Privacy policy

1. Who we are, and what this policy covers

Speed Software Ltd (“Speed”, “we”, “us”), a company registered in Nigeria with registration number RC 9761074, provides an all-in-one business management platform: messaging, sales, invoicing, payments and wallets, inventory, delivery, accounting, reports, storefronts and team tools, on web and mobile (together, the “Services”). This policy explains how we collect, use, store, share and protect personal data when you use the Services or interact with us, and the rights you have. We process personal data in accordance with the Nigeria Data Protection Act, 2023 (“NDPA”), regulations and guidance issued by the Nigeria Data Protection Commission (“NDPC”), and other applicable law. Where our payment, wallet, card or yield features operate through licensed financial partners, additional regulatory obligations (including Central Bank of Nigeria requirements) also apply to that data.

2. Who this policy is written for — three kinds of people

Vendors and their staff — the business owners who create Speed accounts, and the team members they invite as seats. For your data, Speed is the “data controller”: we decide how and why it is processed, as described here.
Buyers (our vendors’ customers) — people who chat with, buy from, pay, or review a business that uses Speed. For most of your data (your chats with the vendor, your order details, your contact information in their customer book), the vendor is the controller and Speed processes it on the vendor’s instructions as a “data processor”. For the narrow data we must process in our own right — payment processing records, fraud prevention, receipts we issue — Speed acts as a controller. Your first port of call for privacy questions about a business is that business; we support them in honouring your rights, and Section 13 explains what we do directly.
Visitors — people who browse our websites or public storefront pages, contact support, follow our social channels, or attend our events, without an account.

3. What we collect

Identity and verification (KYC) data: name, date of birth, phone number, email, address, photograph, government-issued ID, and — where required to open or upgrade a Speed Wallet — BVN, NIN and related verification records, processed with our licensed financial partners.
Business data: business name and registered name, RC number, tax ID, address, logo and branding, bank account details, products, prices, stock, costs, invoices, receipts, and the books Speed keeps for the business.
Financial and transaction data: wallet balances, pay-ins, payouts, transfers, card transactions (when launched), payment method details (we do not store full card numbers; these are handled by our licensed payment partners), yield accruals, and transaction timestamps and references.
Messages and social-channel data: when a vendor connects Instagram, WhatsApp, Messenger or Telegram, we receive and store the messages, contact handles, names and profile images those platforms provide, under their terms, solely to operate the vendor’s inbox, orders and customer records.
Content you provide: product photos, documents you upload (including statements and exports during move-in), notes, reminders, reviews, support conversations.
Device, log and security data: device model, operating system, app version, IP address, crash and event logs, approximate location derived from network data, and unique device identifiers. Device identifiers are used deliberately as part of our seat-security model (a seat is limited to a fixed number of registered devices) and for fraud prevention; this is a stated design of the product.
Usage and audit data: actions taken inside a business account (who created, edited, approved, deleted what, and when). Audit logs exist so business owners can supervise their own accounts; Speed processes them for the vendor and for platform security.
Cookies and similar technologies: as described in Section 14.
Data from third parties: identity-verification and fraud-prevention databases, our financial partners (settlement and dispute records), the social platforms a vendor connects, delivery partners (tracking status), analytics providers, and publicly available sources.

4. Why we process it — and our legal bases

To perform our contract with you: creating and running your account and seats, operating the inbox, invoices, wallet, transfers, inventory, books, reports, storefront and every feature you use; providing support; move-in and data imports.
To comply with law: identity verification, anti-money-laundering and counter-terrorist-financing checks, sanctions screening, transaction monitoring and reporting, tax and record-keeping obligations, and responding to lawful requests from regulators and law enforcement. Where fraud or false information is identified, details may be passed to the Central Bank of Nigeria, the Nigerian Financial Intelligence Unit, the Economic and Financial Crimes Commission and other competent authorities.
Legitimate interests: securing the Services and preventing fraud and abuse (including the seat-and-device rules), improving features, measuring performance, understanding usage, communicating service information, enforcing our terms, and — in balanced, minimal ways — telling you about Speed features relevant to you. We assess these interests against your rights before relying on them.
Consent: where the law requires it — for example certain marketing messages, certain cookies, connecting a social channel, or enabling optional features. You may withdraw consent at any time without affecting prior processing.
Vital interests: in rare emergencies, to protect someone’s life or safety.

