Privacy Notice

Cloove AI Technologies Ltd builds software that businesses use to sell, communicate with customers, manage their operations and move money, and that individuals use to manage their own money through conversational products such as Flow.

This notice explains what personal data Cloove collects, why, what Cloove does with it, who it is shared with, how long it is kept, and what rights you have over it. It covers the Cloove website, the Cloove web and mobile applications, the business dashboard, Flow, Cloove's WhatsApp and messaging experiences, Cloove's voice products, and Cloove's APIs.

Cloove AI Technologies Ltd is a company incorporated in Nigeria. It is the data controller for the processing described here, except where section 2 says otherwise. This notice works alongside the Terms of Service.

Cloove is a controller when it decides why and how personal data is processed. That covers the data of people who sign up for Cloove, use the dashboard, contact support, visit the website, or use Flow as an individual.

Cloove is a processor when a business uses Cloove to handle information about its own customers. If a shop uses Cloove to answer its customers on WhatsApp, take orders and keep records, that shop decides what happens to its customers' data. Cloove processes it on the shop's instructions, under a contract. In that situation the shop is the controller, and it is responsible for telling its customers what it does with their information and for having a lawful basis for it.

Identity and contact information

Name, phone number, email address, and where relevant date of birth and photograph. For businesses, the name and role of the people who register and operate the account.

Business information

Business and trading name, category and description, address, registration details, ownership and control information, settlement account details, catalogue and product information, staff accounts and their permissions.

Verification information

Where a product requires it, information collected to verify who you are or who a business is, including identity documents and identity numbers, and the outcome of verification checks. Some verification is carried out by, or for, the licensed financial institution providing an account, and in that case the institution processes it under its own obligations and its own notice.

Financial and transaction information

Records of payments, collections, transfers, settlements, bill payments and refunds initiated or recorded through Cloove: amount, currency, timing, counterparty details as shown to Cloove, reference and narration, account identifiers, status, and the balance information Cloove displays. Cloove does not hold your funds; the account and the underlying transaction record sit with the licensed institution providing the service.

Messaging and conversation data

Where you interact with Cloove or with a business through WhatsApp or another messaging channel: message content and metadata, your messaging identifier and profile name as the platform provides it, timestamps, delivery status, media you send, and the conversation history needed to keep the conversation coherent.

Voice and call data

Call metadata including numbers, direction, duration and outcome. Where a call is recorded, the recording and any transcript generated from it. Calls are recorded only where the business operating the line has enabled recording and where notice is given as required by law. If you do not want to be recorded, say so and end the call.

AI interaction data

The prompts, questions, instructions and content you give to Cloove's AI features, the responses generated, and the context assembled to produce them, including the business data an assistant is permitted to read in order to answer.

Device and technical information

IP address, device and browser type, operating system, device identifiers, language settings, and logs of how you use the product: pages viewed, features used, actions taken and errors encountered.

Support and correspondence

The content of your messages to Cloove support, the channel used, and the record of how the matter was handled.

Information from other sources

From the licensed financial institutions and payment providers Cloove works with, in connection with services you use; from identity verification providers where used; from messaging and telephony platforms, in the form of the metadata those platforms attach; and from publicly available sources where Cloove carries out a risk or verification check.

Cloove does not deliberately collect special category data. Please do not send health, biometric, religious, political or similar sensitive information through Cloove products unless a product specifically asks for it.

Under the Nigeria Data Protection Act 2023, Cloove needs a lawful basis for each purpose. These are Cloove's purposes and the basis for each.

Where Cloove relies on legitimate interests, it has considered whether that interest is overridden by your rights, and you can object as described in section 10. Where Cloove relies on consent, you can withdraw it at any time. Withdrawal does not affect processing that already happened, and it may mean a feature stops working.

Cloove's products are built around AI. That means:

• Content you provide, including messages, documents, business records and voice, may be processed by AI models to generate a response, take an action you asked for, or organise information for you.
• Some of those models are operated by third-party providers on Cloove's behalf, under contracts requiring them to process the data only to deliver the service to Cloove.
• Cloove contracts with those providers on terms that do not permit your content to be used to train their models, and configures its use of them accordingly.
• Cloove does not sell personal data.

• Licensed financial institutions and payment providers, where you use a feature that depends on a regulated financial service. The institution processes that information as a controller in its own right for its own legal purposes.
• Cloud and infrastructure providers, for hosting, storage, databases, logging and backup.
• Messaging platforms and telephony providers, to deliver and receive messages and calls. Where you use WhatsApp to reach Cloove or a business on Cloove, Meta processes your data under its own terms.
• AI model providers, to deliver the features described in section 5.
• Identity verification providers, where used.
• Analytics, communication and support tools, to understand product usage, send service messages and operate support.
• Professional advisers - lawyers, auditors, accountants and insurers - where necessary.
• Authorities, regulators, courts and law enforcement, where Cloove is legally required to disclose, or where disclosure is necessary to establish or defend a legal claim, prevent crime, or protect someone's safety.
• A buyer or successor, in a merger, acquisition, financing or sale of assets, subject to this notice continuing to apply.
• The business you deal with, if you are its customer. Your interactions are visible to them. That is the point of the product.

