Privacy Policy

This Privacy Policy explains how Casdero Limited (“Casdero”, “we”, “us”) collects, uses, shares and protects personal information when you use our website, web application and mobile apps (together, the “Service”).

By using the Service you agree to the practices described here. If you do not agree, please do not use the Service. This policy should be read together with our Terms of Service.

Information you give us. When you create an account or use the Service we collect details such as your name, email address, phone number, password (stored in hashed form), and your business and branch details.

Business data. Information you and your team enter or import into the Service — for example products, stock levels, sales, invoices, expenses, customers, suppliers and team members. Where this includes personal information about your customers or staff, you control that data and we process it on your behalf.

Linked bank accounts. If you choose to link a bank account, we use our open-banking partner, Mono, to retrieve account details and transaction history you authorise. We never see or store your online banking login credentials.

Camera. Our apps may request camera access so you can scan barcodes and QR codes. Images are processed on your device to read the code and are not uploaded or stored by us.

AI assistant messages. If you use the in-app assistant, the questions you send and relevant context are processed to generate a response.

Device and usage information. We automatically collect technical information such as IP address, browser or device type, operating system, app version, and logs of how the Service is used, to keep it secure and working properly.

Messages to us. If you contact support, we keep the content of your message and your contact details so we can respond.

We use personal information to:

• Provide, operate and maintain the Service and your account;
• Process sales, invoices, inventory and other records you create;
• Authenticate users and protect against fraud, abuse and security incidents;
• Respond to support requests and send important service notices;
• Understand how the Service is used so we can fix problems and improve it;
• Comply with legal obligations and enforce our Terms.

We process information on the basis of performing our contract with you, our legitimate interests in running a secure and useful service, your consent (for example camera access or bank linking, which you can withdraw at any time), and compliance with law.

We do not sell your personal information, and we do not use your business data for advertising.

We share personal information only in the following circumstances:

• Within your organisation. Data in your workspace is visible to team members you invite, according to the roles and permissions you assign.
• Service providers. Trusted vendors who help us run the Service, such as cloud hosting, email delivery, Mono (bank account linking) and Google (AI assistant). They may only use the information to provide services to us.
• Legal reasons. Where required by law, regulation, legal process or a valid request from a public authority, or to protect the rights, property or safety of Casdero, our users or others.
• Business transfers. In connection with a merger, acquisition or sale of assets, in which case this policy will continue to apply to your information.

We keep personal information for as long as your account is active and as needed to provide the Service. When you delete your account we delete or anonymise your personal information within a reasonable period, unless we must keep certain records longer to meet legal, tax, accounting or dispute-resolution obligations.

You can delete your account yourself at any time. In the mobile app, open Settings and tap Delete account; on the web, open Settings and use Delete account. Either way you confirm with your password, and the account is closed immediately — you are signed out on every device and cannot sign in again.

If you cannot sign in, email support@casdero.com from the address registered to your account with the subject “Delete my account”. We will verify the request and complete it within 30 days.

If you are the owner of an organisation, deleting your account also closes that organisation, and everyone working in it loses access at the same time. Transfer ownership to a colleague first if you want the business to continue. Organisations you only belong to are unaffected. Team members can ask their organisation owner to remove them, or contact us directly.

We do not erase the organisation’s accounting records — sales, invoices, receipts, expenses and stock movements. These belong to the business rather than to you personally, and must be kept for tax and accounting purposes; see Data retention above. Full details are on our account deletion page.

We use industry-standard measures to protect your information, including encryption in transit (HTTPS), encrypted session cookies, hashed passwords and role-based access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your data and will notify you of a breach where required by law.

Depending on where you live, including under the Nigeria Data Protection Act 2023, you may have the right to:

• Access the personal information we hold about you;
• Correct inaccurate or incomplete information;
• Request deletion of your information;
• Object to or restrict certain processing;
• Receive a copy of your information in a portable format;
• Withdraw consent where processing is based on consent.

To exercise any of these rights, email support@casdero.com. You also have the right to lodge a complaint with your local data protection authority.

Our service providers may process information in countries other than your own. Where we transfer personal information internationally, we take steps to ensure it remains protected in line with this policy and applicable law.

The Service is designed for businesses and is not intended for anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

We may update this Privacy Policy from time to time. When we make material changes we will update the “Last updated” date above and, where appropriate, notify you by email or in the app. Continuing to use the Service after changes take effect means you accept the updated policy.

If you have questions about this policy or how we handle your information, email us at support@casdero.com or use our contact page.