FastFinAI — Privacy notice
What personal data FastFinAI processes, why, who else sees it, how long it is kept, and the rights you have over it.
Last updated 2 October 2026
This document is a draft awaiting legal review. Passages in square brackets are placeholders that must be completed before it is relied on.
1. Who is responsible for your data
[PEACHBLOSSOMS LEGAL ENTITY NAME] is the data controller for the personal data described here. That means we decide what personal data FastFinAI processes, and why.
| Registered address | [ADDRESS] |
| Company registration number | [RC NUMBER] |
| Data Protection Officer | [NAME], [EMAIL] |
| Privacy contact | [privacy@peachblossoms.ng] |
| NDPC registration | [STATUS / NUMBER] |
2. What FastFinAI does
FastFinAI compares a bank statement against a company's own accounting records and reports the differences between them, so a qualified person can review those differences and decide whether the accounts agree.
To do that it has to read the documents you upload, which contain details of financial transactions.
3. The personal data we process
About people who use FastFinAI:
| Data | Where it comes from |
|---|---|
| Name and email address | Entered when an administrator creates your account |
| Password, stored only as a one-way hash | Chosen by you, or set when you are invited |
| Role and organisation | Set by your administrator |
| A record of your actions, with date and time | Generated as you use the application |
| IP address and browser identification | Sent by your browser with each request |
| Count of failed sign-in attempts | Generated when a sign-in fails |
| Reconciliation sign-offs you give, with your name and email | Recorded when you sign off a reconciliation |
About people named in the documents you upload: bank statements and ledgers routinely name people and organisations who do not use FastFinAI — customers, suppliers, staff receiving payments, and the account holder. From those documents we process whatever they contain, which typically includes names, bank account numbers, transaction descriptions, amounts and dates.
We do not choose what is in these documents and we do not search them for personal data. We process them because they are what has to be reconciled.
If you are named in a document somebody uploaded and you want to know what we hold, contact us. We will normally need to ask the company whose accounts they are in order to find the records, because we hold them as that company's financial records rather than under your name.
4. Why we process it, and our lawful basis
| What we do | Why | Lawful basis |
|---|---|---|
| Run reconciliations on uploaded documents | It is the service | Performance of a contract |
| Keep user accounts and control access | To provide the service securely | Performance of a contract |
| Keep an audit trail of actions taken | So financial work can be traced to a person, a basic accounting control | Legitimate interest, and legal obligation |
| Record failed sign-ins and lock accounts | To stop password guessing | Legitimate interest |
| Keep reconciliation records and sign-offs | They are accounting records | Legal obligation (CAMA 2020, s.374) |
| Send invitations and password resets | So you can reach your account | Performance of a contract |
We do not use your data for advertising, we do not sell it, and we do not profile you.
5. Decisions are made by people, not by the software
FastFinAI uses an AI model to read documents, and fixed arithmetic to compare them. It produces an analysis: what matched, what did not, and what the difference is.
It does not decide whether a set of accounts is reconciled. That conclusion is recorded only when a named person reviews the analysis and signs it off, and the record keeps their name, the time, and the version of the analysis they were looking at. A person may sign off against what the analysis suggests.
We built it this way deliberately. It means you are not subject to a decision made solely by automated processing, which is your right under section 37 of the Nigeria Data Protection Act 2023.
6. Who else sees the data
| Who | What they receive | Where | Why |
|---|---|---|---|
| Google (Gemini API) | The uploaded statement and ledger documents, in pages | United States | To read the text and figures out of them |
| Resend | Your email address and the message text | United States / EU | To deliver invitations and password resets |
| [HOSTING PROVIDER] | Everything the application stores | [LOCATION] | To run the servers and database |
These are the only third parties that receive personal data from FastFinAI. We do not disclose it to anyone else except where the law requires it.
7. Sending data outside Nigeria
Reading your documents requires sending them to Google's Gemini API, which processes them outside Nigeria, and our email provider operates outside Nigeria too.
Sections 41 to 43 of the Nigeria Data Protection Act 2023 permit this only where the recipient is bound by rules giving your data an adequate level of protection, or where another specific condition applies. We rely on the contractual terms those providers are bound by, including their data processing terms.
8. How long we keep it
| Data | Kept for |
|---|---|
| Uploaded bank statements and ledgers | Deleted when the reconciliation finishes, and within 24 hours in any case |
| The reconciliation result and its figures | [6 years, as an accounting record] |
| Generated spreadsheet downloads | 90 days |
| Audit trail | [6 years, as an accounting record] |
| Your user account | While it is in use; erased on request |
| Failed sign-in records | Up to an hour after the last failure |
9. Your rights
Under section 34 of the Nigeria Data Protection Act 2023 you may ask us to:
- confirm whether we hold personal data about you, and give you a copy of it in a commonly used electronic format
- correct it if it is wrong, out of date or incomplete
- erase it
- restrict or object to how we use it
- withdraw consent, where we relied on consent
You may also complain to the Nigeria Data Protection Commission at any time.
If you have a FastFinAI account you can download everything we hold about you from within the application, or ask your administrator to do it for you. Otherwise write to [privacy@peachblossoms.ng]. We will respond within [30 days].
Two kinds of record survive an erasure request, and we would rather say so here than surprise you later. First, the audit trail: entries recording who did what are kept as accounting records, which Nigerian company law requires us to retain, and they are append-only in the database itself, so nobody can alter them, including us. Second, reconciliation sign-offs you gave: your name against a sign-off is a signature on a financial record, and removing it would leave an attestation that nobody made.
Everything else about your account is erased. Your name and email are replaced with a placeholder that cannot receive mail, your password is destroyed, and your sign-in sessions end immediately.
10. How we protect it
- All traffic is encrypted in transit.
- Passwords are stored only as bcrypt hashes and are never recoverable.
- Sign-in sessions use a cookie that page scripts cannot read, and are revoked when you log out, change your password or complete a reset.
- Each user sees only their own organisation's data, enforced on the server.
- What you can reach depends on your role.
- Repeated failed sign-ins lock an account temporarily, whether or not the address is registered.
- Every significant action is written to an append-only audit trail.
- Document passwords are never written to a command line or a log.
No system is perfectly secure. If a breach occurs that is likely to put your rights at risk, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, and we will tell you directly where the risk to you is high.