Privacy Policy

1. About this policy

This policy explains what personal data Roofteller collects, why we collect it, who we share it with, how long we keep it, and what you can do about it.

It covers everyone whose data we handle: landlords and property managers, the team members they invite, tenants, rental applicants, business directors and shareholders, referees and next of kin, people who apply to work with us, and anyone who visits our website or apps.

Who we are. Roofteller is a brand of Tenalet Ltd, a company registered in the Federal Republic of Nigeria with registration number RC 8493617, registered office Plot 312 Olusegun Obasanjo Way, Wuye, Abuja, Federal Capital Territory. Tenalet Ltd is the data controller for the processing described here.

Our Data Protection Officer is Diana Uzor, who can be reached at [email protected].

The law we work under. The Nigeria Data Protection Act 2023 (NDPA) and the NDPA General Application and Implementation Directive 2025 (GAID), which took effect on 19 September 2025 and superseded the Nigeria Data Protection Regulation 2019. Our supervisory authority is the Nigeria Data Protection Commission (NDPC).

A note about tenants. If your landlord uses Roofteller and you pay rent through it, we are our own controller of your data, not simply a processor acting on your landlord's instructions. You hold your own account, you authenticate with us directly, and you transact with us directly. That means you can exercise your rights directly with us. Your landlord separately controls your data for their own purposes, and is responsible for that.

2. What Roofteller does, and why that shapes this policy

Roofteller is a financial platform for landlords in Nigeria. Through licensed partners it provides accounts and wallets, rent collection, transfers and payouts, debit cards, and interest-earning balances; and it provides bookkeeping, receipt capture, reporting and, as a secondary feature, tenant screening.

We are regulated by proxy. Our partners are licensed financial institutions. The law requires them to verify who their customers are and to monitor transactions. So we collect more identity data than a typical software product, we cannot always delete it when asked, and we must share it with partners and, where required, with regulators and law enforcement.

We hold the record, not the money. Your funds sit with our licensed partners, not with Roofteller. What we hold is the record of your accounts and transactions, and that record is what this policy describes. The partners are named in section 7.

3. Personal data we collect

3.1 Everyone with an account

• Name, email address, phone number, country.
• Authentication data: one-time codes; Google or Apple sign-in identifiers; session and refresh tokens; a hashed transaction PIN and its failure/lockout counters.
• Device data where you use our mobile app: a device identifier, app and operating system version, and, if you enable biometric payment authorisation, a public key bound to your device.
• Notification preferences.
• Records of your contact with our support team.

About biometrics on your phone: if you use Face ID, Touch ID or an Android equivalent, that check happens on your device. Your fingerprint or face data never leaves your phone and is never sent to us. We only ever hold the public half of a key pair; the private half stays in your device's secure hardware.

3.2 Landlords and property managers: identity verification (KYC)

Because our partners are regulated, we must verify you before you can hold a balance or move money:

• Bank Verification Number (BVN) and National Identification Number (NIN), and the identity records the verification provider returns against them.
• Date of birth, gender, middle name, and the name and photograph held against your BVN or NIN.
• A government-issued identity document (NIN card, driver's licence, international passport or voter's card), its number, and an image of it.
• Residential address: street, city, state and landmark; a proof-of-address document such as a utility bill; and your electricity meter number and distribution company code, which the verification partner uses as an address signal.
• Next of kin: their name, relationship to you, mobile number and address. Please tell them you have given us their details.
• The outcome of a facial liveness check (see 3.6).

How we protect the most sensitive of these: your BVN, NIN, identity-document number, date of birth, and the full identity records returned by the provider are encrypted at rest, at the individual field level, in addition to the encryption applied to our databases as a whole.

3.3 Businesses: verification (KYB)

If you use Roofteller through a registered business:

• Business registration (CAC) number, business name, company type, registration date, registration status, and the record returned by the registry.
• Tax Identification Number, registered address, city, state and local government area.
• Business contact name, email and phone number.
• Uploaded business documents (certificate of incorporation, status report and similar).
• For each director and significant shareholder: name, email, phone, date of birth, address, percentage shareholding, and their BVN and NIN, both encrypted at rest, plus meter number and distribution company code.

