Privacy Policy

Account Information

When you register, we collect your full name, email address, phone number, and a hashed password. If you sign up via Google or Facebook OAuth, we receive the name and email associated with that account.

Vault Records

You voluntarily submit records documenting your financial and physical assets (e.g. bank account details, crypto wallet addresses, pension references, property information) into your encrypted vault. This data is stored in encrypted form and is never transmitted to third parties except as described under “Data Sharing” below.

Trusted Contact Information

When you designate a trusted contact, we collect their name, email address, phone number, and relationship to you. We use this to facilitate the release workflow on your behalf.

Usage Data

We automatically collect data about how you interact with the platform, including pages visited, features used, timestamps, and login/account activity. This data is used to operate the inactivity monitoring system and to improve the Service.

Device & Technical Data

We collect IP addresses, browser type, operating system, and device identifiers for security monitoring, fraud prevention, and audit logging.

We use your information to:

• Provide the Service - create and manage your account, encrypt and store vault records, and facilitate the trusted contact release workflow.
• Inactivity monitoring - track account activity and send warning notifications based on your configured settings.
• Communications - send transactional emails (account verification, password resets, inactivity warning alerts, release notifications) and, where you opt in, product updates.
• Security & fraud prevention - detect suspicious activity, protect against unauthorised access, and maintain audit logs.
• Analytics & improvement - understand how users interact with the platform to improve features and performance (using aggregated, de-identified data).
• Legal compliance - comply with applicable laws and respond to lawful requests from competent authorities.

We apply industry-standard technical and organisational measures to protect your data:

• Encryption at rest: All vault records and sensitive fields are encrypted using AES-256. Encryption keys are managed and rotated securely, separately from the encrypted data itself.
• Encryption in transit: All data exchanged between your browser/app and our servers is protected by TLS 1.3.
• Access controls: Access to production systems is restricted to authorised personnel via multi-factor authentication. Anchora staff cannot read the plaintext contents of your vault.
• Audit logging: All significant actions within the platform are logged and retained for security review.

No system is completely impenetrable. In the event of a data breach that affects your personal data, we will notify you in accordance with applicable law.

Anchora does not sell, rent, or trade your personal data. We share data only in the following limited circumstances:

• Your trusted contact: Upon a confirmed inactivity-triggered release, we guide your designated trusted contact through discovery of the relevant vault records as part of the workflow.
• Service providers: We use trusted third-party providers (e.g. AWS for cloud infrastructure, email delivery services) who process data solely on our instructions and are bound by data protection agreements.
• Legal obligations: We may disclose data where required by law, court order, or to protect the rights and safety of Anchora, its users, or the public.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will provide notice before your data is transferred and becomes subject to a different privacy policy.

We retain your personal data for as long as your account is active or as needed to provide the Service. Specifically:

• Account and vault data is retained for the duration of your account plus 2 years following account deletion, to support dispute resolution and legal obligations.
• Audit logs are retained for a minimum of 3 years.
• Anonymised and aggregated analytics data may be retained indefinitely.

You may request deletion of your account and associated data at any time (see “Your Rights” below), subject to our retention obligations.

Under the NDPR and applicable law, you have the following rights in relation to your personal data:

• Right of access: Request a copy of the personal data we hold about you.
• Right of rectification: Request correction of inaccurate or incomplete data.
• Right of erasure: Request deletion of your personal data, subject to our legal retention obligations.
• Right to data portability: Request your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at privacy@anchora.com.ng. We will respond within 30 days.

Anchora uses the following types of cookies and similar technologies:

• Strictly necessary cookies: Required for authentication and session management. Cannot be disabled.
• Analytics cookies: Used to understand aggregate usage patterns. You may opt out via your browser settings or our cookie preference centre.

We do not use advertising or tracking cookies, and we do not share cookie data with advertising networks.

The Service is intended for users who are 18 years of age or older. We do not knowingly collect personal data from individuals under 18. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or via a prominent notice on our website at least 14 days before they take effect. The “Effective date” at the top of this page indicates when the current version was last revised.

For questions, requests, or complaints regarding this Privacy Policy or our data practices, please contact our Data Protection Officer:

If you are unsatisfied with our response, you may lodge a complaint with the Nigeria Data Protection Bureau (NDPB) at ndpb.gov.ng.