Privacy notice

Balans is a product of MOTX Studios, registered in Nigeria at Lagos, Nigeria. For the information described here we are the data controller: we decide what is collected and why.

This notice covers the Balans WhatsApp bot, the invoice and receipt pages we host, our emails and this website. It is written for the people who use Balans to bill clients. Section 7 is for their clients.

It is governed by the Nigeria Data Protection Act 2023. Questions, or anything you would like exercised from section 12, go to privacy@balans.ng.

Only what the service needs to work. Nothing is collected to sell or to profile you.

Your account

Your WhatsApp number and profile name, your business name, your email address and when you verified it, your address and TIN if you add them, your logo if you upload one, your plan, and your referral code.

Your bank details

Your bank, your account number — encrypted at rest, with only the last four digits held in the clear — and the account name your bank returns when we confirm it. We need these to create the Monnify subaccount your money settles into.

Your clients

The name of each client you bill and, if you add them, their email address and phone number. You give us these; we never go looking for them.

Your documents

Quotes, invoices, payment requests and receipts: amounts, line-item descriptions, dates, notes, the PDFs we render, and their status over time.

Payments

Records from Monnify for each payment: amount, currency, reference, status, fee breakdown, the payment method and the last four digits of a card. We never see or store full card numbers, CVVs or bank passwords — those stay on Monnify’s checkout.

Messages

What you send the bot and what it sends back, so a conversation makes sense and so we can show you what happened on your account. Section 8 explains what happens to the text we pass to a language model.

Technical data

IP address, device and browser type, and pages viewed, from our web pages and server logs.

Waitlist

Before launch: your email address, what you bill for if you tell us, which page you signed up from, and any referral code in the link. Used to tell you when Balans opens, and for nothing else.

We do not ask for and do not want sensitive personal data — health, religion, political views, biometrics. Please keep it out of invoice descriptions and notes.

Most of it comes from you, in the chat. The rest comes from:

• Your bank, through Monnify, when we confirm the name on an account number you gave us
• Monnify, when a payment is made, refunded or disputed
• Meta, which passes us your WhatsApp number and profile name with each message you send the bot
• Our email provider, which tells us when an invoice email was delivered and opened
• Your client, when they open an invoice page or pay

Under the Nigeria Data Protection Act we need a lawful basis for each use. These are ours.

Running the service

Creating your account, producing documents, making payment links, telling you when you are paid, sending receipts and reminders. Basis: performance of our contract with you.

Moving money

Creating and maintaining your Monnify sub-account, splitting payments, reconciling them nightly. Basis: performance of our contract with you.

Keeping the service safe

Fraud checks, velocity limits, name checks, screening descriptions for prohibited categories, audit logs, and investigating disputes. Basis: our legitimate interest in preventing fraud, and our legal obligations.

Records and tax

Keeping financial records, responding to lawful requests from regulators, courts or the police. Basis: legal obligation.

Support and improvement

Answering your questions, fixing faults, and measuring in aggregate what works and what does not. Basis: legitimate interest in running and improving a service you use.

Telling you things

Service messages about your account and your documents come with the service. Waitlist emails, and anything promotional, go only to people who asked. Basis: contract for service messages, consent for the rest.

We do not make decisions about you by automated means alone where that decision has a legal or similarly significant effect. Our risk checks flag and hold; a person decides.

We do not sell your data and we do not share it for anyone else’s advertising. We share only what each of these needs to do its job.

Monnify

Your business name, bank account and the details of each payment. Monnify is a separate controller for the payment itself and is regulated by the Central Bank of Nigeria.

Meta Platforms

The WhatsApp messages between you and the bot travel through Meta’s Cloud API. Meta handles them under its own terms.

Our language model provider

The text of a message you send the bot, so it can be turned into structured fields. See section 8.

Our email provider

Your email address and your client’s, to deliver invoices, receipts and reminders.

Hosting and storage

Our servers, database and private object storage, which hold everything above.

Your client

The invoice page shows your business name, the work and the amount. It does not show your bank account, your phone number or your other clients.

Courts, regulators and the police

Where the law requires it, or to establish or defend a legal claim.

A buyer of the business

If Balans is sold or reorganised — including the planned move to Balans Technologies Ltd — under the same protections, and we will tell you.

This matters if you use Balans to bill people. When you give us a client’s name and email, you decide why we hold them and we act on your instructions. In the language of the Act, you are the controller for your clients’ details and we are your processor.