If you provide a director's or shareholder's details, you must be entitled to, and you should tell them we hold their data and point them to this policy.

3.4 Financial and transaction data

• Account and virtual account numbers issued to you by a partner bank.
• Ledger accounts, double-entry ledger transactions and entries, and account balances.
• Payments in and out: payouts, transfers, rent payments, checkout transactions, card transactions, counterparty account numbers and names, narrations, references, amounts and timestamps.
• Card records: card number, expiry, scheme, status and a card fingerprint.
• Rent data: rent collections, invoices and line items, charges, disbursements, invitations and tenant claims.
• Bookkeeping data: entries, categories, vendors, tagging rules and imported transactions.
• Direct debit mandates, where you set one up.

3.5 Documents and receipts you upload

Receipt photographs and PDFs, transaction attachments, identity and address documents, and business documents, together with what we extract from a receipt: merchant name, amount, currency, tax, date, reference, an extraction-confidence score, and any foreign-currency conversion applied.

Camera and photo access on mobile. To capture a receipt, our mobile app asks to use your camera and photo library. We use that access only for the image you choose to attach, never at any other time, and you can decline or revoke it in your device settings and keep using the rest of the app.

We do not collect your location. The app does not request or use location data.

3.6 Biometric verification: what we do and do not receive

Some partners require a facial liveness check before an account can be opened or upgraded.

Roofteller does not perform it and never receives your facial data. The check is carried out by the partner financial institution that requires it, on the partner's own hosted page, as part of its regulatory duty to verify its customers. Your facial image, template and any biometric identifier stay with that partner, which processes them as its own controller under its own privacy notice, not on our instructions. Our role is limited to showing you the link.

What comes back to us is a result: verified, failed or needs review, with a reason code such as "face match low", the attempt number and a session reference. That is all we hold.

3.7 Tenants and rental applicants

If you pay rent through Roofteller: your name, email, phone number, the property or unit, your invoices and what you owe, your payment history, and the record of your payment instructions.

Your landlord may enter some of this before you ever use Roofteller. That is how the invitation reaches you.

If you apply to rent through Roofteller: additionally, and only with your consent, the information the application asks for and the results of the checks you authorise, which may include identity verification, income verification, and a credit report from a licensed credit bureau, together with a credit score and a monthly income figure where those are returned.

We do not score, rank or rate you, and we make no decision about you. The landlord decides.

3.8 Everyone who visits our website or apps

IP address, approximate location derived from it, device and browser type, operating system, pages viewed, referring page, session duration and timestamps, and cookie and similar identifiers. On the marketing site we also collect what you submit to a form: waitlist sign-ups, newsletter subscriptions, template downloads, self-assessment quiz answers, and insurance quote requests.

3.9 If you apply to work with us

Your name and contact details, your CV, your work history and qualifications, your referees, the answers you give in an application or at interview, and our interviewers' notes and any assessment results.

For roles with access to customer money, identity documents or financial records: additionally, identity and right-to-work verification, and background screening proportionate to the role. We tell you before any check runs, and name whoever carries it out.

We may also receive your details from a recruiter or job board you applied through.

No hiring decision about you is made by automated means.

3.10 What we do not collect

We do not ask for, and you should not send us, information about your health, religion, ethnicity, political opinions, trade union membership or sexual orientation. We have no use for it. If you send it to us anyway, we will delete it.

The one exception is recruitment: if you tell us about a disability so we can make an adjustment at interview, we use it only for that and keep it separate from your application.

4. Where we get it

• From you: what you type, upload, or authorise.
• From your landlord: if you are a tenant or applicant.
• From a landlord or business you work with: if you are an invited team member, a director, a referee or a next of kin.
• From verification partners: the identity, address, business-registry, income and credit data returned when a check runs.
• From banking partners: account details, transaction notifications and settlement data.
• Automatically: from your use of our website and apps.

