Privacy Policy
What we collect, why, who else handles it, how long we keep it, and what you can ask us to do with it.
Last updated 13 October 2026 · Bleu Meridian Technologies, Lagos, Nigeria
- We hold the business records you put into SME360 — sales, expenses, invoices, customers and documents — only to run the service for you.
- We never sell your data, use it for advertising, or use it to train AI models.
- When you use the assistant, what you send it goes to our AI provider, Anthropic, so it can reply.
- You can download everything (Settings → Your data) or permanently delete your business (Settings → Delete business) yourself, at any time.
This summary is for convenience — the full text below is what applies.
1. Who we are
SME360 is a business record-keeping and AI assistant service operated by Bleu Meridian Technologies (CAC registration no. 9017064), Lagos, Nigeria ("SME360", "we", "us"). This policy explains how we handle personal data under the Nigeria Data Protection Act 2023 (NDPA). Businesses in many African countries use SME360; where your local law gives you more protection than this policy describes, you have that protection too.
2. Your data, and your customers' data
We handle two different kinds of personal data, and our role is different for each:
- Data about you, the account holder — your sign-in details, how you use SME360, and what you send us when you contact us. For this, we are the data controller: we decide why and how it is used, and this policy describes it.
- Data about the people your business deals with — your customers, suppliers and staff, and anyone named in the records and documents you put into SME360. For this, your business is the data controller and we are your data processor: we only use it to run SME360 for you, on your instructions. The terms for that are in our Data Processing Agreement.
If you are a customer, supplier or staff member of a business that uses SME360 and you want to see, correct or delete your information, please contact that business first — they control it. You can also contact us and we will pass your request on and help them respond.
3. What we collect
Information you give us
- Your account — your name, email address and password. If you choose "Continue with Google", Google shares your name, email address and profile picture with our sign-in provider. Passwords are held by our sign-in provider and are never visible to us.
- Your business profile — business name, legal name, address, country, currency, logo, tax and registration numbers if you add them, and the bank account details you choose to print on your invoices.
- Your business records — sales, expenses, invoices, receipts, orders, payments, your price list (including what items cost you, if you add it), tasks, reminders and to-dos.
- Your customers and suppliers — the names, phone numbers, email addresses, addresses, tax numbers, bank details and notes you save about them.
- Your staff — if you add teammates: their name, role, the sign-in address you give them, what they are allowed to do, and, if you use Pay, their pay rate and the payments and advances you record.
- Documents and photos — anything you upload to Documents, attach to a record, or send to the assistant (for example a photo of a receipt). To make documents searchable by the assistant, we read each one once and store a short summary and its key facts (such as dates, amounts and reference numbers) alongside it.
- Conversations with the assistant — what you type or send in the app, and on WhatsApp if you link a number, together with the assistant's replies.
- Messages to us — what you write in Help & feedback or send to our email address.
Information collected automatically
- An activity log — a record of changes made in your business (who created, changed or deleted what, and when), so you can see who did what.
- Which screens you open — the name of each screen in the app you open, how long it stayed open, and whether it was opened on a phone or a computer, so we can see which parts of SME360 are useful and where people get stuck. It never includes your records, amounts or customer names. Only the SME360 team sees it, as totals for each business; it is never shown to a business owner about their staff; and it is deleted after 180 days.
- Shared documents — when you share an invoice or receipt by link, we count how many times the link is opened and when, so you can see whether your customer has looked at it. We record nothing about the person who opens it. If they sign up from that page, we note that they came from a shared document.
- Notifications we send you — whether a message reached you, whether you opened it in the app, and whether you then did what it suggested. We do not track email opens or link clicks.
- Error reports — when something breaks, a technical description of the error and the screen or request it happened on, so we can fix it.
- Technical data — our sign-in provider and our network provider process your IP address and browser or device details to sign you in and protect the service from abuse. Our own application does not store your IP address.
We do not use advertising trackers and we do not run third-party analytics on your account data.
4. Why we use it
| Purpose | What it involves | Legal basis (NDPA) |
|---|---|---|
| Providing SME360 | Storing your records, producing invoices, receipts and reports, answering you in the assistant, sending the WhatsApp messages you set up | Performance of our contract with you |
| Keeping it secure | Signing you in, checking every request against your role, spotting abuse, keeping the activity log | Our legitimate interests, and performance of the contract |
| Improving SME360 | Seeing which screens are used and where people stop; reviewing assistant answers that went wrong so we can fix them | Our legitimate interests |
| Supporting you | Answering your questions and feedback | Performance of the contract |
| Product emails to account owners | Occasional emails about using SME360 — you can unsubscribe from any of them | Our legitimate interests; you can object at any time |
| Legal obligations | Responding to lawful requests, keeping records the law requires | Legal obligation |
SME360 does not make decisions about you that have legal or similarly significant effects using automated processing alone. The assistant suggests; you decide what is saved.
5. The AI assistant — please read this one
When you use the assistant, the text you type and any file or photo you attach are sent to Anthropic, our AI provider, so that a reply can be produced. To give useful answers, relevant context from your business is included in that request — for example your recent transactions, open invoices, customer names and phone numbers, your price list and summaries of your documents. This processing happens on Anthropic's infrastructure in the United States.
We do not use your records to train AI models, and our agreement with Anthropic does not allow them to train their models on your data. Anthropic may keep requests for a limited period under its own commercial terms, for example to detect misuse.
We keep a record of each conversation turn — what was asked, what the assistant proposed, and whether you saved, changed or rejected it — so you can see your chat history and so we can find and fix answers that went wrong. A small number of SME360 engineers can read these records in our internal tools for that purpose; that access is restricted and logged.
If you would rather none of your business data left the service this way, don't use the assistant — every screen in the app works without it.
