Winnni Privacy Policy

How jurisdictions were selected

Winnni lets users track expenses and budgets in multiple currencies. This document treats each currency Winnni supports as a signal of a real user base in that currency’s home country, and maps each one to the data-protection law and regulator that applies there. This is the working basis for the country-specific disclosures in Section 15.

Currency Supported In-App	Country / Region	Applicable Law	Regulator
NGN – Nigerian Naira (primary, free tier)	Nigeria	Nigeria Data Protection Act, 2023 (NDPA)	Nigeria Data Protection Commission (NDPC)
GHS – Ghanaian Cedi	Ghana	Data Protection Act, 2012 (Act 843)	Data Protection Commission
ZAR – South African Rand	South Africa	Protection of Personal Information Act, 2013 (POPIA)	Information Regulator (South Africa)
KES – Kenyan Shilling	Kenya	Data Protection Act, 2019	Office of the Data Protection Commissioner (ODPC)
UGX – Ugandan Shilling	Uganda	Data Protection and Privacy Act, 2019	Personal Data Protection Office (PDPO)
TZS – Tanzanian Shilling	Tanzania	Personal Data Protection Act, 2022	Personal Data Protection Commission (PDPC)
EUR – Euro	European Union / EEA	General Data Protection Regulation (EU) 2016/679 (GDPR)	Local EU Member State supervisory authority
GBP – British Pound	United Kingdom	UK GDPR + Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025	Information Commissioner’s Office (ICO) — being renamed the Information Commission
USD – US Dollar	United States	No single federal law; California Consumer Privacy Act / CPRA where applicable, plus other state privacy laws	California Privacy Protection Agency (CPPA); relevant state Attorneys-General
CAD – Canadian Dollar	Canada	Personal Information Protection and Electronic Documents Act (PIPEDA); Quebec’s Law 25 for Quebec residents	Office of the Privacy Commissioner of Canada (OPC); Commission d’accès à l’information (Quebec)
AUD – Australian Dollar	Australia	Privacy Act 1988 and the Australian Privacy Principles (APPs)	Office of the Australian Information Commissioner (OAIC)
JPY – Japanese Yen	Japan	Act on the Protection of Personal Information (APPI)	Personal Information Protection Commission (PPC)

Note: the in-app currency list also includes a legacy code, French Franc (FRF), which was replaced by the Euro in 1999 and has no current regulatory relevance; EU/EEA coverage under GDPR is treated as the applicable framework for that entry.

1. Introduction

This Privacy Policy explains how Tradexploits (“Tradexploits,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal data in connection with Winnni, our smart expense and budget tracking mobile application (the “App” or “Service”). This Policy applies to anyone who downloads, installs, registers for, or otherwise uses the App (“you” or “user”), regardless of where you are located.

We built Winnni around a simple principle: your financial data belongs to you, we collect only what the App needs to function, and any automatically-suggested category is something you review and approve, not something we decide for you. This Policy is written to reflect that principle accurately, alongside the legal obligations described in Section 15.

2. Who We Are

Winnni is operated by:

Tradexploits; for any privacy question, request, or complaint, you can reach us at: support_winnni@tradexploits.com 

As an early-stage service, Tradexploits has not yet appointed a formal Data Protection Officer or an EU/UK representative, as these are not currently required at our processing scale. The contact above serves as our designated privacy point of contact. We will appoint a formal Data Protection Officer, and an EU/UK representative under Article 27 GDPR/UK GDPR, if and when our processing activity requires it, and will update this Policy accordingly.

3. Definitions

• “Personal data” means any information relating to an identified or identifiable natural person.
• “Processing” means any operation performed on personal data, including collection, storage, use, disclosure, or deletion.
• “Controller” means the entity that determines the purposes and means of processing personal data in most cases, Tradexploits.
• “Processor” means an entity that processes personal data on the controller’s behalf, such as our infrastructure and payment providers described in Section 8.
• “Data subject” or “user” means the individual to whom personal data relates you.

4. Data We Collect

We collect only the categories of data described below, each tied to a real function of the App. We do not collect data “just in case” for future use.

4.1 Account and Profile Data

• Email address and password (used to create and secure your account; your password is never stored in plain text: authentication is handled by Supabase Auth, which stores only a securely hashed credential).
• Full name, as you choose to provide it.
• Profile photo / avatar, if you choose to upload one.
• Your selected display currency and, in the future, your selected display language.
• One-time verification codes sent to confirm your email during sign-up or password reset.

