How we handle your data.

Novorit (“Novorit”, “we”, “us”) operates the approval, procurement, and records platform available at novorit.com and app.novorit.com. This policy explains how we handle personal data in that service and on this marketing website.

For privacy questions, contact our privacy enquiry form.

Account information. Name, work email, organisation, role, optional profile details, and any identity attributes your employer passes through SSO or SCIM.

Content you create. Payment vouchers, purchase orders, attachments, approval comments, signatures, audit-trail events, and any other material you submit while using the platform.

Usage and device data. IP address, user-agent, timestamps, and pages or actions accessed — recorded primarily to power the tamper-evident audit trail and to secure the service.

Support correspondence. Messages, phone numbers (if shared), and any information you voluntarily include when contacting us.

Free-trial record. When an organisation starts a free trial, we keep a one-way scrambled code derived from the billing email address the trial was started with — never the address itself — together with the date and which organisation started the trial. If that organisation later replaces its billing email address, the same kind of code is kept for the address it replaced. The code cannot be turned back into an email address; it only lets us check whether an address we are given has already been used for a free trial. See How long we keep it.

Marketing-site analytics. We do not run third-party analytics on this website, and we do not place advertising cookies.

We process personal data only where we have a lawful basis to do so:

• Contract. To provide the Novorit service to your organisation — authenticating users, routing approvals, generating documents, maintaining audit records.
• Legitimate interest. To secure the service, prevent abuse and financial crime, verify counterparty and payment details, monitor operational health, improve the product, maintain business records, and produce aggregated and de-identified statistics — including corroborating vendor and payee details across organisations, in a form that does not identify any customer or individual.
• Legal obligation. To meet tax, accounting, anti-fraud, and other regulatory duties.
• Consent. For optional marketing communications, where we ask first and you can withdraw at any time.

We do not sell personal data. We share it only in the following, narrowly defined cases:

• Within your organisation. Approval workflows route documents and events to other users in your tenant according to roles you configure.
• With sub-processors. Infrastructure and operational providers we engage to run the service. See the list under “Sub-processors” below.
• To comply with law. Where a valid legal process compels disclosure. We challenge over-broad requests and notify affected customers where law permits.
• In a corporate transaction. If Novorit is involved in a merger, acquisition, or asset sale, data may transfer under equivalent privacy commitments.
• As de-identified, aggregated information. We corroborate supplier, vendor, and payee details across organisations using de-identified information that carries no identifier of you, your organisation, or any individual, and no stored link back to either. Counterparty identities are represented by one-way fingerprints that cannot be reversed, and a fact is only surfaced once several unrelated organisations independently corroborate it. We never disclose which organisation contributed a fact, and we do not sell this information. See The Verification Network below for detail and how to opt out.

Payment fraud in Nigeria frequently follows a pattern that is invisible inside a single organisation: a supplier’s bank details change shortly before a large payment. One organisation sees an unremarkable edit. Several organisations seeing the same change to the same supplier in the same period see a warning.

The Verification Network lets Novorit surface that warning without any organisation disclosing anything about itself or its records. It works as follows:

• What is contributed. Verification facts only — for example, that a bank account has been independently confirmed to belong to a named supplier. Never document content, attachments, amounts, names, comments, or free text.
• How identities are handled. A supplier’s account number is converted to a one-way cryptographic fingerprint before it leaves your tenant. The fingerprint cannot be reversed, and no reverse map exists. It is derived on a separate cryptographic path from the identifiers used inside your tenant, so the two cannot be correlated.
• No link to you. Contributed facts are stored without any identifier of your organisation. There is no stored path from a fact back to the organisation that contributed it.
• Separation. The network store is reached over a separate, restricted database login that has no access to operational tables, and operational systems have no access to it.
• Corroboration threshold. A fact is never surfaced until a minimum number of unrelated organisations independently corroborate it.
• Participation. On by default, because the protection depends on participation. Opt out at any time from your organisation’s settings, or by writing to us. Opting out stops future contributions within 30 days and also stops you receiving network signals; facts already contributed carry no link to you and therefore cannot be located or removed. Fraud detection inside your own organisation is unaffected either way.

