Legal

Privacy Policy

Effective 2 October 2026 · Applies to beels.xyz, the Beels web app and the Beels mobile app

1. Who we are

Beels (“Beels”, “we”, “us”) is a group and split payments product operated by Ash.africa. We help you run shared contributions (“beels”), collect money automatically through direct debit, and disburse funds to members.

This policy explains what personal data we collect, why we collect it, who we share it with, and the choices you have. It is written to satisfy the Nigeria Data Protection Act 2023 (NDPA) and the app-review requirements of platforms we integrate with, including Meta (WhatsApp).

Contact: [email protected]

2. Data we collect

  • Account information. Name, email address and phone number when you register or are added to a beel.
  • Group and payment records. The beels you create or join, contribution amounts and schedules, deposits, withdrawals, transfer receipts and transaction statuses.
  • Direct debit mandate details. When you link a bank account for automatic collection, we send your bank account number and bank (and a one-time, encrypted BVN check where the bank requires it) to our payment partner so they can register a debit instruction. The account number, bank and mandate status are stored; your BVN is not stored by Beels.
  • Message and notification data. The phone number and message content needed to deliver notifications to you, including notifications sent through WhatsApp.
  • Optional Gmail connection. If you choose to connect Gmail so Beels can recognise payment emails and summarise your money activity, we receive a read-only email scope limited to that purpose. You can disconnect it at any time and we do not read mail unrelated to payments.
  • AI assistant prompts. Messages you type to the in-app AI assistant, including the money context you ask it about.
  • Support and security data. Records of support conversations and request logs we keep to secure accounts, investigate fraud and honour regulatory obligations.

We do not ask for or store sensitive biometric identifiers, and we never sell your personal data.

3. How we use your data

  • Create and operate your beels, show balances, and let members track contributions.
  • Verify that a bank account belongs to you before linking it.
  • Execute direct debit collections and disbursements you have authorised.
  • Send transactional notifications by email, and by SMS or WhatsApp where you have opted in.
  • Provide the AI assistant and money insights you request.
  • Prevent fraud, investigate disputed transactions, and comply with Nigerian financial and data protection laws.

4. WhatsApp

We use WhatsApp to send you notifications about your beels — contribution reminders, payment confirmations and account actions — and to support you when you message us first.

  • What we process: the phone number you registered with Beels and the content of the messages needed to deliver or answer each notification.
  • Who processes it: delivery happens through WhatsApp, operated by Meta Platforms, Inc. Meta acts as an independent controller under its own privacy policy, which also applies to your use of WhatsApp.
  • Your choices: you can stop WhatsApp notifications at any time by replying STOP in the chat, adjusting your notification settings in the Beels app, or asking us at [email protected]. If you block us on WhatsApp, we stop sending.
  • We do not use WhatsApp message content for advertising, and we never sell it.

5. Who we share data with

We only share the data needed to deliver the service, with these categories of recipients:

  • Payment and banking partners. OnePipe / paywithaccount.com and Nigerian banks through the NIBSS network (account verification, direct debit mandates, collections, disbursements); Flutterwave for hosted payment pages.
  • Notification platforms. Meta (WhatsApp), our email delivery provider and our SMS provider — they process your contact details and message content to deliver notifications to you.
  • AI and tooling providers. Google (Gemini API) processes assistant conversations when you use the AI features; Google (Gmail API) processes the read-only email scope if you connect Gmail.
  • Infrastructure providers. Cloud hosting and storage services that keep the service running.
  • Legal and safety. Regulators, auditors, banks investigating a fraud claim, or competent authorities where the law requires it.

Our partners may process data outside Nigeria; where they do, we rely on the safeguards those providers provide under their own certifications and your legal rights.

6. Retention

  • Account information is kept while your account is active and for as long as needed to honour open transactions or obligations.
  • Transaction and payment records are kept as required by Nigerian financial regulations.
  • A linked mandate is retained until you unlink the account or revoke the mandate; after that its records are kept only for audit.
  • Notification message data is kept only as long as needed to deliver it and resolve disputes.

7. Security

Data is transmitted over encrypted connections. Access to personal data is limited to what each system needs to function, sensitive values (such as bank credentials used for verification) are encrypted in transit to our payment partner, and we monitor the platform for abuse. No method of storage or transmission is perfectly secure, so we also keep a short paper trail of instructions (such as the fact that we never store your BVN) to reduce what could leak in the first place.

8. Your rights

Under the Nigeria Data Protection Act 2023 you can ask us to:

  • Give you a copy of the personal data we hold about you.
  • Correct data that is wrong or out of date.
  • Delete your account and associated personal data, subject to transaction and record-keeping obligations.
  • Stop a use of your data that you object to (such as WhatsApp notifications).
  • Complain to us, or escalate to the Nigeria Data Protection Commission (NDPC).

Send requests to [email protected]. We respond within the timelines the NDPA provides.

9. Children

Beels is a financial product and is intended for people aged 18 and over. We do not knowingly collect data from children; if you believe a child has given us data, contact us and we will delete it.

10. Changes to this policy

We update this policy when the service changes. The effective date at the top always reflects the current version, and material changes will be announced in the app.