Who we are
Bankable Limited ("Bankable", "we", "us", "our") is a financial technology company incorporated in Nigeria. We operate the platform at mybankable.com and any associated applications (the "Platform").
We are a Data Controller under the Nigeria Data Protection Act 2023 (NDPA) and the General Application and Implementation Directive (GAID) 2025.
Email: [email protected]
Bankable Limited, Abuja, Federal Capital Territory, Nigeria
What this policy covers
This Privacy Policy explains what personal data we collect, why we collect it, how we use it, who we share it with, how long we keep it, and your rights under Nigerian data protection law. It applies to all users of the Bankable Platform, visitors to mybankable.com, and anyone who joins our waitlist.
The personal data we collect
Information you provide directly
| Category | Examples | When collected |
|---|---|---|
| Identity | Username (chosen by you) | Account registration |
| Contact | Email address | Registration, waitlist signup |
| Authentication | Password (hashed with Argon2id — never stored in readable form), session tokens | Registration and login |
| Identity verification | National Identification Number (NIN) — optional | Voluntarily provided during onboarding |
| Consent records | Timestamp, consent text shown, consent version | Every consent event |
Financial transaction data — with your explicit consent only
When you connect your bank account via Open Banking APIs, we collect your transaction history (up to 6 months), transaction amounts, dates and directions, transaction categories, and running account balances.
Derived data we create from your information
We create your financial health score (0–100), component scores across five behavioural dimensions, score trajectory over time, and personalised financial health recommendations.
Technical data collected automatically
When you visit mybankable.com, Cloudflare (our infrastructure provider) processes your IP address, browser type, device type, pages visited, and visit timestamps. See Section 7 for cross-border transfer details.
Technical and authentication data
We automatically collect: IP address and device type (via Cloudflare), session token (stored as SHA-256 hash; set as an httpOnly, Secure, SameSite=Lax cookie named bk_session), email verification and password reset token hashes, and login attempt counts and account lock status.
Lender referral data
If you click through to a lender from our marketplace, we record which lender you clicked, your score and income at the time of the click, and any self-reported outcome you provide.
Waitlist data
If you join our waitlist, we collect your email address only. No financial data is collected at the waitlist stage.
How we use your data and our legal basis
| Purpose | Data used | Legal basis |
|---|---|---|
| Generating your financial health score | Transaction data | Your explicit consent |
| Displaying your score and insights | Derived score data | Contract performance |
| Tracking score trajectory | Score snapshots | Your explicit consent |
| Sharing score summary with lenders (where requested) | Score data only — never raw transactions | Separate explicit consent |
| Creating and managing your account | Identity, contact, authentication data | Contract performance |
| Verifying your email address | Email address, verification token | Contract performance |
| Sending transactional emails (verification, reset, score updates) | Email address | Contract performance |
| Processing payments for subscriptions and on-demand rescores | Payment reference (via Flutterwave) | Contract performance |
| Recording lender referral clicks for commission tracking | Referral click data | Legitimate interests |
| Sending waitlist and launch notifications | Email address | Your consent |
| Operating and improving the Platform | Technical data | Legitimate interests |
| Complying with legal obligations | As required by law | Legal obligation |
| Preventing fraud and ensuring security | Technical and identity data | Legitimate interests / Legal obligation |
We will never process your data for a purpose incompatible with the original purpose without obtaining fresh consent.
Automated decision-making
Our scoring engine uses automated processing to calculate your financial health score. This score may influence which financial products you are shown or referred to.
You have the right to know that automated processing is taking place, receive a meaningful explanation of the logic behind your score, contest your score if you believe it is based on inaccurate data, and request human review of any automated assessment. To contest your score or request human review, contact us at [email protected].
Who we share your data with
Open Banking API providers
We work with licensed Open Banking API providers (currently Mono Finance Inc. and Okra Technologies Limited) to access your bank transaction data with your consent. We have Data Processing Agreements in place with these providers.
Financial institutions — with your separate consent
If you explicitly consent to having your score summary shared with lenders, we may share your score band, score date, and trajectory direction. We never share your raw transaction data with any lender.