We engage trusted infrastructure providers to operate the platform, and limit each to the data it needs to perform its function. The categories of provider we rely on today are:

• Managed PostgreSQL for application data — United Kingdom (London).
• Application hosting and compute — United Kingdom (London).
• Content delivery network — Global edge.
• Object storage for document attachments — European Union.
• Encrypted off-site backups with an independent provider — European Union.
• Running the nightly backup job — United States. The data is handled briefly, in memory, before it is encrypted, and is not kept.
• Managed Redis for session state and rate-limiting — United Kingdom (London).
• Background job processing — United States.
• Transactional email delivery — United States.
• WhatsApp and SMS notification delivery — Africa / international. WhatsApp is the primary real-time approval channel; recipient phone numbers and approval details are processed by this provider.
• Payment processing, where enabled, for plan checkout and subscription billing — Africa / international.
• AI / large-language-model processing, where enabled — United States / European Union. When you turn on optional AI features (such as receipt and document extraction), the relevant document content is processed by a language model through a model gateway configured for zero data retention.
• Error and performance monitoring — European Union.

The specific named providers in each category are shared with prospective customers through our privacy enquiry form, typically alongside a Data Processing Agreement.

Primary application data is stored in the United Kingdom (London) on a managed PostgreSQL service. Document attachments are stored in encrypted object storage in the European Union. Every night a full copy of the data is encrypted with a key we hold offline and stored with an independent provider in the European Union, locked against deletion: daily copies are kept for 30 days and monthly copies for 12 months.

If your data must stay in a specific country or region, talk to us and we will tell you plainly what we can support today.

Account data. Retained while your organisation is an Novorit customer, plus a short grace period for reactivation, then deleted or anonymised.

Content & documents. Retained per your plan’s retention policy. Your administrator can export documents at any time, and delete them subject to statutory minimum-retention obligations — financial records such as processed vouchers and purchase orders are held for the minimum period Nigerian law (the Nigeria Data Protection Act 2023 and CAMA) requires, and for the duration of any active legal hold, before deletion.

Audit logs. Retained permanently for the lifetime of the tenant. Because the log is the compliance record of who did what, it is never purged while the account is active.

Support emails and marketing enquiries. Retained for the period needed to respond and for reasonable record-keeping.

Free-trial record. Kept indefinitely, so that each email address can start only one free trial. It is not deleted when the organisation’s account is deleted (only its link to that organisation is removed), and it is not deleted when you ask us to erase your personal data. We keep it on the basis of our legitimate interest in preventing fraud and abuse of the free trial (GDPR Article 6(1)(f), read with Recital 47, and the legitimate-interest basis in section 25 of the Nigeria Data Protection Act 2023). It holds only the scrambled code described under What we collect, the date it was recorded, and — until that account is deleted — which organisation started the trial.

De-identified and aggregated information. Retained indefinitely. It contains no personal data and no identifier of any customer, so it is not deleted when an account closes and cannot be deleted on request — it cannot be traced to any customer or individual.

If you are in a jurisdiction with statutory data-protection rights (EU/EEA under GDPR, Nigeria under the Nigeria Data Protection Act 2023, California under CCPA, United Kingdom under UK GDPR, and others), you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion, subject to legal and contractual retention obligations and to the free-trial record described under How long we keep it.
• Receive a portable copy of your data.
• Object to or restrict certain processing.
• Withdraw consent where consent is the lawful basis.
• Lodge a complaint with your local supervisory authority.

Where Novorit processes your data on behalf of your employer (most features of the platform), we will forward your request to the relevant administrator and assist with its fulfilment. For direct requests, email our privacy enquiry form.

Security is a structural feature of the platform, not a bolt-on. The full stack — tenant isolation, role-based authority, session integrity, audit trail, access lifecycle, encryption — is documented at /product/security.

No system is perfectly secure; we operate a responsible-disclosure programme and welcome good-faith reports through our responsible-disclosure form.

Novorit is a business platform. It is not directed at children under 16 and we do not knowingly collect their personal data. If you believe a child has provided data to us, contact us and we will delete it.

We may update this policy as our service evolves or laws change. Material changes will be communicated to account administrators and noted on this page with a new effective date. Continuing to use Novorit after a change constitutes acceptance of the updated policy.

For any question about this policy, or to exercise a right listed above, write to our privacy enquiry form. We respond within one business day for enterprise customers and otherwise within a reasonable time not exceeding the statutory deadline applicable to your jurisdiction.