Privacy Policy
What we collect, who else touches it, and what you can ask us to do with it.
Last updated 6 September 2026 · SME360, Lagos, Nigeria
The short version. We hold the business records you put in — your sales, expenses, invoices, customers and documents. We don't sell them and we don't use them to train AI models. When you use the assistant, what you type is sent to our AI provider to produce a reply. You can ask us for a copy of your data, or ask us to delete it, at any time.
1. Who we are
SME360 is a business record-keeping and assistant service operated from Lagos, Nigeria. In the language of the Nigeria Data Protection Act 2023, we are the data controller for the information described here.
2. What we collect
Information you give us
- Your account — name, email address and password. Passwords are held by our sign-in provider and are never visible to us.
- Your business records — sales, expenses, invoices, receipts, customers, suppliers, price list, tasks and reminders.
- Documents you upload — anything you put in the Documents area, and any photo or file you send the assistant.
- Messages to the assistant — what you type in the app, and what you send on WhatsApp if you link a number.
- Your staff — if you add teammates, their name, role and the sign-in address you give them.
Information collected automatically
- Basic technical data needed to run and secure the service: IP address, browser and device type, and timestamps of actions taken in your account.
- Error reports when something breaks, so we can fix it.
We do not use advertising trackers, and we do not run third-party analytics on your account data.
3. Why we use it
- To provide the service — storing your records, producing invoices and receipts, and answering you in the assistant.
- To keep it secure — authenticating you, spotting abuse, and keeping an activity log so a business owner can see who did what.
- To support you — when you contact us about a problem.
- To meet legal obligations where they apply to us.
4. The AI assistant — read this one
When you use the assistant, the text you type and any file you attach are sent to Anthropic, our AI provider, so that a reply can be produced. That processing happens on their infrastructure, outside Nigeria. Relevant context from your account — for example the customer names or recent invoices needed to answer your question — may be included in that request.
We do not use your records to train AI models, and our agreement with our AI provider does not permit them to train their models on it either. If you would rather no business data left the service this way, do not use the assistant — every screen in the app can be used without it.
5. Who else processes your data
We use a small number of service providers. Each only receives what it needs:
| Provider | What for | What it sees |
|---|---|---|
| Clerk | Accounts and sign-in | Name, email, password |
| Anthropic | The AI assistant | What you send it, plus related records |
| Railway | Hosting and database | All stored records |
| Cloudflare | Document storage and network | Uploaded files |
| Meta (WhatsApp) | The WhatsApp assistant | Messages, only if you link a number |
| Sentry | Error reporting | Technical error details |
| Formspree | The in-app feedback form | What you write in it |
| Mono | Bank feed | Bank transactions, only if you connect an account |
Some of these operate outside Nigeria, so your data is transferred and stored abroad. We do not sell your data, and we do not share it for advertising.
6. How long we keep it
We keep your records for as long as your account is open, because that is the point of a bookkeeping tool — last year's invoices need to still be there. If you close your account or ask us to delete it, we remove your records from the live service. Backups are overwritten on a rolling basis. We may keep a minimal record of the deletion itself.
7. Your rights
Under the Nigeria Data Protection Act 2023 you can ask us to:
- give you a copy of the data we hold about you;
- correct anything that is wrong;
- delete your data;
- stop or limit how we use it;
- send your data to you in a portable form.
Ask us using the contact below and we will respond within 30 days. If you are not satisfied, you can complain to the Nigeria Data Protection Commission.
8. Security
Access to a business's records requires signing in, and every request is checked against your role in that business. Traffic is encrypted in transit. Passwords are stored by our sign-in provider, hashed — nobody at SME360 can read yours. No system is perfectly secure, and we will tell you promptly if a breach affects your data.
9. Children
SME360 is for businesses and is not intended for anyone under 18.
10. Changes
If we change this policy we will update the date at the top, and tell you in the app if the change is significant.
11. Contact
Questions, or want to exercise any of the rights above?
Email privacy@sme360app.com, or use
Help & feedback inside the app.