Supabase
Database, authentication & storage. Hosts your records and documents. Data region: EU (London).
Trust Centre
Trust, in the open.
One place for the things you should be able to check before you trust us with your financial life: our policies, the companies that help us run MiTax, how we protect your data, and who to contact. No badges we haven’t earned.
- Built to the NDPA 2023
- Strictly non-custodial
- Encrypted in transit & at rest
- Server-authoritative
Policies
The documents that govern how we handle your data.
Plain-language where we can manage it, complete where the law needs it to be.
Privacy Policy
What we collect, why, how long we keep it, and your rights.
NDPA Compliance Statement
Our obligations under the Nigeria Data Protection Act 2023.
Security
The six core controls we build into the product.
Cookie Policy
What we set, and the consent controls you get.
Terms of Service
The agreement between you and Worllet Ltd.
Complaints
How to raise a concern, and how to escalate to the NDPC.
Sub-processors
The companies that help us run MiTax.
To deliver the service we rely on a small set of vetted providers. Some are always in use; others are engaged only when you use the related feature. This reflects the providers integrated into MiTax; we maintain the authoritative register internally and update this page when it changes.
Always in use
Cloudflare
Delivery & protection. CDN, DNS and edge security in front of the platform. Global edge.
Sentry
Error & performance monitoring. Diagnostic and device data to keep the app reliable. US / EU.
Engaged when you use a feature
Paystack & Flutterwave
Payments. Licensed payment providers that move your tax payment and the MiTax fee — when you make a payment. Nigeria.
Identity verification provider
KYC / CDD. Confirms your identity (Tax ID, NIN, RC) when you verify, to meet anti-money-laundering rules. Nigeria.
Meta (WhatsApp Business)
Messaging. Delivers transactional WhatsApp messages — deadlines, receipts, alerts — when you opt in. Global.
Email delivery provider
Transactional email. Sends receipts, alerts and the copies of your data you request. US.
AI model provider
AI tax assistant. Powers the optional in-app assistant — used only if you turn it on, with the context you give it. US.
Where data leaves Nigeria.
Some providers process data outside Nigeria. Where that happens we rely on the transfer conditions permitted under the NDPA and put appropriate safeguards in place. You can ask us about any specific provider at privacy@mitax.io.
Security posture
Security built into the product, not bolted on.
256-bit TLS in transit, AES-256 at rest, database-enforced row-level access, server-authoritative tax math, a full audit trail, and a strictly non-custodial money flow.
The six core controls.
Each control is documented and enforced in the product. Read the detail on our Security page. On certifications, we are honest: we build to the NDPA 2023 and GAID 2025, and we do not currently claim ISO 27001 or SOC 2 certification. If we obtain one, it will be listed here.
Data protection
Our NDPA data-protection programme.
As a financial-services platform we treat ourselves as a data controller of major importance under the NDPA, and we run the programme that status requires.
Records of processing
We maintain a record of every purpose we process data for, its lawful basis and its retention — visible to you in the app’s Privacy Centre.
Impact assessments
We run Data Protection Impact Assessments for high-risk processing, and submit them where the NDPA requires.
Retention & erasure
We keep data only as long as needed, except where tax law compels us to retain it. You can request export or erasure at any time.
Your rights
Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent — exercised in-app or by email.
Breach response
If a breach is likely to put your rights at risk we notify the NDPC within 72 hours and affected users without undue delay.
Escalation to the NDPC
If we don’t resolve your concern you can complain to the Nigeria Data Protection Commission. See our complaints route.
Availability
Uptime & incidents.
Honest about status.
We do not publish a live status page or a headline uptime figure yet — we would rather show you a real one than a number we cannot stand behind. For incidents that affect your filing or payments, we notify affected users directly and post updates. When a public status page is live, it will be linked here.
Security & privacy contact
Questions, or found something? Reach us.
For security disclosures, email our security team — tell us before you tell anyone else. For data-protection and privacy requests, email our privacy team.