5. Speed AI — how artificial intelligence handles your data

What it does: Speed AI features (order detection, drafted replies, expense capture, error checks, the WhatsApp assistant, Move-in Day) send the relevant business content — for example a chat thread, a receipt photo, a spreadsheet — to the AI model the vendor has chosen, together with the business context needed for a useful answer.
Who the models are: third-party AI providers (for example Anthropic, OpenAI, Google), under contracts with Speed. The vendor chooses which provider processes their content; Speed pipes the context to that provider only.
Training: we configure our AI integrations so that your content is not used to train providers’ models, wherever the provider supports that configuration, and we contractually require providers to process content only to deliver the service.
Control: AI features are visible and controllable: owners and admins decide which staff can use AI and set per-employee AI credit limits; AI actions are logged like any other action; vendors can decline AI features entirely and use Speed fully without them.
Buyers: where a vendor enables customer-facing AI (for example an assistant answering price questions in their chats), the vendor is responsible for that use toward their buyers, and Speed processes the buyer messages involved as the vendor’s processor.

6. Who we share data with

We do not sell, rent or trade personal data. Ever. We share it only as follows, and where a third party processes on our behalf, a written data-processing agreement binds them to confidentiality and security:

Licensed financial partners: the banks and payment institutions our money features run on (currently including Wema Bank for transfer rails), card scheme partners when cards launch, and the regulated partners with whom pooled balances are placed for Speed Yield — for payment processing, settlement, KYC, fraud prevention, dispute resolution and interest administration.
Identity, fraud and compliance services: verification providers and fraud-prevention databases used to confirm identity and detect financial crime.
Platform partners you connect: Meta (Instagram, WhatsApp, Messenger) and Telegram, to operate the channels a vendor connects, under those platforms’ terms.
AI providers: as described in Section 5, at the vendor’s selection.
Delivery partners: the courier a vendor books receives the recipient name, phone and address needed to deliver, and returns tracking status.
Service providers: cloud hosting, communications (SMS, email, push), analytics, customer-support tooling — strictly for the functions we hire them to perform.
The vendor you deal with: if you are a buyer, your order, contact and conversation data is visible to the business you are dealing with — that is the product working.
Regulators and law enforcement: where required by law or valid legal process, including CBN, NDPC, NFIU, EFCC and courts.
Corporate events: in a merger, financing, acquisition or asset sale, data may transfer as part of the transaction, under confidentiality and this policy’s protections.
With your direction: when you export data, connect an integration, or ask us to share.

7. What is public on purpose

Storefronts are public web pages by design: the business name, branding, catalogue, prices and, when launched, customer reviews and ratings appear publicly, including in search engines and Speed’s own discovery surfaces. Vendors control what their storefront displays. Buyers posting reviews should expect the review and the display name they use to be public. Business information printed on invoices and receipts (name, contact, RC number) is shared with the recipients of those documents by nature.

8. International transfers

Some of our service providers (for example cloud hosting and AI providers) process data outside Nigeria. Where personal data leaves Nigeria, we do so in accordance with the NDPA’s cross-border transfer provisions — relying on transfers to jurisdictions or recipients providing adequate protection, appropriate contractual safeguards, or another lawful basis — and we keep records of those safeguards.

9. How we protect it

Encryption in transit and at rest for sensitive data; bank-grade handling of payment credentials through licensed partners (Speed does not store full card numbers).
Access controls: staff access to personal data is limited to need-to-know, logged, and revoked on role change; production access requires multi-factor authentication.
Independent penetration testing before public launch and at least annually after, with severity-1 and -2 findings treated as blocking.
The product’s own controls protect you too: two-factor authentication, visible device lists and remote sign-out, seat-and-device limits, role-based permissions, approvals on money movement, audit logs, and a bin that prevents accidental permanent deletion.
A tested incident-response procedure: where a breach occurs that is likely to risk your rights, we will notify the NDPC and affected persons as the NDPA requires.

10. How long we keep data

We keep personal data only as long as needed for the purposes collected: for the life of your account and a reasonable period after closure; longer where law requires — financial-transaction, KYC and related records are retained for the minimum periods prescribed by CBN and anti-money-laundering regulations (typically at least five years after the transaction or relationship ends); and where needed to resolve disputes or enforce agreements. Vendors can export their business data at any time, and on account closure may request deletion; where law obliges retention, we retain the minimum required, restricted from other use, and delete or irreversibly anonymise the rest on schedule.

