
• monitor, troubleshoot, secure, and improve the website, mobile app, and underlying systems;
• detect abuse, fraud, misuse, or suspicious activity;
• comply with legal, regulatory, reporting, audit, and law-enforcement obligations; and
• enforce our Terms of Use and other applicable policies.

5. Our Lawful Bases for Processing

Depending on the context, we may process your personal data on one or more of the following lawful bases recognised under applicable law:

• Consent: where you voluntarily grant permission, including for optional account linking, certain notifications, analytics preferences where required, and similar choices.
• Contract: where processing is necessary to provide the Fitly services you requested or to take steps before entering into that relationship.
• Legal obligation: where we must process data to comply with applicable law, lawful requests, regulatory obligations, or dispute-handling requirements.
• Legitimate interests: where processing is reasonably necessary for service security, fraud prevention, support, product improvement, diagnostics, internal administration, or responsible business operations, provided your rights and freedoms are not overridden.

Where we rely on consent, you may withdraw that consent at any time, subject to legal or operational limits. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

6. Bank Connectivity and Read-Only Access

Where Fitly offers bank account connectivity:

• account linking is optional;
• the connection is intended to be read-only;
• the connection flow is provided by the third-party partner, not by Fitly directly;
• Fitly uses the connection to retrieve financial information for budgeting and planning purposes;
• Fitly does not request your bank to debit, transfer, or hold funds on your behalf; and
• you may disconnect a linked account, although previously imported records may be retained where necessary for continuity, compliance, dispute resolution, or legitimate record-keeping.

Before you connect an account, Fitly should present a clear notice explaining that:

• Mono or another named partner is handling the connection flow;
• the connection is read-only;
• Fitly does not see the banking credentials entered in that third-party flow; and
• the resulting data is used for budgeting, planning, and account insight purposes within Fitly.

7. AI Features and Automated Processing

Fitly may offer AI-powered educational or coaching features to help users better understand spending patterns, financial planning, and platform content.

When you use these features:

• we may process your prompts, usage events, and relevant account context necessary to generate a response;
• responses are intended for informational and educational support within the Fitly experience;
• AI outputs may be generated using third-party technology providers engaged by Fitly;
• Fitly should not rely on AI alone to make legally significant decisions about you; and
• users should not treat AI-generated content as legal, tax, investment, medical, or regulated financial advice.

If Fitly introduces any form of solely automated decision-making that has legal or similarly significant effects, Fitly will provide any notices required by applicable law.

8. How We Share Personal Data

We do not sell your personal data.

We may share personal data only as reasonably necessary with the following categories of recipients:

• Service providers and processors that help us operate the platform, such as hosting providers, authentication providers, analytics providers, customer support tools, communication tools, cloud infrastructure providers, payment processors, and database providers;
• Financial data integration partners used to facilitate read-only account connection and transaction retrieval, such as Mono, where you choose to use that feature;
• AI and technology providers engaged to support in-app coaching, automation, or product functionality;
• Professional advisers such as lawyers, auditors, insurers, consultants, and compliance providers where necessary;
• Regulators, law enforcement, courts, and competent authorities where disclosure is required by law, lawful request, or to protect rights, safety, and security; and
• Corporate transaction participants in connection with a merger, acquisition, restructuring, financing, or sale of assets, subject to appropriate confidentiality and lawful safeguards.

Any third party processing personal data on our behalf is expected to do so under appropriate confidentiality, security, and data protection obligations.

9. International and Cross-Border Transfers

Fitly may use service providers or infrastructure located in Nigeria and in other jurisdictions. As a result, personal data may be processed outside Nigeria.

Where we transfer personal data across borders, we will take reasonable steps to ensure that such transfer occurs in accordance with applicable law and that appropriate safeguards are in place, including contractual protections, adequacy considerations, technical controls, or other recognised transfer mechanisms where required.

10. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to:

• provide the Fitly services;
• maintain user records and account history;
• comply with legal, accounting, audit, and regulatory obligations;
• resolve disputes;
• enforce agreements; and
• preserve legitimate business records and security evidence.

Retention periods may differ depending on the type of data, the feature used, user requests, legal requirements, and operational necessity. When personal data is no longer required, we will delete, anonymise, or securely archive it in accordance with applicable law and our retention practices.

11. Security Measures

We implement reasonable technical, organisational, and administrative safeguards designed to protect personal data against unauthorised access, misuse, disclosure, alteration, or destruction.

These measures may include:

• access controls and role-based permissions;
• authentication and session controls;
• encryption or similar protective measures in transit and at rest where appropriate;
• logging and monitoring of critical systems;
• secure development and infrastructure practices;
• incident management processes; and
• vendor due diligence for key service providers.

No method of transmission or storage is completely secure. While we take reasonable steps to protect personal data, we cannot guarantee absolute security.

12. Your Privacy Rights

Subject to applicable law and any lawful limitations, you may have the right to:

• be informed about how your personal data is processed;
• request access to personal data we hold about you;
• request correction of inaccurate, incomplete, or outdated personal data;
• request deletion or erasure of personal data in appropriate circumstances;
• request restriction of processing in appropriate circumstances;
• object to certain forms of processing, including direct marketing where applicable;
• request portability of personal data where applicable;
• withdraw consent where processing is based on consent; and
• lodge a complaint with the Nigeria Data Protection Commission or another competent supervisory authority.

We may need to verify your identity before acting on a request. We may also keep certain data where we have a lawful basis or obligation to do so.

To exercise your rights, please contact us using the details in the "Contact Us" section below.

13. Marketing Communications

Where permitted by law, we may send updates, newsletters, product announcements, and promotional messages. You may opt out of marketing communications at any time by using the unsubscribe option provided or by contacting us.

We will continue to send service, security, billing, and account-related communications where necessary even if you opt out of marketing.

14. Cookies, Analytics, and Similar Technologies

We may use cookies and similar technologies for:

• essential website functionality;
• keeping users signed in;
• remembering preferences;
• performance measurement;
• analytics and service improvement;
• fraud prevention and security; and
• diagnosing errors and improving reliability.

Where required, we will request consent before deploying non-essential cookies or similar technologies. You may also control certain cookie preferences through your browser settings or in-product controls where available.

15. Third-Party Links and Services

Our website or app may contain links to third-party websites, tools, or services. This Privacy Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party service you use.

16. Children's Privacy

Fitly is not intended for children under the age of 18 unless we expressly state otherwise and have implemented lawful safeguards required for such processing.

If we learn that we have collected personal data from a child in a manner inconsistent with applicable law, we will take appropriate steps to delete or otherwise handle that data lawfully.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, business practices, or technology stack.

When we make material changes, we may notify users through the website, mobile app, email, or other appropriate channels. The "Last Updated" date at the top of this page shows when this Privacy Policy was last revised.

18. Contact Us

If you have any questions, requests, or complaints about this Privacy Policy or how your personal data is handled, please contact us:

Fitly Technologies Limited (RC 9592303)
Address: 0, Ehigiegba Street, Ekosodin, Benin City, Edo State, Nigeria.
Email: dpo@fitly.com.ng
Support: hello@fitly.com.ng

If you believe your complaint has not been adequately resolved, you may contact the Nigeria Data Protection Commission (NDPC) through its official channels at https://ndpc.gov.ng.