Cloove does not sell personal data and does not share it for third-party advertising. A current list of the categories of service provider Cloove uses is maintained internally and is available to business customers on request.

Some of Cloove's service providers, including cloud infrastructure, messaging platforms and AI model providers, process data outside Nigeria. Where Cloove transfers personal data outside Nigeria, it does so on a basis permitted by the Nigeria Data Protection Act 2023, which may include an adequacy decision, contractual safeguards in Cloove's agreement with the recipient, your consent, or the transfer being necessary to perform a contract with you. Cloove records where each category of data is processed and on what basis, and reviews it when providers change.

Cloove keeps personal data for as long as it is needed for the purpose it was collected for, then deletes it or renders it non-identifying.

Account and profile data

For the life of the account, then 12 months after closure.

Business and identity verification records

Five years from the end of the relationship, where financial crime record keeping applies.

Transaction records held by Cloove

Five years from the date of the transaction.

Messaging and conversation data

For the life of the account, available to the business that owns the conversation.

Call recordings and transcripts

Twelve months, unless a shorter period is set by the business operating the line or a longer period is needed for a dispute or legal claim.

AI interaction data

Twelve months, unless retained as part of a business record you asked Cloove to keep.

Support correspondence

Three years from the close of the matter.

Technical logs

Twelve months.

Marketing data and preferences

Until you opt out, plus a suppression record kept so Cloove does not contact you again.

Where a legal obligation, an investigation or a legal claim requires a longer period, Cloove keeps the data for that period and no longer. Retention across Cloove is governed by a single internal schedule, which both this notice and the AML / CFT / CPF Policy refer to, so that the two cannot drift apart.

Cloove protects personal data with technical and organisational measures appropriate to the risk: encryption of data in transit, access controls limiting staff access to what a role requires, authentication on user accounts, confirmation steps on sensitive actions such as money movement, separation of environments, logging of access to production systems, and vendor review before engagement. More detail is on the security page.

No system is completely secure. Cloove works to reduce the likelihood and impact of an incident and to respond quickly when one occurs. Cloove has an internal procedure for identifying, containing and assessing personal data breaches. Where a breach is likely to result in a risk to your rights and freedoms, Cloove will notify the Nigeria Data Protection Commission within the period required by law, and will inform affected individuals where the law requires it or where telling you would help you protect yourself.

Cookies. Cloove's website and web applications use cookies and similar technologies to keep you signed in, remember your preferences, keep the service secure and understand how the site is used. Strictly necessary cookies are required for the site to work. Analytics and preference cookies are used with your consent.

Under the Nigeria Data Protection Act 2023 you have the right to:

• Be informed about how your data is used, which is what this notice does.
• Access the personal data Cloove holds about you and receive a copy.
• Correct data that is inaccurate or incomplete.
• Request deletion of data Cloove no longer has a lawful reason to keep.
• Restrict processing while a dispute about accuracy or lawfulness is resolved.
• Object to processing based on legitimate interests, and to direct marketing at any time.
• Receive your data in a portable form, where processing is based on consent or contract and carried out by automated means.
• Withdraw consent where Cloove relies on it.
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects, and to ask for human review.

To exercise a right, write to privacy@clooveai.com. Cloove will ask you to confirm your identity and will respond within one month. If a request is complex, Cloove will tell you and explain why it needs longer.

Some rights are qualified. Cloove may not be able to delete records it is required by law to keep, or to stop processing necessary to meet a legal obligation or defend a legal claim. Where Cloove refuses a request, it will tell you why.

If you are unhappy with how Cloove has handled your data or your request, write to privacy@clooveai.com and Cloove will look at it again. You also have the right to lodge a complaint with the Nigeria Data Protection Commission. Where the matter concerns a financial service provided by a licensed institution through a Cloove product, that institution's own complaints route also applies, and Cloove will tell you how to reach it.

Cloove's products are for adults and for businesses. Cloove does not knowingly collect personal data from anyone under 18. If you believe a child has provided personal data to Cloove, write to privacy@clooveai.com and Cloove will delete it.

Cloove will update this notice as its products and the law develop. The date above will change, and where a change materially affects how your data is used, Cloove will tell you before it takes effect.

Privacy and data protection: privacy@clooveai.com. Compliance: compliance@clooveai.com. General enquiries: chat@clooveai.com.