5. Why we use it, and our lawful basis

Under NDPA 2023 we must have a lawful basis for every purpose.

Where we rely on legitimate interest, we have assessed that our interest is not overridden by your rights. You can ask us for that assessment, and you can object (see section 11).

Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect processing already carried out, and some services cannot continue without it.

6. Automated processing and AI

6.1 We do not make automated decisions about you that have legal effect

No decision that produces a legal or similarly significant effect about you is made solely by automated means on Roofteller. In particular:

• We do not score or rate tenants. A letting decision is made by a human landlord.
• Credit reports and verification results are passed on, not acted on by us. We do not approve, decline or recommend.
• Automated checks may flag a transaction or an account for review, for fraud, sanctions or money-laundering reasons, but where that leads to a restriction, a person reviews it, and you can ask us to review it again.

6.2 AI features, and what they see

Where enabled, we use a third-party AI provider (Google) for two things:

• Transaction categorisation. We send a sanitised transaction narration and an amount: no name, no account number, no identity data. It returns a suggested category. The suggestion is written as a suggestion only: it never confirms a category in your books.
• Receipt reading. We send the receipt image or PDF you uploaded and receive back the extracted merchant, amount, currency, tax, date and reference. If your receipt contains personal data, that data goes with it, so avoid uploading documents containing personal information you do not need in your books.

We do not use your data to train third-party AI models, and our AI providers are contractually barred from doing so.

7. Who we share it with

We do not sell your personal data. We share it in four situations.

7.1 With the people you are dealing with

• Your landlord sees your name, contact details, invoices, payment history, and, if you applied to rent, your application and the reports you consented to.
• Your tenants see what they need to pay you: your name or portfolio name, the property, the amount and the reference.
• Team members you invite see what their role permits.

7.2 With service providers who process data for us

We may add or change providers as the platform grows. When we do we update this list, and where the change is material, including a new banking or verification partner that will hold your data, we tell you in the app or by email before it takes effect.

7.3 Where the law requires it

With regulators including the Central Bank of Nigeria and the NDPC, with the Nigerian Financial Intelligence Unit, with courts, and with law enforcement, where we or a partner are legally obliged, or where it is necessary to establish, exercise or defend a legal claim. We may be prohibited by law from telling you when this happens.

7.4 If our business changes

If Roofteller is acquired, merged or restructured, data may transfer as part of that. Any buyer would be bound by this policy or a policy no less protective, and we would tell you.

8. Sending data outside Nigeria

Some of our providers operate outside Nigeria, including in the United States and the European Union. Where personal data leaves Nigeria, we transfer it under NDPA 2023 Part IX, relying on:

• an adequacy decision by the NDPC, where one covers the destination; or
• contractual safeguards in our agreement with the provider, imposing protection equivalent to the NDPA; or
• your explicit consent, where we have told you the risks and no other basis applies; or
• the transfer being necessary to perform a contract with you, or to establish or defend a legal claim.

You can ask us which basis applies to a particular provider, at [email protected].

9. How long we keep it

The five-year rule surprises people. If you close your account and ask us to delete everything, we can delete a great deal, but not the identity and transaction records the law requires us to keep. We restrict those so they are used only for that purpose.

When a retention period ends, we delete or irreversibly anonymise the data.

10. How we protect it

• Encryption in transit (TLS) everywhere, and encryption at rest for our databases and file storage.
• Field-level encryption for the most sensitive identifiers: BVN, NIN, identity-document numbers, dates of birth, and the full identity records returned by verification providers. These are encrypted separately, so they remain protected even against someone with database access.
• Passwordless authentication: there is no password to steal or reuse. Sign-in is by one-time code or a verified sign-in provider.
• Device-bound payment authorisation: the private key that authorises a payout lives in your phone's secure hardware and never leaves it.
• No facial data held: liveness checks run on the partner's page; we receive a result, not an image.
• Access control: staff access is role-based and limited to what a role needs. Access to customer data by our internal administrators is logged in an audit trail.
• Rate limiting and abuse controls on sensitive endpoints: sign-in, verification, payouts, cards and checkout.
• Monitoring for errors and suspicious activity.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the NDPC within 72 hours of becoming aware of it, and we will tell you directly where the risk to you is high.