Infrastructure and service providers
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services, Inc. (AWS) | Cloud server hosting, database storage | Ireland (EU, eu-west-1) |
| Cloudflare, Inc. | Website hosting, CDN, DDoS protection | United States |
| Brevo (Sendinblue SAS) | Transactional email delivery | European Union |
| Flutterwave, Inc. | Payment processing for subscriptions and rescores | Nigeria / United States |
| GitHub, Inc. | Code repository (no user data stored) | United States |
Legal and regulatory bodies
We may share your data with the NDPC, CBN, or law enforcement where legally required.
Cross-border data transfers
Some of our service providers are located outside Nigeria. When we transfer your personal data outside Nigeria, we ensure adequate protection is in place through Standard Contractual Clauses or Data Processing Agreements with providers who maintain equivalent data protection standards.
Cloudflare processes website traffic data in the United States and globally. Formspree stores waitlist email addresses on servers in the United States.
Your financial transaction data and score data are not transferred to any foreign jurisdiction.
Your financial transaction data and score data are currently stored on AWS cloud servers located in Ireland (European Union). Ireland operates under the EU General Data Protection Regulation (GDPR), which provides a level of data protection equivalent to or exceeding the requirements of the Nigeria Data Protection Act 2023. We have a Data Processing Addendum in place with Amazon Web Services governing this arrangement.
We intend to migrate to AWS infrastructure located in Nigeria (Lagos region) when that infrastructure meets our operational requirements. We will update this policy when that migration occurs.
Data retention
| Data type | Retention period | Reason |
|---|---|---|
| Raw transaction data | 12 months from processing | Minimum for scoring window plus review period |
| Financial health scores | 36 months from generation | Enables trajectory tracking |
| Consent records | Duration of relationship + 5 years | Legal obligation to demonstrate lawful processing |
| Waitlist email addresses | Until launch or unsubscribe | Consent-based |
| Session tokens | 30 days (or until revoked) | Authentication |
| Email verification and reset tokens | 24 hours (verification) / 15 minutes (reset) | Security |
| Audit logs | 7 years | Legal compliance |
| Referral click data | 12 months | Commission tracking |
| Technical log data | 90 days | Security monitoring |
| Identity data | Duration of active account + 2 years | Legal and regulatory obligations |
| Raw transaction data | 90 days after account deletion | Per Data Retention Schedule DRS-001 |
When your data is no longer needed, we securely delete or anonymise it.
Your rights under the NDPA
As a data subject under the Nigeria Data Protection Act 2023, you have the following rights:
- Access — Request a copy of the personal data we hold about you
- Rectification — Ask us to correct inaccurate data
- Erasure — Ask us to delete your data where we no longer have a lawful basis
- Restriction — Ask us to limit how we use your data
- Portability — Request your data in a structured, machine-readable format
- Object — Object to processing based on legitimate interests
- Withdraw consent — Withdraw consent at any time without affecting prior lawful processing
- Human review — Request human review of any automated scoring decision
Data security
We implement the following security measures:
- All data in transit encrypted using TLS 1.2 or higher
- All data at rest encrypted using AES-256
- Passwords hashed using Argon2id (memory 64 MB, 3 iterations, parallelism 4) — never stored in readable form
- NIN data encrypted using AES-256-GCM — never returned to clients or shared
- Session tokens stored as SHA-256 hashes — original tokens never stored
- Account lockout after 5 failed login attempts
- Formal Data Breach Response Plan in place
If a breach occurs that poses a risk to your rights and freedoms, we will notify the NDPC within 72 hours and notify you without undue delay.
Cookies and tracking
We use one essential session cookie: bk_session — keeps you logged in to your Bankable account. It is httpOnly, Secure, and SameSite=Lax, and expires after 30 days or when you log out. Cloudflare may also set technical cookies for security and performance. We do not use advertising cookies, analytics cookies, or third-party tracking scripts.
Children's data
Our Platform is intended for users who are 18 years of age or older. We do not knowingly collect personal data of children under 18. If you believe we have inadvertently collected data from a child under 18, please contact us immediately at [email protected].
Changes to this policy
We may update this Privacy Policy from time to time. We will notify registered users of material changes by email. The "last updated" date at the top of this policy indicates when it was last revised.
How to complain
If you believe we have not handled your personal data correctly, you have the right to complain to the Nigeria Data Protection Commission:
We would appreciate the opportunity to address your concern before you contact the NDPC. Please contact us first at [email protected].
This Privacy Policy is governed by the laws of the Federal Republic of Nigeria.