CapFlow IntelligenceLog in

Privacy Policy

CapFlow Intelligence Platform, operated by NationSpace Tech Limited

Effective Date: 1 January 2025Version 1.0Last Reviewed: July 2026

Compliant with the Nigeria Data Protection Act 2023 (NDPA), the General Application and Implementation Directive 2025 (GAID), and the Nigeria Data Protection Regulation 2019 (NDPR) as applicable.

1. Introduction and Identity of the Data Controller

NationSpace Tech Limited is a technology company incorporated in the Federal Republic of Nigeria under the Companies and Allied Matters Act (CAMA). NationSpace Tech Limited operates the CapFlow brand and the CapFlow Intelligence Platform at https://capflowai.com (hereinafter referred to as "CapFlow", "we", "us", or "our"). CapFlow is a trading name and product of NationSpace Tech Limited and is not a separately incorporated entity. NationSpace Tech Limited is the sole Data Controller for all personal data processed through the CapFlow Intelligence Platform and the CapFlow Capital Exchange application.

NationSpace Tech Limited is a Data Controller as defined under the Nigeria Data Protection Act 2023 (NDPA) and the General Application and Implementation Directive 2025 (GAID). In processing the personal data of data subjects, NationSpace Tech Limited assumes all obligations imposed upon Data Controllers under the NDPA, the GAID, and any other applicable data protection legislation.

This Privacy Policy governs the collection, use, storage, sharing, and protection of personal data processed through the CapFlow Intelligence Platform and the CapFlow Capital Exchange application (currently in development, collectively referred to as the "Platform"). It is designed to inform data subjects of their rights, our obligations, and the measures we employ to safeguard personal information.

Data Controller: NationSpace Tech Limited

Registered Address: 36 Aiyetoro Street, Aguda, Lagos, Federal Republic of Nigeria

Email: info@capflowai.com

Website: https://capflowai.com

2. Scope and Application

This Privacy Policy applies to:

  • All registered users of the CapFlow Intelligence Platform, including business owners, sole traders, individual borrowers, and capital partners (lenders and investors).
  • Visitors to our website and any person who contacts us in connection with the Platform.
  • Data subjects whose personal data is processed indirectly through the uploading of bank statements and other financial documents.
  • All markets in which the Platform operates: Nigeria (NG), Ghana (GH), Kenya (KE), the United Kingdom (GB), and the United States (US).

Where data subjects are located in markets outside Nigeria, NationSpace Tech Limited processes their personal data under the applicable laws of those jurisdictions in addition to the NDPA and GAID where relevant. The NDPA has extraterritorial reach; it applies to the processing of personal data of Nigerian citizens or residents regardless of where the processing occurs.

3. Categories of Personal Data Collected

3.1 Identity and Registration Data

  • Full legal name
  • Email address
  • Phone number
  • Role designation (business owner, individual borrower, capital partner)
  • Country and market of operation

3.2 Business and Entity Data

  • Business name and registration details
  • Business type, sector, and branch information
  • Revenue mix declarations (bank, POS, cash percentage breakdowns)

3.3 Financial Data Derived from Bank Statement Processing

This is the most sensitive category of data processed by the Platform. Where a data subject uploads a bank statement (in PDF or CSV format) or connects a bank account via an approved Open Banking provider, the Platform processes:

  • Transaction records, including dates, amounts, descriptions, and transaction types (credit or debit)
  • Running account balances as stated on bank-issued statements
  • Revenue and expenditure patterns, including categorisation of transactions into defined types
  • Derived financial intelligence metrics, including: CapFlow Score, Probability of Default, Liquidity Buffer, Debt Service Coverage Ratio (DSCR), Cash Retention Ratio, Revenue Stability Score, Cashflow Consistency Score, and Forecasted Cash Position

3.4 Open Banking Connectivity Data

  • Bank account identifiers provided by Open Banking providers
  • Account connection status, provider name, and last synchronisation date
  • Current account balance at time of synchronisation

NationSpace Tech Limited does not store raw bank credentials (usernames, passwords, or PINs). Open Banking connectivity is implemented through licensed third-party providers bound by Data Processing Agreements with NationSpace Tech Limited.

3.5 KYC and Identity Verification Data (CapFlow Capital Exchange)

  • Government-issued identification documents (as required by applicable law)
  • Biometric verification data collected and processed by licensed third-party KYC providers
  • Verification status and tier classification

3.6 Technical and Platform Data

  • Internet Protocol (IP) address
  • Browser and device type (where applicable)
  • Session authentication tokens and login timestamps
  • Error logs collected via monitoring services for platform stability and security purposes
  • Two-factor authentication enrolment and verification status

3.7 Payment and Transaction Data (Platform Fees Only)

NationSpace Tech Limited uses Paystack (Nigeria, Ghana, Kenya) and Stripe (United Kingdom, United States) to process subscription and platform fee payments. NationSpace Tech Limited does not store raw payment card information and does not receive, hold, pool, or disburse client money, loan principal, or investment capital at any point. The only financial data processed through payment providers relates to platform fees payable to NationSpace Tech Limited itself.

4. Lawful Basis for Processing

4.1 Consent

Where the processing is not strictly necessary for the performance of a contract, NationSpace Tech Limited obtains the express, informed, and freely given consent of the data subject prior to processing. Data subjects may withdraw consent at any time by contacting info@capflowai.com.

4.2 Contractual Necessity

NationSpace Tech Limited processes identity, registration, and platform interaction data as necessary for the performance of the contract established when a data subject registers for and uses the Platform.

4.3 Legal Obligation

Certain processing is required to comply with applicable law, including anti-money laundering obligations, fraud prevention requirements, regulatory audit obligations, and the requirements of the Nigeria Data Protection Commission (NDPC).

4.4 Legitimate Interests

NationSpace Tech Limited may process technical data for the purposes of platform security, fraud prevention, system monitoring, and service improvement, where such processing does not override the fundamental rights and freedoms of the data subject.

5. Purposes of Processing

  • To verify the identity of registering users and establish user accounts on the Platform
  • To analyse uploaded bank statements and connected account data to derive financial intelligence metrics and credit scores through the CapFlow Scoring Engine
  • To produce a CapFlow Score, Probability of Default rating, recommended advance amount, liquidity analysis, and related financial intelligence outputs
  • To conduct macroeconomic stress-testing (MacroShield) on a business's simulated repayment capacity under country-specific shock scenarios
  • To generate 30-, 60-, and 90-day financial forecasts based on historical transaction data
  • To facilitate the voluntary sharing of a data subject's CapFlow financial profile with capital partners who have been granted access by the data subject
  • To process platform subscription and origination fee payments through licensed payment service providers
  • To send transactional communications relating to account activity, score recalculations, and service notifications
  • To maintain the security, integrity, and availability of the Platform
  • To comply with applicable legal and regulatory obligations
  • To conduct anonymised, aggregated research for the purposes of improving the accuracy and fairness of our financial scoring models

6. Automated Decision-Making and Profiling

The CapFlow Scoring Engine produces financial intelligence outputs through fully automated processing of transaction data. This constitutes automated decision-making and profiling as defined under the NDPA. NationSpace Tech Limited makes the following disclosures in compliance with the NDPA and GAID:

6.1 Nature and Logic of Automated Processing

The CapFlow Scoring Engine applies deterministic financial formulae to categorised transaction data. Components include Revenue Stability Score, Cashflow Consistency Score, Liquidity Buffer Score, Debt Service Coverage Ratio, Operational Health Score, Fraud Safety Score, and Cash Retention Score. These are weighted into a composite CapFlow Score (0–100). A Probability of Default percentage is derived using a calibrated non-linear actuarial formula.

6.2 Right to Human Review

Data subjects have the right to request human review of any automated financial intelligence output. Any data subject who believes that an automated output is inaccurate or does not reflect their real financial circumstances may contact info@capflowai.com. During the review process, the data subject may provide additional context, correct miscategorised transactions, and request score recalculation.

7. Disclosure and Sharing of Personal Data

NationSpace Tech Limited does not sell, rent, or trade personal data. Sharing occurs only in the following circumstances:

7.1 With Capital Partners (Lender-Access Sharing)

A data subject may voluntarily grant a named, registered capital partner access to their CapFlow financial profile. This sharing is initiated exclusively by the data subject, limited to explicitly authorised data, revocable at any time, and logged with a full audit trail accessible to the data subject.

7.2 With Licensed Third-Party Service Providers (Data Processors)

  • Supabase Inc., cloud database and authentication infrastructure (United States)
  • Vercel Inc., application hosting and deployment infrastructure (United States)
  • Mono Technologies, Open Banking data connectivity for Nigerian financial institutions (Nigeria)
  • TrueLayer Limited, Open Banking data connectivity for United Kingdom financial institutions (United Kingdom). Integration is planned for a future UK market launch.
  • Paystack Inc., payment processing for Nigeria, Ghana, and Kenya markets (Nigeria)
  • Stripe Inc., payment processing for United Kingdom and United States markets (United States)
  • Sentry, operated by Functional Software Inc., error monitoring and platform diagnostics (United States)

7.3 With Regulatory and Law Enforcement Authorities

NationSpace Tech Limited may disclose personal data to regulatory bodies, law enforcement agencies, or courts where required by applicable law or a valid legal process.

7.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of NationSpace Tech Limited's business or assets, personal data may be transferred to the successor entity. Data subjects will be notified of any such transfer.

8. Processing of Sensitive Personal Data

The NDPA and GAID impose heightened obligations on the processing of sensitive personal data. Financial data derived from bank statements and biometric data collected for KYC purposes are classified as sensitive personal data. For all such processing, NationSpace Tech Limited relies on explicit consent as the primary lawful basis, implements additional technical safeguards including encryption at rest and in transit, conducts Data Protection Impact Assessments (DPIAs) before initiating high-risk processing activities, and does not process biometric data directly. Such processing is delegated exclusively to licensed third-party providers under appropriate contractual safeguards.

9. Cross-Border Data Transfers

NationSpace Tech Limited transfers personal data outside the Federal Republic of Nigeria to Supabase Inc. (United States), Vercel Inc. (United States), Stripe Inc. (United States), and Sentry (United States). All cross-border transfers are conducted in accordance with Part VIII of the NDPA and the GAID cross-border transfer framework, safeguarded through Data Processing Agreements incorporating standard contractual clauses recognised by the Nigeria Data Protection Commission. Data subjects may request information about the specific safeguards applied by contacting info@capflowai.com.

10. Data Retention

  • Account registration data: Retained for the duration of the account and for seven (7) years following account closure.
  • Bank statement data and derived financial scores: Retained for five (5) years following the last active use of the Platform.
  • Payment transaction records: Retained for a minimum of seven (7) years in accordance with Nigerian financial record-keeping requirements.
  • Error monitoring and technical logs: Retained for ninety (90) days, then permanently deleted.
  • KYC and identity verification data: Retained for a minimum of five (5) years following the last transaction or account activity.
  • Audit logs relating to data access and lender-sharing events: Retained for five (5) years.

At the expiry of the applicable retention period, personal data is securely and permanently deleted or irreversibly anonymised, unless a longer retention period is required by law.

11. Technical and Organisational Security Measures

11.1 Technical Measures

  • Encryption in transit: All data transmitted between users and the Platform is encrypted using Transport Layer Security (TLS).
  • Encryption at rest: All personal data stored in the Platform's database infrastructure is encrypted at rest.
  • Authentication security: User passwords are stored using bcrypt hashing, which is a one-way, non-reversible algorithm. Passwords are never stored in plaintext.
  • Session management: User sessions are managed through cryptographically signed JSON Web Tokens (JWTs) transmitted via HttpOnly cookies, inaccessible to client-side JavaScript.
  • Two-factor authentication (2FA): The Platform offers Time-Based One-Time Password (TOTP) two-factor authentication, compatible with standard authenticator applications.
  • Row-Level Security (RLS): The database layer independently enforces data access controls preventing cross-user data access.
  • API rate limiting: All API endpoints are protected by Postgres-backed rate limiting implemented via atomic database operations.
  • Webhook verification: Payment webhook payloads are verified using HMAC cryptographic signatures (SHA-512 for Paystack, SHA-256 for Stripe) using constant-time comparison algorithms.
  • Error monitoring: All error reports are filtered before transmission to strip sensitive field names including passwords, tokens, account numbers, and national identity identifiers.

11.2 Organisational Measures

  • Access to personal data within NationSpace Tech Limited is restricted to personnel who require access for the performance of their duties.
  • Third-party Data Processors are engaged only under formal Data Processing Agreements.
  • Security configurations and access controls are reviewed and updated on a periodic basis.
  • Data Protection Impact Assessments are conducted prior to the introduction of new high-risk processing activities.

12. Rights of Data Subjects

Under the NDPA and the GAID, data subjects are entitled to the following rights. These rights may be exercised by submitting a written request to info@capflowai.com. NationSpace Tech Limited will respond to all valid requests within thirty (30) days of receipt.

12.1 Right of Access

Data subjects have the right to request confirmation of whether NationSpace Tech Limited processes their personal data and, if so, to receive a copy of that data together with information about the purposes of processing, the categories of data processed, the recipients to whom data has been disclosed, and the applicable retention periods.

12.2 Right to Rectification

Data subjects have the right to request the correction of inaccurate, incomplete, or misleading personal data. In the case of transaction data derived from bank statements, data subjects may use the Platform's built-in transaction review and correction interface to reclassify transactions and trigger a score recalculation.

12.3 Right to Erasure (Right to be Forgotten)

Data subjects may request the deletion of their personal data where the data is no longer necessary for the purpose for which it was collected; consent has been withdrawn and no other lawful basis applies; the data has been unlawfully processed; or deletion is required to comply with a legal obligation.

12.4 Right to Restriction of Processing

Data subjects may request that NationSpace Tech Limited restrict the processing of their personal data where the accuracy of the data is contested, processing is unlawful but the data subject opposes deletion, or the data is no longer required by NationSpace Tech Limited but is needed for legal claims.

12.5 Right to Data Portability

Data subjects have the right to receive a copy of personal data provided to NationSpace Tech Limited in a structured, commonly used, and machine-readable format, and to request its direct transmission to another data controller where technically feasible.

12.6 Right to Object

Data subjects may object to the processing of their personal data where processing is based on legitimate interests or for direct marketing purposes.

12.7 Rights in Relation to Automated Decision-Making

Data subjects have the right to request human review of automated financial intelligence outputs, to contest automated decisions, and to request that decisions not be made solely on the basis of automated processing where those decisions significantly affect them.

12.8 Right to Lodge a Complaint

Data subjects have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) if they believe that the processing of their personal data has violated their rights under the NDPA.

NDPC Website: https://ndpc.gov.ng

NDPC Email: info@ndpc.gov.ng

NDPC Address: Nigeria Data Protection Commission, Abuja, Federal Republic of Nigeria

13. Processing of Children's Personal Data

The CapFlow Intelligence Platform and the CapFlow Capital Exchange application are not directed at individuals below the age of eighteen (18) years. NationSpace Tech Limited does not knowingly collect or process the personal data of persons under the age of eighteen (18). If you believe that personal data of a minor has been submitted to the Platform, please notify us immediately at info@capflowai.com.

14. Cookies and Similar Technologies

The CapFlow Intelligence Platform uses the following cookies:

  • Authentication cookies: HttpOnly, cryptographically signed session tokens used to maintain the authenticated state of a logged-in user. These are essential for the operation of the Platform.
  • Security cookies: Used to implement cross-site request forgery (CSRF) protections and rate-limiting identifiers.

NationSpace Tech Limited does not use advertising cookies, behavioural tracking cookies, or third-party marketing cookies. The Platform does not participate in cross-site tracking or retargeted advertising.

15. Open Banking Data Access and Management

NationSpace Tech Limited currently uses Mono Technologies as a licensed Open Banking provider to enable data subjects in the Nigerian market to connect their bank accounts directly to the Platform. Integration with TrueLayer Limited for United Kingdom financial institutions is planned for a future launch phase. The following terms govern Open Banking data access:

  • Data subjects initiate bank account connections voluntarily and may disconnect at any time through the Platform's Bank Connections settings.
  • NationSpace Tech Limited requests only read-only access to transaction data and account balance information. No payment initiation permissions are requested.
  • Transaction data retrieved via Open Banking is stored on the Platform and used solely for the purposes of generating financial intelligence outputs as described in this Policy.
  • Bank account credentials are never transmitted to or stored by NationSpace Tech Limited. Authentication with the financial institution occurs through the Open Banking provider's own secure infrastructure.
  • Historical transaction data previously retrieved via Open Banking is retained following account disconnection in accordance with the retention periods described in Section 10, for purposes of supporting ongoing score calculations and audit integrity.

Data subjects who have concerns about the data accessed through Open Banking connections may contact us at info@capflowai.com or disconnect their bank connection through the Platform at any time.

16. Data Breach Notification

In the event of a personal data breach, NationSpace Tech Limited will assess the nature, scope, and likely consequences of the breach without undue delay. Where the breach is likely to result in a risk to the rights and freedoms of data subjects, NationSpace Tech Limited will notify the Nigeria Data Protection Commission within seventy-two (72) hours of becoming aware of the breach. Where the breach is likely to result in a high risk, NationSpace Tech Limited will communicate the breach to affected data subjects without undue delay.

17. Data Protection Officer

NationSpace Tech Limited is committed to designating a qualified Data Protection Officer (DPO) in accordance with the NDPA and the GAID. Until a formal DPO appointment is made, all data protection enquiries, rights requests, and complaints should be directed to:

Name: Temitayo Ogunlade

Title: Founder, NationSpace Tech Limited

Email: info@capflowai.com

Address: 36 Aiyetoro Street, Aguda, Lagos, Federal Republic of Nigeria

18. Updates to this Privacy Policy

NationSpace Tech Limited reserves the right to update this Privacy Policy from time to time to reflect changes in applicable law, regulatory guidance, or our data processing activities. Where material changes are made, NationSpace Tech Limited will publish the updated Policy on the Platform with a revised Last Reviewed date, and notify registered data subjects by email or through in-Platform notification.

19. Governing Law and Jurisdiction

This Privacy Policy is governed by and construed in accordance with the laws of the Federal Republic of Nigeria, including the Nigeria Data Protection Act 2023 and the General Application and Implementation Directive 2025. Any dispute arising from or in connection with this Policy shall be subject to the jurisdiction of the courts of the Federal Republic of Nigeria.

For data subjects located in the United Kingdom, this Policy is additionally read in light of the UK GDPR and the Data Protection Act 2018. For data subjects located in the United States, applicable state privacy laws may confer additional rights.

20. How to Contact Us

For any enquiry, request, or complaint relating to this Privacy Policy or the processing of your personal data, please contact:

NationSpace Tech Limited, Data Privacy

Email: info@capflowai.com

Website: https://capflowai.com

Address: 36 Aiyetoro Street, Aguda, Lagos, Federal Republic of Nigeria

We will acknowledge receipt of all requests within five (5) business days and will provide a substantive response within thirty (30) days, or notify you if additional time is required.

NationSpace Tech Limited, CapFlow Intelligence Platform

Privacy Policy v1.0 | Effective 1 January 2025 | Compliant with NDPA 2023 and GAID 2025

Back to CapFlow