4.2 Financial Data You Enter

• Expense records you create: amount, category, an optional note, and date.
• Budget records you create: amount, category (optional), period, and start date.

This data is self-reported by you. Winnni does not connect to your bank account, does not initiate or process any transfer of funds on your behalf, and does not currently collect income data as a distinct record type (this is a planned future feature; see Section 14).

4.3 Receipt Scanning and Smart Categorisation Data

When you scan a receipt, the photo is processed on your own device using Google ML Kit to extract the text, this step happens on-device and the receipt image itself is not uploaded to or stored on our servers. Only the extracted text is then sent, over a secure connection, to a hosted AI model (Google’s Gemini, accessed through Firebase AI Logic) to suggest a category for each item. Every suggestion is shown to you for review, and only the items you confirm are saved to your account. See Section 7 for more on this automated processing.

4.4 Device, Technical, and Notification Data

• A push-notification token, used solely to deliver budget alerts and reminders you have enabled via Firebase Cloud Messaging.
• Your notification preferences, stored locally on your device.
• Basic technical and security data our infrastructure providers (Supabase and Firebase) collect to operate the Service, including IP address, device/app attestation signals (via Firebase App Check and Google Play Integrity, used to confirm requests come from a genuine, untampered copy of the App), and standard connection logs.

4.5 Premium Subscription and Payment Data

Winnni offers optional Premium subscription features. If you choose to upgrade, payment is processed entirely by Paystack, a licensed third-party payment service provider. Winnni does not directly collect, transmit, or store your card number, bank account details, or other payment credentials. To initiate and identify your subscription, we share your name and email address with Paystack. Paystack independently collects any card or bank details you enter directly within its own secure checkout flow, governed by Paystack’s own privacy policy. Winnni receives back only your subscription status (active/inactive), plan type (monthly/annual), and a transaction reference, never your underlying payment credentials.

4.6 Communications

If you contact us for support, we collect the information you provide in that communication, including your email address and the content of your message, in order to respond to you.

4.7 What We Do Not Currently Collect

To be precise about the boundaries of this Policy, Winnni does not currently collect: bank account credentials or linked account data (Paystack handles any card/bank entry independently – see 4.5), location or GPS data, biometric data, government identification numbers, health data, voice recordings, your verified date of birth, or your country of residence as a discrete profile field. If any future version of the App introduces a feature that requires a new category of data. For example, income tracking, savings goals, open-banking connectivity, an age self-certification step, or an optional country field – we will update this Policy, describe the new data clearly, and where required by law, seek your renewed consent before that collection begins. See Section 14.

5. How We Use Your Data

We use the data described above only to:

• Provide the core functions of the App; recording expenses, calculating budgets, generating alerts and dashboards, and enabling receipt scanning and category suggestions.
• Operate and secure your account, including authentication and fraud prevention.
• Process your Premium subscription payment via Paystack and maintain your subscription status.
• Send you notifications and reminders you have enabled.
• Respond to support requests.
• Maintain, debug, and improve the reliability of the Service.
• Comply with legal obligations, including responding to lawful requests from regulators or courts.

We do not sell your personal data. We do not use your financial data to serve third-party advertising, and Winnni does not currently integrate any advertising SDK.

6. Legal Bases for Processing

Where applicable law requires a lawful basis for processing (including under the GDPR, UK GDPR, and the NDPA), we rely on:

• Performance of a contract: to provide the core features of the App you signed up to use, including your Premium subscription if purchased.
• Consent: for optional features such as push notifications and receipt scanning, which you can withdraw at any time through your device or in-app settings.
• Legitimate interests: for basic security, fraud prevention, and service reliability, balanced against your rights and never overriding them.
• Legal obligation: where we are required to retain or disclose data by law.

7. Automated Processing and AI Disclosure

Winnni includes an optional smart receipt-scanning feature that uses a hosted AI model (Gemini, accessed through Firebase AI Logic) to suggest a spending category for each item detected on a scanned receipt. This is the only automated processing Winnni performs.

This processing does not produce a legal or similarly significant effect concerning you: it never saves data, sets a budget, or takes any action without your explicit review and confirmation on the receipt-review screen. Because a meaningful human decision (yours) sits between every suggestion and any stored record, this processing falls outside the restrictions that apply to solely automated decision-making under Article 22 GDPR/UK GDPR and equivalent provisions of the NDPA. We are nonetheless describing it transparently here, and you may decline to use receipt scanning at any time and enter expenses manually instead.

