Privacy Policy

1. Introduction

Moatwave Technologies Ltd ("Moatwave", "we", "our", or "us") is committed to protecting the personal data of all users of our platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you access our website at moatwave.com or use any of our products and services (collectively, the "Services").

By accessing or using our Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree, please discontinue use of our Services immediately.

2. Information We Collect

We collect information you provide directly to us when you register an account, use our Services, or communicate with us. This includes:

• Account information: company name, your name, email address, phone number, and password.
• Business data: staff profiles, payroll figures, financial transactions, inventory records, attendance logs, and other data you upload or generate within the platform.
• Payment information: billing name, address, and payment method details (processed by our payment processor; we do not store full card numbers).
• Communications: messages, support tickets, and feedback you send to us.
• Device and usage data: IP address, browser type, pages visited, time spent, and other diagnostic information collected automatically.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our Services.
• Process transactions and send related notices such as invoices and receipts.
• Authenticate users and enforce role-based access controls.
• Send administrative communications including security alerts and policy updates.
• Respond to enquiries and provide customer support.
• Detect, investigate, and prevent fraudulent or unauthorised activity.
• Comply with applicable legal obligations, including Nigerian Data Protection Act (NDPA) 2023 requirements.
• Generate anonymised, aggregated analytics to improve platform performance.

4. Data Storage & Security

Your data is stored on secure cloud infrastructure (Supabase / PostgreSQL) hosted within data centres that comply with industry security standards. We enforce row-level security, end-to-end encryption for data in transit (TLS 1.2+), and AES-256 encryption for data at rest.

Access to your data is restricted to authorised personnel on a need-to-know basis, and all administrative actions are recorded in an immutable audit log.

While we implement commercially reasonable measures, no method of transmission over the internet is 100% secure. In the event of a data breach, we will notify affected users and relevant authorities in accordance with applicable law.

5. Sharing Your Information

We do not sell, trade, or rent your personal data to third parties. We may share your information only in the following circumstances:

• Service providers: trusted vendors who assist us in operating our platform (e.g. payment processors, email delivery, cloud infrastructure), bound by confidentiality agreements.
• Legal requirements: when required by law, court order, or government authority, or to protect the rights and safety of Moatwave, our users, or the public.
• Business transfers: in connection with a merger, acquisition, or sale of company assets, with prior notice to affected users.
• With your consent: for any other purpose with your explicit agreement.

6. Your Rights

Under the Nigerian Data Protection Act (NDPA) 2023 and other applicable regulations, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request erasure of your data where it is no longer necessary for the purpose it was collected.
• Object to or restrict processing of your data.
• Data portability — receive your data in a structured, machine-readable format.
• Withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at hello@moatwave.com. We will respond within 30 days.

7. Cookies

We use essential cookies and similar technologies to maintain your session and remember your preferences. We do not use third-party advertising cookies. You may configure your browser to refuse cookies, but certain features of our Services may not function correctly as a result.

8. Data Retention

We retain your personal data for as long as your account remains active or as necessary to provide our Services. After account termination, we retain data for a minimum of 12 months to comply with legal and regulatory obligations, after which it is securely deleted or anonymised.

Financial records may be retained for up to 7 years as required by Nigerian financial regulations.

9. Children's Privacy

Our Services are intended solely for use by businesses and are not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top of this page and, where changes are material, notify you by email or in-app notification. Your continued use of our Services after any change constitutes acceptance of the updated policy.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Data Protection Officer: