Acreed Insights privacy notice

This notice explains how Acreed Insights Limited collects, uses, shares and protects your information when you use the Acreed Insights platform — including business verification, the Acreed Credibility Score and certificate, applications to funders, and post-funding monitoring. It is written to meet the Nigeria Data Protection Act 2023 (NDPA) and the General Application and Implementation Directive 2025 (GAID).

Who we are

Acreed Insights Limited (RC 9357855), Lagos, Nigeria, is the data controller for the personal information processed on the platform. You can reach our data protection contact at legal@acreedinsights.com.

What we collect

Account details: your name and email address. Business details: your business name, CAC registration number and which register it is on, tax identification number (TIN), operating address, a proof of that address, and sector. Identity details for each named director: name, National Identification Number (NIN), Bank Verification Number (BVN), a photo of a government-issued ID, a passport photograph, and a selfie taken during verification. From the identity checks we also keep the name and gender on the NIN record, the names on the BVN record, and the document type, printed name, a masked document number and the expiry date read from the ID. Financial details: bank statement data you connect (read-only), and, with each director’s consent, their credit-bureau report. Documents you choose to upload as evidence, including any tax clearance certificate you provide. We also keep records of activity on your account.

Identity checks and biometrics

To prove that a verified identity really belongs to the person presenting it, we run three checks: that your government ID is a genuine document, that your selfie is of a live person rather than a photograph, and that the face in your selfie matches the photo on your NIN or BVN record, or failing that the photo on your ID. We also check that the name printed on your ID agrees with your NIN and BVN records. These checks are performed by our identity-verification provider, Dojah. Your selfie passes through our systems only to be sent for checking and is then discarded. We keep the outcome of each check, a confidence value and the details listed above. We ask for your explicit consent before this processing begins, and we will tell you if a check does not pass.

If the checks cannot decide, or your verification stops, you can ask a person on our team to check your ID and selfie. This is a separate step with its own consent: copies of your selfie and ID photo are made for the review and stored, encrypted, only until it is decided, then deleted — or after 30 days if it is never decided. A person compares them and confirms your identity, asks you to take new photos, or decides they cannot confirm it. The ID you uploaded during verification stays among your documents, as described below. You can also contact us about any decision.

Documents you upload

Documents you upload — your CAC certificate, tax clearance certificate, proof of address and any evidence of collateral — are read by an automated document reader, and we keep the details it reads and the outcome. When the reader cannot be sure of a document, or finds that it disagrees with what you typed, a person on our team looks at the document to decide. We never share your documents with anyone outside Acreed except a funder you apply to.

Your business address

We ask for your operating address and a recent proof of it — a utility bill, tenancy agreement or bank letter — in your business’s or a director’s name. Our document reader compares the address, name and date on the proof with what you typed. A person on our team then confirms your business is at that address before it counts towards your score, and may call you to confirm it.

Tax compliance

We confirm that your business is registered for tax using its registration number. If you provide a tax clearance certificate, we read it to check that it is issued to your business and which assessment years it covers — the document is read by an automated system, and we keep the outcome and the details we read from it. We also look through the bank statements you have connected for payments to tax authorities, so that a business which pays its taxes gets credit for it. If we cannot find any, we tell you, so you can connect the account you pay from.

Your directors

A certificate describes a business, so we check everyone who directs it, not only the person who applies. We take each director’s name and position, and we ask each director to confirm their own identity — we send them a private link, and they enter their own identity number themselves rather than you entering it for them. We check that identity against the national records. A director’s identity number is used for the check and not kept; only a masked version is. A director’s credit record is checked only after that director has read and agreed to a separate consent for it, on their own link; the business cannot give that consent for them. A director for whom the bureau holds no credit file is not treated as having bad credit. Each director sees what is being checked and agrees to it before anything runs. A director who does not complete their checks is simply recorded as unverified; we do not proceed on their behalf.

Why we use it, and our lawful bases

We use your information to verify your identity and your business against official records, to analyse your connected bank statements, to compute your Acreed Credibility Score and issue your certificate, to share your application with the funders you choose to apply to, to monitor funded facilities where monitoring has been agreed, to operate and secure the platform, and to send you service communications. We rely on your consent for the verification checks (including the biometric checks, the credit-bureau pull and the manual review), on performance of our terms of use for operating your account, on the loan agreement between you and your funder for monitoring a funded loan, and on our legitimate interest in keeping the platform secure and preventing fraud.

Who we share it with

Providers acting on our instructions: Dojah (identity, registry, tax-registration and biometric checks, and the credit-bureau report, with the director’s consent), Mono (read-only bank statement access), Groq (an automated system that reads the documents you upload, writes plain-language summaries of your results, and answers questions in the in-app assistant — identity numbers are never sent to it), Paystack (payments; we never see your card details), Resend (email), Sentry (error reports that help us fix faults, with personal details removed), Amazon Web Services and our other hosting providers (storage and running the platform), and, only if you allow it in the cookie banner, Google Analytics (site visits).