11. Your rights

Under NDPA 2023 you have the right to:

• Be informed: this policy.
• Access a copy of the personal data we hold about you.
• Rectify data that is inaccurate or incomplete.
• Erase data, where we no longer need it or where you withdraw the consent it rested on, subject to the retention obligations in section 9.
• Restrict processing while a dispute about accuracy or lawfulness is resolved.
• Object to processing based on legitimate interest, and to direct marketing at any time.
• Portability: receive the data you gave us in a structured, commonly used, machine-readable format, and have it sent to another controller where technically feasible.
• Withdraw consent at any time, without affecting processing already carried out.
• Not be subject to a solely automated decision with legal or similarly significant effect (see section 6.1).
• Complain: see section 15.

How to exercise them. Email [email protected]. We may need to verify your identity first. We will not hand your financial records to someone who says they are you. We will respond within 30 days, and will tell you if we need longer and why.

There is no charge, unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline it, and will explain why.

12. Cookies and tracking

We and our providers use cookies and similar technologies on our website and web apps for:

• Essential purposes: signing you in, keeping your session, security, load balancing and bot protection (Google reCAPTCHA, Cloudflare). These cannot be switched off. We rely on our legitimate interest in keeping the service secure, not on consent, because a bot filter a visitor can decline is not a bot filter.
• Analytics: understanding how the site and apps are used (Google Tag Manager and Google Analytics, Mixpanel, Zoho PageSense), recognising returning visitors to our marketing website (Swan), and measuring whether our advertising is working (Meta Pixel). In Nigeria these run on our legitimate interest in measuring and improving the product and our advertising, not on your consent, so they are on unless you turn them off. We think this is a fair balance: the data tells us which pages confuse people and which ads reach the people they are meant for, and you can stop it at any time. Outside Nigeria we ask first.

Outside Nigeria, analytics cookies are used only with your consent. Nothing is loaded until you choose it: the tags themselves are withheld, not merely told to hold back. In Nigeria they are on from your first visit, for the reasons given above.

Either way you choose per category. Refusing everything takes one step more than accepting everything: the banner offers Accept All directly, which switches on every category at once, and refusing is the Use Essential Only button behind Preferences, where Accept saves whichever categories you have left switched on. You can change your mind at any time using the Cookie preferences link in our footer. Turning analytics off there is how you exercise your right under s.27 of the NDPA to object to processing based on legitimate interest; we act on it immediately and do not ask you to justify it. Your choice is recorded, with a timestamp, in an rt_consent cookie. If you later withdraw or object to a category, the cookies it set are cleared, along with any identifier it stored in your browser.

You can also block or delete cookies in your browser, though parts of the site may then not work.

13. Marketing

We send marketing only if you have asked for it. Every marketing email has an unsubscribe link and we act on it promptly.

Service messages are different. Payment confirmations, security alerts, statements, verification requests and changes to these terms are part of the service, and you cannot opt out of them while you hold an account.

14. Children

Roofteller is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us personal data, contact [email protected] and we will delete it.

15. Complaints

If you think we have handled your data badly, tell us first: [email protected]. We will acknowledge within 2 business days and respond substantively within 30 days.

If you are not satisfied, you can complain to the Nigeria Data Protection Commission:

• Email: [email protected]
• Website: ndpc.gov.ng

You do not have to come to us first, and complaining to us does not affect your right to complain to the NDPC or to seek a remedy in court.

16. Other websites

Our site and apps link to third-party sites and embed third-party content, including Skydd insurance pages, Calendly booking pages and YouTube videos. Those services have their own privacy notices, and we are not responsible for them.

17. Changes to this policy

We update this policy as the product and the law change. When we do, we change the "last updated" date above. If a change is material, we will tell you by email or in the Platform before it takes effect.

This policy replaces the version dated 28 August 2026.

18. Contact us

Tenalet Ltd, trading as Roofteller. RC 8493617.