8. Data Sharing and Third-Party Service Providers

We do not sell or rent your personal data. We share data only with the service providers who help us operate the App, each acting as our data processor and bound to process data only on our instructions:

Provider	Role	Data Involved
Supabase	Authentication, database (PostgreSQL), and file storage	Account credentials, profile data, expense and budget records, avatar images. Protected by row-level security so only you can access your own records.
Google Firebase (Cloud Messaging)	Push notification delivery	Notification/device token
Google Firebase (App Check)	App authenticity verification	Device attestation signal (Play Integrity); no personal content
Google Firebase AI Logic / Google Gemini	Receipt text categorisation	Text extracted from a scanned receipt (not the image itself)
Google ML Kit	On-device text recognition	Processed entirely on your device; nothing is transmitted to us or to Google for this step
Paystack	Premium subscription payment processing	Name and email address, used to identify and process your subscription. Paystack independently collects your payment method details (card/bank) directly within its own checkout; Winnni does not receive or store this information.

Google’s and Paystack’s processing of your data is additionally governed by their own privacy and data-processing terms. We select providers that offer contractual data-protection commitments consistent with the laws described in Section 15.

9. International Data Transfers

Our service providers may process and store data on servers located outside your country of residence. Where we or our providers transfer personal data across borders, we rely on recognised safeguards: including Standard Contractual Clauses, adequacy decisions, or equivalent mechanisms recognised under the applicable law described in Section 15; and, where the NDPA applies, the cross-border transfer conditions set out in that Act.

10. Data Retention

We retain your account and financial data for as long as your account remains active, so that the App can function. If you delete your account through the in-app “Delete account” option, your profile, expense, and budget records are permanently removed from our active database, other than data we are required to retain for a limited period to meet a legal obligation (for example, records relevant to a legal claim, tax obligation, or regulatory request), which we will delete once that obligation no longer applies.

11. Your Rights

Subject to the specific rules of your country’s law (see Section 15), you generally have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data, directly editable in-app for most fields.
• Delete your data; available directly in-app via Settings > Delete account, which performs a full account deletion.
• Export your data; available in-app via PDF and Excel report export.
• Restrict or object to certain processing.
• Cancel your Premium subscription at any time via Settings > Premium > Cancel Premium. Cancellation stops future billing but does not entitle you to a refund for the current billing period, except as required by applicable law or as described in our Terms and Conditions.
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
• Lodge a complaint with your local data protection authority (listed in Section 15).

To exercise a right not directly available in-app, contact us using the details in Section 2.

12. Age Requirement and Children’s Privacy

Winnni is intended for users who are at least 18 years old, or the age of legal majority in their jurisdiction, consistent with the App’s function as a personal financial management and payment-enabled tool. We do not knowingly collect personal data from anyone below that age. If we become aware that we have inadvertently collected such data, we will delete it promptly.

How this is currently enforced: at present, Winnni relies on self-representation, by creating an account, you confirm you meet this age requirement (see Section 3 of the Terms and Conditions). Winnni does not currently ask for or store a date of birth, and no age-verification document or ID check is required.

13. Data Security

We apply the following measures, reflecting how the App is actually built rather than generic claims:

• Authentication through Supabase Auth, with passwords stored as secure hashes, never in plain text.
• Database-level access control (PostgreSQL row-level security) ensures every record is enforced, at the database itself, to be readable and writable only by its owning user.
• Encryption in transit (TLS) for all communication with our backend, and encryption at rest for stored data, managed by Supabase.
• Firebase App Check with Play Integrity, restricting calls to our AI categorisation endpoint to genuine, untampered copies of the App, no AI service key is embedded in the App itself.
• Payment security: card and bank details are handled entirely within Paystack’s own PCI-DSS-compliant checkout; Winnni’s servers never receive or store this information.
• Data minimisation: we collect only the fields described in Section 4.

No system is completely secure, and we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately using the details in Section 2.

14. Changes to This Policy

We will update this Privacy Policy as Winnni evolves. For example, if we introduce income tracking, savings goals, open-banking connections, an age self-certification step, an optional country field, or new AI features. We will post the revised Policy in-app with an updated “Last Updated” date, and for material changes, we will provide notice through the App and, where required by law, seek your renewed consent before the change takes effect. Continued use of the App after a change takes effect constitutes acceptance of the revised Policy, to the extent permitted by applicable law.

15. Regional and Country-Specific Disclosures

This section describes how the general commitments above apply under the specific law of each country where Winnni currently has, or reasonably anticipates, users determined using the currencies Winnni supports (see the jurisdiction mapping table above). Where a right or requirement below is not repeated elsewhere in this Policy, it supplements not replaces the rest of this document.

15.1 Nigeria

Winnni’s primary market is Nigeria. We process personal data in accordance with the Nigeria Data Protection Act, 2023 (NDPA) and the NDPC’s General Application and Implementation Directive, 2025 (GAID), which together replace the earlier Nigeria Data Protection Regulation (NDPR) 2019. The Nigeria Data Protection Commission (NDPC) is our supervisory authority.

• You have the rights described in Section 11, as guaranteed under the NDPA, including access, rectification, erasure, restriction, objection, and data portability.
• As an early-stage service, Tradexploits does not currently meet the NDPA’s threshold for a Data Controller or Processor of Major Importance (DCPMI). We will register with the NDPC and file the required Compliance Audit Return if and when our processing activity reaches that threshold, or as otherwise required by law.
• In the event of a qualifying personal data breach, we will notify the NDPC and affected users without undue delay, and in any event within 72 hours of becoming aware of the breach, where required by the NDPA.
• You may lodge a complaint with the NDPC at [NDPC complaint contact – confirm current details at ndpc.gov.ng before publishing]

15.2 European Union / European Economic Area, and United Kingdom

If you access Winnni from the EU, EEA, or UK, we process your data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and, in the UK, the UK GDPR and Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025 (DUAA).

• Your rights under Section 11 correspond to Articles 15–22 GDPR/UK GDPR.
• You have the right to lodge a complaint with your local EU supervisory authority, or, in the UK, with the Information Commissioner’s Office (ICO), which is being renamed the “Information Commission” under the DUAA.
• The DUAA introduces a new right for UK users to complain directly to us before escalating to the Information Commission; we are implementing an internal complaints process consistent with this requirement.
• We have not appointed an EU or UK representative under Article 27, as our current processing does not meet the threshold that requires one. We will do so if that changes.

15.3 Ghana

We process the data of users in Ghana in accordance with the Data Protection Act, 2012 (Act 843), under the oversight of Ghana’s Data Protection Commission.

15.4 South Africa

We process the data of users in South Africa in accordance with the Protection of Personal Information Act, 2013 (POPIA), under the oversight of the Information Regulator (South Africa). Under POPIA, our processing of your financial data relies on your consent and the necessity of processing to perform our contract with you.

15.5 Kenya

We process the data of users in Kenya in accordance with the Data Protection Act, 2019, under the oversight of the Office of the Data Protection Commissioner (ODPC).

15.6 Uganda

We process the data of users in Uganda in accordance with the Data Protection and Privacy Act, 2019, under the oversight of the Personal Data Protection Office (PDPO).

15.7 Tanzania

We process the data of users in Tanzania in accordance with the Personal Data Protection Act, 2022, under the oversight of the Personal Data Protection Commission (PDPC).

15.8 United States

The United States does not have a single comprehensive federal privacy law. If you are a California resident, you have rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), including the right to know what personal data we collect, to request deletion, and to opt out of the sale or sharing of personal data; which, as stated in Section 5, we do not do. California residents may lodge a complaint with the California Privacy Protection Agency (CPPA). If other US state privacy laws apply to you based on your state of residence, we will honour the applicable rights under those laws on request.

15.9 Canada

We process the data of users in Canada in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA), under the oversight of the Office of the Privacy Commissioner of Canada (OPC). If you are a resident of Quebec, the stricter requirements of Quebec’s Law 25 also apply, and you may lodge a complaint with the Commission d’accès à l’information du Québec (CAI).

15.10 Australia

We process the data of users in Australia in accordance with the Privacy Act 1988 and the Australian Privacy Principles (APPs), under the oversight of the Office of the Australian Information Commissioner (OAIC).

15.11 Japan

We process the data of users in Japan in accordance with the Act on the Protection of Personal Information (APPI), under the oversight of the Personal Information Protection Commission (PPC).

15.12 Other Jurisdictions

If you access Winnni from a country not listed above, we will still process your data in accordance with the general commitments in this Policy, and will honour data-subject rights under your local law to the extent they apply to us, on request to the contact in Section 2.

16. Contact Us

For any question about this Privacy Policy or how we handle your data: support_winnni@tradexploits.com, +234 906 266 0949, +234 703 810 5096