The funders you apply to see your application, your score and band, how the score was worked out part by part, the verification outcomes, the monthly totals from your bank statements (never individual transactions before a loan is funded), and the documents you provided as part of your application — including your government ID and passport photograph, which funders are required to hold for their own regulatory checks. Where we require funders to be verified, we check a funder’s registered legal name and registration number against the CAC corporate registry, hold the regulatory licence reference they declare, and a person on our team approves the funder before it can list, invite, or open applications; the people who act for a funder go through identity checks like a director’s — identity number, government ID and selfie — and if you act for a funder, this notice applies to you too. Funders see at most the last four digits of an identity number, though the full number may appear on the ID document itself. If you publish your certificate, anyone with its link can see your business name, score, band, sector, state and validity dates — it never shows personal identifiers. We do not sell your information.

Bank access is read-only, and yours to revoke

Connecting a bank account gives us read-only access to statement data through Mono. We cannot move money. You can disconnect any account you have connected, at any time, from the verification screen or from Settings: we instruct our banking provider to cancel the connection, which ends their permission to share your transactions with us, and we remove the account from your profile so it is never read again. Your cash-flow analysis is then recalculated from the accounts that remain, or removed entirely if none do. If our provider does not confirm the cancellation immediately, we keep asking until they do.

We also keep a bank connected only while something needs it: a valid certificate, an open application or a loan being monitored, plus 30 days after the last of those ends, so that a business renewing a little late need not reconnect. Then we disconnect it ourselves and tell you. The analysis already made from it, your score and your certificate are kept, and you can connect the bank again when you renew.

While a loan is monitored

When a funder records a loan, we ask you to agree to monitoring and to choose which bank accounts to share. Nothing is read for monitoring until you agree. While monitoring is on, your funder can see the transactions on the accounts you share — the date, amount, description and other party of each — along with your loan’s health, the conditions of the loan, and your repayment record.

When monitoring ends

Monitoring runs while your loan does. When your final repayment is recorded, monitoring ends automatically: we stop reading your bank account and the facility closes. Your funder can also end it earlier — for example if you settle the loan directly with them — and we will tell you when they do, and why.

You can withdraw your permission for monitoring at any time and we stop collecting new information immediately. What was shared before you switched it off stays available to your funder. Because your funder is relying on that information, we tell them that you have switched it off. We do not tell them why, and your loan is unaffected — withdrawing permission is your right and is not a default or a breach.

Deleting your data

You can delete your account from your settings. This removes your business profile, the verifications we ran and their results, the documents you uploaded, your certificate — its public link stops working — and your score history, and it disconnects any bank account you had connected. It happens immediately and cannot be reversed: we cannot restore your data afterwards, and neither can our support team.

There is one situation where we cannot delete your data straight away: while a funder is still monitoring a loan you hold with them. Their monitoring rests on the loan agreement between you, not on your permission to us, so it does not end when you ask us to forget you. Monitoring ends by itself when your final repayment is recorded; if the loan has already ended some other way, your funder can close the monitoring, and you can delete your account straight afterwards. We tell you which funder it is and what would release it.

We keep a record of the consents you gave and withdrew, and of the fact that the account was deleted. We are required to keep these, and they contain no details of your business.

How we protect it

Regulated identifiers such as NIN, BVN and account details are encrypted at rest, with the key held outside the database, and so are photos sent for a manual identity review. Access is limited by strict tenant isolation, so one customer can never read another’s data, and the application reaches the database through a restricted login. Traffic to and from the platform is encrypted in transit. Documents are kept in private storage and read only through short-lived links.

Where your information is held

Our identity, banking and payment providers (Dojah, Mono and Paystack) are in Nigeria. The documents you upload are stored in Sweden, in the European Union. Our application servers, database, email service and error reporting are hosted in the United States, and the automated reader and assistant run there too. Where information is transferred outside Nigeria we rely on written agreements with each provider, including the NDPA’s cross-border safeguards, so that it is protected to the standard the NDPA requires.

How long we keep it

We keep your information while your account is active and for as long as a certificate issued to your business remains verifiable, then for any period the law requires us to retain records. Photos sent for a manual review are deleted after the decision, or after 30 days if none is made. If you close your account or ask us to delete your data, we remove it promptly except where we are legally required to keep it.

Your rights

Under the NDPA you can ask us to access, correct or delete your information, restrict or object to its use, receive a copy in a portable form, or withdraw a consent at any time (withdrawing consent stops future processing; it does not undo checks already run). Contact us at legal@acreedinsights.com — and you also have the right to complain to the Nigeria Data Protection Commission.

Questions: legal@acreedinsights.com