6. WhatsApp
If you link a WhatsApp number, messages between you and the SME360 assistant are carried by Meta's WhatsApp Business Platform, and we keep a copy of them so the assistant can follow the conversation and so you can see the activity in the app. Depending on your settings we also send you a summary of your day in the evening, your to-do list in the morning, and reminders at the times you set. You can switch these off in Settings → Notifications, and unlink a number at any time.
7. Emails we send
- Service emails — sign-in codes, security notices and messages about your account. These are needed to run the service.
- Documents you send — when you email an invoice or receipt to a customer from SME360, we deliver it on your behalf. Replies go to you, not to us.
- Product emails — occasional emails to account owners about getting more out of SME360. Every one has an unsubscribe link, and once you unsubscribe we keep your address on a "do not email" list so it stays that way. We never send marketing to your customers or staff.
8. Share links
You can create a link to an invoice or receipt to send to a customer. Anyone who has that link can view that one document — the same as if you had forwarded the PDF. Links are long and random so they cannot be guessed, and you can turn a link off at any time, after which it stops working.
9. Who else processes your data
We use a small number of service providers. Each receives only what it needs to do its job, and processes it on our instructions:
| Provider | What for | What it handles | Location |
|---|---|---|---|
| Railway | Hosting the app and the database | All stored records | United States |
| Cloudflare | File storage and network protection | Uploaded files and documents; network traffic | United States / global network |
| Clerk | Accounts and sign-in | Name, email, password (hashed), sign-in and device details | United States |
| Anthropic | The AI assistant and reading uploaded documents | What you send it, plus related records (see section 5) | United States |
| Resend | Sending email | Recipient address and email content, including invoices and receipts you email to customers | United States |
| Meta (WhatsApp) | The WhatsApp assistant | Your WhatsApp number and messages — only if you link a number | Global |
| Formspree | The in-app feedback form | What you write in it, the screen you were on | United States |
| Hostinger | Our email inbox | Emails you send to us | Global |
| Google Fonts | Displaying the fonts on our website and app | Your IP address and browser details when the fonts load — no account data | United States / global |
We may also disclose data where the law requires it, to protect people from harm, or as part of a sale or reorganisation of our business (in which case this policy continues to apply). We do not sell your data, and we do not share it for advertising.
10. Where your data is stored
Our database and file storage are hosted in the United States, and several of the providers above are based outside Nigeria. Your data is therefore transferred abroad. We do this because it is necessary to provide the service you have asked for, and we rely on the data protection commitments in our agreements with these providers to keep it protected to the standard the NDPA requires.
11. How long we keep it
| Data | How long |
|---|---|
| Business records, customers, suppliers, staff, documents and uploaded files | As long as the business exists in SME360 — that is the point of a bookkeeping tool. Removed from the live service as soon as you delete the business. |
| Chat history with the assistant | Until you delete the conversation or the business. |
| Our record of each assistant turn (section 5) | As long as the business exists; removed when you delete it. |
| WhatsApp messages | As long as the business exists; removed when you delete it. |
| Activity log of changes | As long as the business exists. |
| Screen views | 180 days, then deleted automatically. |
| Error reports | As long as we need them to fix problems; removed when you delete the business. |
| Encrypted backups | 30 days. Each night an encrypted copy of our database is made and kept in separate secure locations; copies older than 30 days are deleted. We only restore from a backup to recover from a disaster, never to bring back data you deleted. |
| "Do not email" list | Kept, so that we keep respecting your unsubscribe. |
| Record that a business was deleted | Kept, without any name, email, phone number or other identifying detail — just enough to show the deletion happened. |
| AI usage costs | Kept as anonymous totals for our own accounting, without who you are. |
Deleting a business does not close your sign-in account, because you may own or work in other businesses. To close your sign-in account as well, contact us.
12. Your rights
Under the NDPA you have the right to:
- get a copy of the personal data we hold about you;
- take your data with you in a portable, machine-readable form;
- correct anything that is inaccurate or incomplete;
- have your data deleted;
- restrict or object to how we use it, including to product emails;
- withdraw consent where we rely on it;
- complain to the Nigeria Data Protection Commission.
Many of these you can do yourself, immediately: Settings → Your data downloads everything in your business (Excel, CSV and PDF, with your uploaded files); you can edit any record in the app; and Settings → Delete business permanently removes it. For anything else, contact us — we will respond within 30 days, and we may need to confirm it is really you before acting.
13. Security
- All traffic to SME360 is encrypted in transit (HTTPS).
- Access to a business's records requires signing in, and every request is checked on our servers against your role in that business. Each business's data is kept separate from every other business's.
- Uploaded files are stored privately and are only served after a permission check or through a short-lived link.
- Passwords are stored by our sign-in provider, hashed. Nobody at SME360 can read yours.
- Nightly backups are encrypted with AES-256 before they leave our servers.
- Access to our internal tools is limited to named members of the SME360 team, and that access is logged.
No system is perfectly secure. If a breach affects your personal data, we will notify the Nigeria Data Protection Commission where the law requires it, within 72 hours of becoming aware of it, and tell you without undue delay.
14. Cookies
The app uses cookies and your browser's storage only to keep you signed in, protect your account, and remember your preferences (such as your last open chat). We do not use advertising or cross-site tracking cookies.
15. Children
SME360 is for businesses and is not intended for anyone under 18.
16. Changes to this policy
If we change this policy we will update the date at the top. If the change is significant, we will tell you in the app or by email before it takes effect.
17. Contact
Questions, or want to exercise any of the rights above?
Email info@sme360app.com, or use
Help & feedback inside the app.
Bleu Meridian Technologies (CAC no. 9017064), Lagos, Nigeria.