That means:

• You must have a lawful reason to give us your clients’ details, and to send them documents
• We use them only to produce and deliver the documents you ask for, and never for our own purposes
• If a client of yours asks us to delete their details, we will point them to you and help you do it
• We tell you without delay if their details are caught in a breach

If you are one of those clients and you got here from an invoice: the business that invoiced you decides what happens to your details. Ask them first. If you cannot reach them, email privacy@balans.ng and we will help.

Balans uses a language model for one job: turning a sentence like “Invoice Zenith Homes 350k for duplex 3D render, due Friday” into structured fields. It does no arithmetic, decides no fee, and cannot mark anything paid. Our own code computes every amount, and only a verified Monnify event changes a payment status.

The text of your message goes to the model provider. Your bank account number, your verification codes and your payment links do not. We have contractual terms with the provider that your content is not used to train their models.

The message text we keep for this purpose is deleted after 30 days by a job that runs daily. The structured result — the invoice itself — stays as long as section 9 says.

Each kind of record has its own clock.

Message text sent to the model

30 days, then purged.

Documents, payments and receipts

Kept for the period Nigerian law requires financial records to be kept, counted from the end of the relevant financial year. These are your books as much as ours.

Your account and bank details

For as long as your account is open. When you close it, the subaccount is deactivated at once and your personal details are anonymised once the retention period above has run.

Audit and security logs

Kept as long as needed to investigate fraud and to meet our obligations. They never hold full account numbers, codes or tokens.

Expired links and tokens

Purged daily once they can no longer be used.

Waitlist

Until Balans opens and we have told you, or until you ask us to remove you — whichever comes first.

• Account numbers and other secrets are encrypted at rest. Keys are never in our code
• Every inbound webhook is signature-checked. Unsigned requests are rejected
• PDFs and logos are private objects, served through short-lived signed links
• Payment links and magic links come from a cryptographically secure generator, and magic links work once
• Full account numbers, verification codes and tokens are never written to our logs
• Every public endpoint is rate limited
• Staff access to the back office needs two-factor authentication, and every admin action is logged
• Backups run daily, are kept 30 days, and restores are tested

No system is perfect. If a breach puts your rights at risk, we will tell you and the Nigeria Data Protection Commission within the time the Act allows, and we will say plainly what happened and what to do.

Some of the services we rely on — messaging, the language model, email, hosting — process data outside Nigeria. Where that happens we rely on the transfer routes the Act allows, including contractual protections with each provider and, where it applies, an adequacy decision.

You can ask us which providers hold what, and where. Email privacy@balans.ng and we will tell you.

Under the Nigeria Data Protection Act you can ask us to:

• Show you what we hold about you, and why
• Correct anything wrong or out of date
• Delete what we hold, where we are not required to keep it
• Give you a copy of what you gave us, in a form you can take elsewhere
• Stop or limit a use that relies on our legitimate interest, where your situation outweighs it
• Withdraw consent you gave, at any time, without affecting what was done before

Ask in the chat, or email privacy@balans.ng. We answer within 30 days and we do not charge. We will ask you to confirm it is you, through your verified email, before we release or delete anything.

Two limits worth stating plainly. We cannot delete financial records the law requires us to keep, so a deletion request anonymises your personal details and leaves the ledger. And we cannot delete your clients’ details on their behalf without your instruction, because those are yours to control.

If you are unhappy with how we have handled this, tell us first and give us a chance to fix it. You can also complain to the Nigeria Data Protection Commission at ndpc.gov.ng.

This site does not run advertising trackers and does not sell anything about you to an ad network. We use only what a page needs to work — a session cookie on the invoice page, for example — and aggregate counts of page views that do not identify anyone.

Invoice and receipt pages are marked so search engines do not index them. They are reachable only through the unguessable link you send your client.

Monnify’s checkout is Monnify’s own page and sets its own cookies under its own notice.

Balans is for people running a business and is not for anyone under 18. We do not knowingly collect children’s data. If you believe a child has given us details, email privacy@balans.ng and we will remove them.

When something material changes — a new purpose, a new provider, a different retention period — we will tell you in the chat and by email before it takes effect. Smaller corrections are made on this page and the date at the top moves.

Every version has a number. This one is 2026-09-draft-1, last updated 21 September 2026.

MOTX Studios, Lagos, Nigeria.

Privacy and data requests: privacy@balans.ng

Everything else: hello@balans.ng

We are appointing a data protection officer before launch, and their details will appear here. PRD-GAP: confirm whether NDPC registration applies to us at our expected data volume.