Privacy notice

Who we are

Hada is operated by Hada (operator's registered legal name to be confirmed), based in Nigeria. We are the data controller for the information described here. Questions go to [email protected].

This notice covers the Hada app and joinhada.com during the invite-only pilot. A lawyer will review it before the live pilot; the date at the top tells you which version you are reading.

What Hada is, and is not

Hada gives a household or flat one reusable bank account number for a shared expense. The account is a virtual account issued by Squad (HabariPay Limited). Members pay into it from their own bank apps, the group sees who has paid, and the verified organizer withdraws the money to their own verified bank account.

Hada is not a bank. It offers no wallet, cards, loans or savings, and it does not check what the money is spent on. Money paid into the account is received by Squad into Hada's merchant account with them and is paid out only when the organizer asks for a withdrawal (custody and settlement terms to be confirmed with Squad).

Information we collect

What we collect depends on your role in a group.

• Organizers: your phone number; first, middle and last name; date of birth; gender; address; contact email; the mobile number registered to your BVN; your BVN (see the next section); your consent record; the verification reference and status returned by Squad; and the bank account you nominate for withdrawals.
• Members: your phone number, first and last name, date of birth and email address, given when you set up your profile, plus the groups you belong to.
• Payers without a Hada account: the details Squad returns with each transfer into a group's account, such as the sender name your bank shares, the amount, the time and the bank reference. Organizers use these to match a payment to a member.
• Everyone: device and app information (model, operating system, app version), sign-in and session records, push notification tokens, error reports and product analytics.

We do not collect your bank login, card numbers or PINs, and we never ask for them.

Your BVN

Organizers enter their Bank Verification Number once, during verification. We send it over an encrypted connection to Squad so they can verify your identity as their rules require. We do not store your BVN in Hada, in logs, in analytics or in support tools.

We keep the verification reference and status that Squad returns, and a record that you consented. If verification has to be repeated, we ask for your BVN again rather than keep a copy.

How we use your information

• To run the service: sign you in, show your groups, record receipts and let the organizer withdraw.
• To verify organizers, because the account provider requires it before an account number can be issued.
• To send you sign-in codes by SMS through Flutterwave, invitations and support replies by email through Resend, and push notifications about payments and group activity.
• To keep the pilot safe: rate limits, fraud and abuse checks, daily reconciliation of receipts against the provider's records, and audit records of who changed what.
• To fix problems, using error reports and product analytics that never include your BVN, sign-in codes or bank details.
• To meet legal obligations, including record-keeping for payments.

We do not sell your information and we do not use it for advertising.

What a shared link shows

An organizer can create a shared link for their group's collection and send it to members or anyone else. Anyone who has the link can open the page; it is not protected by a login. The page shows:

• The group's bank name, account number and account name as approved by Squad.
• The collection title, the target, how much has been collected and how much is left.
• Each participant's display name or initials, as the organizer wrote them, and whether they have paid, part-paid or overpaid.
• The total of receipts not yet matched to a member.
• A summary of provider charges and withdrawals.

It never shows phone numbers, email addresses, BVNs, the bank details of people who paid, the organizer's withdrawal account or any internal notes.

The organizer can revoke or replace the link in the app at any time. A revoked link stops working straight away. Copies, screenshots or prints made before that cannot be recalled, so organizers should share the link only with people who should see it.

Who we share information with

We share information only with the providers needed to run Hada, and only what each one needs:

• Squad (HabariPay Limited) issues the group's virtual account, verifies organizers, notifies Hada of inflows and settles the money paid in (the withdrawal route is to be confirmed with Squad).
• Flutterwave delivers the SMS codes used to sign in.
• Resend delivers invitation and support emails.
• Sentry collects error reports from the app and servers.
• PostHog collects product analytics about how the app is used.
• Infrastructure providers that host our servers and database. Hosting region and data location: to be confirmed with the deployment set-up (MVP-16).

We may also share information when the law requires it, or to investigate fraud, a wrong transfer or misuse of a shared link.

How long we keep information

• Your BVN: never stored.
• Sign-in codes: deleted when they expire, a few minutes after they are sent.
• Account and profile information: for as long as your account is active, then deleted or anonymised within a period to be set in legal review.
• Receipts, member assignments, withdrawal records and audit records: kept after a group closes for the period payment record-keeping rules require (to be set in legal review), because they are the evidence of who paid what.
• Error reports and diagnostic logs: 30 to 90 days.
• Product analytics: retention period to be set in legal review.

You can ask us to delete your account and information at [email protected]. We delete what we can and tell you what we have to keep and why.

How we protect information

• Connections between the app, our servers and our providers are encrypted.
• Your BVN, sign-in codes and provider secrets are kept out of logs, error reports, analytics and support exports.
• Test and live systems use separate credentials.
• A new device gets limited access to a verified organizer's account until support confirms it is really you.
• Only named operators can open the operator view, and their actions are recorded.

Your choices and rights

You can ask us what information we hold about you, ask us to correct or delete it, or withdraw from the pilot. Organizers can revoke shared links themselves in the app.

You have rights under the Nigeria Data Protection Act 2023 (to be confirmed by legal review), including the right to complain to the Nigeria Data Protection Commission. Write to [email protected] first and we reply within one working day.

Changes to this notice

We update this notice as the pilot changes and before the live pilot starts; the date at the top changes when we do. If a change affects how we handle your BVN or what a shared link shows, we tell organizers in the app before it takes effect.

Contact

Hada (operator's registered legal name to be confirmed), Nigeria. Email: [email protected].