11. Your rights

Under the NDPA you have the right to: be informed about our processing; access a copy of your personal data; correct inaccurate or incomplete data; delete data (subject to legal retention duties); restrict or object to certain processing, including direct marketing — objections to marketing are always honoured; data portability, in a structured, commonly used format; withdraw consent at any time where processing rests on consent; and not be subject to solely automated decisions with legal or similarly significant effect, except as the law allows and with the safeguards in Section 16. To exercise any right, contact our Data Protection Officer at ifemide.o@myspeedapp.com or via in-app support. We will verify your identity, respond within 30 days, and never charge for a first, reasonable request. If you are unsatisfied, you may lodge a complaint with the Nigeria Data Protection Commission. Step-by-step deletion instructions are on our data deletion page.

12. Staff seats, and what business owners see

If you use Speed as a staff member on a business’s seat, the account owner controls that workspace: your actions in it (sales recorded, chats handled, approvals given) are visible to the owner through audit logs and analytics — that supervision is a purpose of the product. Speed processes your workspace activity on the owner’s behalf; your own account credentials, device registrations and any personal use of Speed outside that workspace remain governed by this policy directly. Owners must obtain any consents their own law and employment relationships require for workplace monitoring.

13. If you are a buyer (a vendor’s customer)

When you chat with, order from, pay, or review a Speed business: that business is responsible for your relationship and your data in their account; direct your requests to them first, and we contractually require vendors to use buyer data only to serve you and comply with law — never to spam or sell. What Speed does in its own right: process the payment and issue the receipt when you pay through Speed rails (retaining transaction records under financial law); prevent fraud; and operate the storefront and review infrastructure. Receipts and payment pages generated on our free plan may carry a short line noting they were made with Speed — a product notice, not use of your data for advertising. If a vendor cannot or will not resolve your request, contact our DPO and we will assist directly.

14. Cookies and similar technologies

Our websites and apps use: essential cookies (sign-in, security, remembering your session — the product cannot work without them); preference cookies (language, settings); analytics cookies (understanding usage to improve the Services); and, on our marketing sites only, limited advertising cookies. Where law requires consent, we ask before setting non-essential cookies, and you can change choices any time in cookie settings or your browser. Blocking essential cookies will break parts of the Services.

15. Messages we send you

Transactional and service messages — payment confirmations, security alerts, approval requests, receipts, reminders you set — are part of the Services and cannot be opted out of while you use the relevant features. Marketing and growth messages (feature news, tips, offers) are sent under consent or legitimate interest as applicable, capped in frequency by our own product rules, and every one carries an opt-out that we honour immediately.

16. Automated decisions and profiling

We use automated rules and models for: fraud and abuse prevention (velocity checks, device-pattern flags — including the seat-sharing signature described in our terms); operational flags shown to vendors about their own customers (for example at-risk or churned statuses); and, when launched, Speed Score, a business-health score computed from a business’s own records. Where an automated decision would produce legal or similarly significant effects for you — for example a wallet restriction — you have the right to contest it, provide context, and obtain human review through our support and DPO channels. Vendor-facing insights (statuses, scores, insights) are decision support for the vendor, not decisions about the vendor.

17. Children

The Services are for business use by adults. We do not knowingly collect personal data from anyone under 18; if we learn we hold such data, we will delete it. If you believe a minor has provided us data, contact the DPO.

18. What we will never do

Never sell, rent or trade your personal data.
Never claim ownership of your business data — your customers, records, books and content are yours; we take only the limited licence needed to operate the Services for you, and you can export everything, any day.
Never use your content to train AI models outside the configurations and contracts described in Section 5.
Never hide a material change — significant updates to this policy are notified in-app or by email before they take effect; continued use after the effective date constitutes acceptance.

19. Contact

Data Protection Officer, Speed Software Ltd (RC 9761074) · Email: ifemide.o@myspeedapp.com · Address: Yaba, Lagos, Nigeria · In-app: Settings → Data & privacy. Complaints may also be directed to the Nigeria Data Protection Commission.