Who we are
Creole AI Labs runs Fiscus. This page explains what we collect and why — in plain words.
Fiscus ("Fiscus", "we", "us", "our") is a tax-compliance and financial-record product operated by Creole AI Labs ("Creole AI Labs"), based in Nigeria. You can reach us at the contact details in Section 12.
For the purposes of the Nigeria Data Protection Act, 2023 (NDPA) and the regulations of the Nigeria Data Protection Commission (NDPC), Creole AI Labs is the data controller of the personal data described in this policy.
This policy explains what personal data we collect, why, how we use and protect it, who we share it with, how long we keep it, and the rights you have over it.
The data we collect
your account details, the bank statements you choose to upload, and how you use the app — nothing we don't need.
a. Account & identity data
- Your name, email address, and phone number.
- Authentication data — a password (stored only as a secure hash) and, if you enable it, your authenticator/2-factor setup.
- Business details you provide during onboarding — business name, CAC registration number, sector, and your Tax ID.
b. Financial data you upload
- Bank statements (PDF, CSV, Excel or image) that you choose to upload, and the transaction data we extract from them.
- Receipts and supporting documents you attach to substantiate expenses.
- The tax figures, books, and returns we compute from that data.
- We only ever read the statements you give us. We are non-custodial: we never connect to your bank, never see your banking password, and cannot move money.
c. Payment data
- When you subscribe, payment is processed by our payment partner (Flutterwave). We never see or store your full card details.
d. Usage & technical data
- Anonymous product analytics (which pages are used, in aggregate) — anonymous and PII-free by design, with no session recording.
- Standard technical data (IP address, device/browser type) and security logs needed to operate the service safely.
Why we use your data
to run your account and work out your tax. Under the NDPA we always have a lawful reason for each use.
| What we do | Lawful basis (NDPA) |
|---|---|
| Create and secure your account | Performance of a contract |
| Read your statements and compute your tax figures, books and returns | Performance of a contract; your consent |
| Process your subscription payment | Performance of a contract |
| Send you account, security and deadline notifications | Performance of a contract; legitimate interest |
| Aggregate, anonymous analytics to improve the product | Legitimate interest |
| Keep tamper-evident audit and financial records | Legal obligation; legitimate interest |
We do not make automated decisions that produce legal effects on you without your involvement. Fiscus computes an estimate and presents it with its basis; you review and file it yourself.
Automated processing and AI
most statements are read on our own machines. Scanned ones may use outside AI — but AI never decides your tax figure.
- Most statements are read deterministically, on our own infrastructure, with no AI and no data leaving our systems.
- For scanned or image-based statements, and some categorisation, we use third-party AI inference providers to extract and classify the data (see Section 6). That content is sent solely to perform the extraction and return the result — not used to train their models under our agreements, and not retained by them beyond processing.
- AI never composes your final tax figure. The number is produced by our deterministic tax engine, cited to the specific section of the law, and always shown to you as an estimate to review.
Cookies and analytics
just what keeps you logged in and safe. No ad tracking, no session recording, no snooping on what you type.
We use a minimal set of cookies necessary to keep you logged in and to keep the service secure. For product analytics we use a privacy-first configuration that is anonymous, does not record your session, and does not automatically capture your inputs or personal data. We do not use advertising or cross-site tracking cookies.
Who we share data with
only the partners who help run Fiscus — payments, AI, hosting. We never sell your data.
We share data only with service providers who help us run Fiscus, under agreements that require them to protect it and use it only on our instructions:
- Payments: Flutterwave — to process subscription payments.
- AI inference: DeepInfra (primary) and Novita (failover) — to extract/classify data from scanned statements. Located outside Nigeria (see Section 8).
- Hosting & storage: our servers and encrypted object storage (including Cloudflare and our VPS host).
- Email: our email-delivery provider, to send one-time codes and notifications.
We do not sell your personal data, and we do not share it with third parties for their own marketing. We may disclose data if required by law or a valid order of a competent Nigerian authority, limited to what is legally required.
How we protect your data
encrypted with a key that's yours alone, every action logged, and any breach reported within 72 hours.
- Your records are encrypted at rest with a key scoped to your organisation — one tenant's data cannot be read with another's key.
- All data in transit is encrypted with TLS.
- Every privileged action (login, data access, admin change, filing) is written to a tamper-evident, hash-chained audit log.
- Access to production data is restricted, logged, and least-privilege.
- We report data breaches to the NDPC within 72 hours and to affected users where the risk to them is high.
No system is perfectly secure, but we take the protection of your financial data seriously and design for it.
Cross-border transfers
some of our AI runs outside Nigeria; we only send your data abroad where the NDPA allows it.
Some of our processors (notably our AI inference and some infrastructure providers) are located outside Nigeria. Where your data is transferred abroad, we do so only where the transfer is permitted under the NDPA — for example, on the basis of your consent, because it is necessary to perform our contract with you, or because the recipient is subject to adequate protection or contractual safeguards.
How long we keep your data
financial records for six years (the tax rule), then destroyed. You can ask us to delete yours anytime.
- Financial records (statements, receipts, computed books and returns): kept for six (6) years from the end of the relevant tax year, in line with Nigerian tax record-keeping requirements, then securely destroyed.
- Account data: kept while your account is active. If you close it, we delete or anonymise your personal data except where a legal obligation requires us to keep it.
- Security and audit logs: kept for as long as needed for security and legal integrity.
- You can ask us to delete specific data or your whole account at any time (Section 10); where a legal retention period applies, we will tell you and honour the request as soon as it allows.
Your rights
you can see, fix, download, or delete your data, and complain to the NDPC. Just email us.
Under the NDPA you have the right to:
- Access the personal data we hold about you;
- Rectify inaccurate or incomplete data;
- Erase your data ("right to be forgotten"), subject to legal retention limits;
- Restrict or object to certain processing;
- Data portability — receive your data in a usable format;
- Withdraw consent at any time, without affecting processing done before you withdrew;
- Lodge a complaint with the Nigeria Data Protection Commission (NDPC).
To exercise any of these, contact us at home@fiscus.ng. We may need to verify your identity first, to protect your data.
Children
Fiscus isn't for under-18s, and we don't knowingly collect their data.
Fiscus is not intended for anyone under 18. We do not knowingly collect data from children.
Data Protection contact
questions or requests about your data? Email home@fiscus.ng.
- Email: home@fiscus.ng
- Data protection: If and when Fiscus becomes a "data controller of major importance" under the NDPA, we will designate a Data Protection Officer and register with the Nigeria Data Protection Commission within the required period. Until then, please direct all data-protection queries to the email above.
Changes to this policy
if we change this, we'll update the date and, for anything material, tell you.
We may update this policy as Fiscus evolves or the law changes. When we make a material change we will update the version and date above and, where appropriate, notify you. Your continued use of Fiscus after an update means you accept the revised policy.