01The short version
If you only read one part, read this.
We connect to your accounts read-only. Qoyla can see balances and transactions to give you advice. It cannot move money on its own, ever. You approve every action, and your funds never leave your bank.
- We collect the financial and account data you connect, plus basic information about how you use Qoyla.
- We use it to calculate your Safe-to-Spend, surface risks, and answer your questions, nothing else.
- We do not sell your data, and we do not show you ads based on it.
- You can view, export or delete your data at any time from Your data rights.
02What we collect
We try to collect only what we genuinely need to be useful. That falls into four groups.
| Category | Examples |
|---|---|
| You give us | Your name, email, phone number, and the preferences you set, such as your currency, region and notification choices. |
| You connect | Account balances, transaction history and account metadata from the banks and institutions you link. We receive this read-only through licensed open-banking providers. |
| You create | Your questions to Ask Qoyla, the plans and pockets you set up, and the actions you approve or decline, each kept in your Proof Record. |
| We observe | Device and app information, general location from your IP address, and basic usage analytics that help us keep the service reliable and secure. |
We never ask for, and never store, your online banking password. Connections are made through tokenised, revocable links you control.
03Why we use it
Every use of your data ties back to a clear purpose. We rely on one of these lawful bases for each one.
- To provide the service you asked for. Calculating Safe-to-Spend, building plans, decoding charges and answering questions are the core of our contract with you.
- To keep you and the service safe. Detecting fraud, preventing abuse and securing accounts is a legitimate interest we take seriously.
- To meet our legal duties. Some records must be kept to satisfy financial regulation and anti-money-laundering rules.
- With your consent. Optional things, like marketing emails or connecting a new institution, happen only when you say yes, and you can withdraw consent at any time.
04How the advisor uses your data
Ask Qoyla interprets your situation, but the maths is done by deterministic tools, not guessed by a model. Here is the boundary we hold:
The model reads and explains. Tools compute. You decide. Figures are calculated by verifiable code, every recommendation carries its reason, and nothing is acted on without your approval. That whole chain is saved in your Proof Record.
We do not use your personal financial data to train shared, general-purpose models. Your data improves your experience, and aggregate, de-identified trends may help us improve the product, but your individual records are never sold or exposed for model training by third parties.
06How long we keep it
We keep data only as long as it is useful to you or required of us. When neither applies, we delete or de-identify it.
| Data | Retention |
|---|---|
| Account & profile | For as long as your account is open, then deleted within 90 days of closure unless we must keep it longer. |
| Transaction & advice history | Up to 7 years where financial and tax regulation requires it, otherwise removed on request. |
| Support conversations | 24 months, to help us resolve follow-up questions. |
| Security & audit logs | Up to 12 months for fraud prevention and incident investigation. |
07Your choices and rights
You are in charge of your data. Depending on where you live, you have the right to access it, correct it, export it, restrict how we use it, object to certain processing, and ask us to delete it.
The easiest way to exercise any of these is through Your data rights, where you can file a request and track it. We respond within the legal window, usually well before. You also have the right to complain to your data protection authority, in Nigeria that is the NDPC.
08How we protect it
Security is not a footnote here. Data is encrypted in transit and at rest, access is tightly scoped and logged, and we monitor continuously. The full picture is in our Security overview.
09International transfers
Qoyla operates across regions. Where we move data between countries, we do so under recognised safeguards, such as standard contractual clauses, and we keep data resident in your region where the law requires it. For Nigerian users, see NDPR compliance.
10Children
Qoyla is built for adults. We do not knowingly collect data from anyone under 18. Family features are always set up and controlled by an adult account holder. If you believe a child has used Qoyla directly, contact us and we will remove the data.
11Changes to this policy
When we make a meaningful change, we will tell you, in the app and by email if it is significant, before it takes effect. Every version is dated, and we keep an archive so you can see what changed and when.
12Contact us
Questions about your privacy, or want to reach our Data Protection Officer? We would rather hear from you than have you wonder.
privacy@qoyla.ai
Data Protection Officer, Qoyla, Inc. We aim to reply within two business days.