Start trial
Menu
Draft for legal review. This document has not been reviewed by a lawyer and is not yet in force.

Privacy policy

Draft dated 11 November 2026.

Who we are

ReckonOS is provided by Digital Elixir Ltd, a company incorporated in Nigeria with the Corporate Affairs Commission (RC 1482355), whose address is Suite A2, Saham Plaza, Alexandria Crescent, Wuse II, Abuja, Nigeria (“ReckonOS”, “we”, “us”).

For anything in this policy, including data protection questions, email [email protected] with “Privacy” in the subject. Our Data Protection Officer can be reached at [email protected].

Two roles

For your own account, your ReckonOS subscription and visits to this website, we decide how the data is used: we are the controller. For the data you put into your workspace about your clients, contractors and projects, we process it on your behalf and on your instructions: we are the processor, and your business is the controller. Our data processing agreement sets out that role, and the sub-processor list names who helps us.

The laws we follow

As a Nigerian company we follow the Nigeria Data Protection Act 2023 (NDPA) and the rules of the Nigeria Data Protection Commission (NDPC). When we handle personal data of people in the European Union or the United Kingdom, we also follow the EU General Data Protection Regulation and the UK GDPR.

What we collect

  • Account data: your name, email address, password (stored only as a hash), role, two-step sign-in settings, when you accepted these terms, and your email preferences.
  • Workspace data: business details and logo, clients, projects, invoices, payments, credit notes, time entries, expenses and receipt images that you or your team add.
  • Contractor tax data: W-9 details you collect from contractors. Full taxpayer IDs are encrypted at rest; only the last four digits are kept readable.
  • Credentials: payment gateway keys and email (SMTP) settings you connect, encrypted at rest and shown only as their last four characters once saved.
  • Subscription data: your plan, billing country, billing history and the references our billing providers give us. We never receive or store card numbers.
  • Security records: sign-in events, the IP address and browser of each sign-in, and an audit log of changes made in your workspace.
  • Usage counts: page views and a few product steps (for example “trial started” or “first invoice sent”), counted with self-hosted, cookieless analytics. These counts carry no name, email, workspace or amount.

This website

reckonos.com sets no cookies. The only thing it stores in your browser is your light or dark theme, and only if you choose one with the switch in the footer. Visits are counted with Umami, which we run on our own server: it uses no cookies, does not store your IP address, and does not count you if your browser sends Do Not Track. See the cookie policy.

Why we use it, and the legal basis

  • To provide the service you signed up for (performance of a contract).
  • To keep accounts and payments secure, including the audit log and sign-in protection (legitimate interests).
  • To bill your subscription and keep tax and accounting records (legal obligation and contract).
  • To send service emails: sign-in and verification links, trial, billing and renewal notices, data export links and deletion notices (contract).
  • To send the weekly digest to workspace admins on plans that include it (legitimate interests). Turn it off in Settings > Notifications or with the one-click unsubscribe link in every digest.
  • To count visits and product steps without identifying anyone, so we can improve sign-up and set-up (legitimate interests).

Who we share it with

Only the service providers on our sub-processor list, each receiving only what it needs. ReckonOS subscriptions and the trial fee are charged in US dollars in every country, including Nigeria. Depending on your billing country and your choice at checkout, the payment is taken by Paddle as merchant of record, by Paystack or Flutterwave, or by our crypto payment processor (NOWPayments or CoinGate), with Digital Elixir Ltd as the seller for payments outside Paddle. We send the provider your billing name, email and billing country, and the provider handles the payment details you give it under its own privacy policy. ReckonOS’s own emails (sign-in and verification links, trial and billing notices, export links, the weekly digest) are delivered by Resend, Inc., which receives the recipient address and the content of each email. Our mailboxes, including the [email protected] and [email protected] addresses, are hosted by Zoho Corporation (Zoho Mail), so anything you write to us is stored there. Payment gateways you connect (for example Stripe or PayPal) and your own mail server are your providers, under your agreements with them. We do not sell personal data and do not share it for advertising.

Where it is stored, and transfers

Account and workspace data is stored on our application server and database at Oracle Corporation (Oracle Cloud Infrastructure), in the Oracle Cloud region we operate, with encrypted backups in object storage. This website, the app and the API are served from that server through Cloudflare, Inc., which provides DNS, its proxy and CDN in front of them; traffic passes through Cloudflare, but it does not store the customer database. Emails we send pass through Resend, and emails you send us are stored by Zoho Mail. When personal data leaves Nigeria, we rely on a transfer basis the NDPA allows, such as an adequacy decision or appropriate safeguards in a written contract. When personal data of people in the EU or UK is transferred to a country without an adequacy decision, we use the European Commission’s Standard Contractual Clauses or the UK International Data Transfer Agreement or Addendum.

How long we keep it

  • While you use ReckonOS: we keep your workspace data. When a plan ends, the workspace becomes read-only and stays available for you to view and export until you delete it.
  • When you delete the workspace (Settings > Data): the plan is cancelled at once and the workspace becomes read-only. After 30 days, during which an admin can undo it, we erase its clients, invoices, payments, credit notes, expenses, projects, time entries, contractors, uploaded files and team accounts. Audit log entries are kept as a bare record that something happened, with who, where from and what changed removed. We email the admins when deletion is requested and again 7 days before erasure.
  • When you delete your account (Settings > Data): you are signed out at once. After 30 days, during which the link we email you restores the account, we erase your name, email address, password, two-step sign-in data and the IP addresses of your sign-ins. Records you created belong to the workspace and stay there without your name. The only admin of a workspace has to hand over or delete the workspace first.
  • Data exports: the download link works once and expires after 24 hours; the file is deleted after it is downloaded or when the link expires.
  • Billing records of what you paid ReckonOS are kept for as long as tax and company law requires, which in Nigeria is at least six years. They hold none of your workspace data.
  • Backups: erased data can remain in encrypted database backups until those backups expire on our backup schedule. We never restore it into the service.

Your rights

Under the NDPA, the GDPR and the UK GDPR you can ask to access, correct, export or delete your personal data, object to or restrict some uses, and withdraw consent where we rely on it. You can do the two most common ones yourself in Settings > Data: download your data (admins can download the whole workspace) and delete your account or workspace. For anything else, email [email protected]; we answer within one month. If your data is in a workspace someone else controls, we pass your request to them.

You can complain to the Nigeria Data Protection Commission (ndpc.gov.ng), to the data protection authority where you live in the EU, or to the UK Information Commissioner’s Office (ico.org.uk). We would like the chance to fix it first.

Security

Gateway keys, SMTP passwords, two-step sign-in secrets and contractor tax IDs are encrypted with AES-256-GCM. The key that decrypts them is held only in our production server configuration: the ReckonOS application uses it to call your gateway or mail server, and the people who administer our production servers (today, the founder) could use it. No screen shows a saved key again, and every change to credentials is written to your audit log. More on the security page.

Children

ReckonOS is a business service and is not meant for anyone under 18.

Changes

We post changes here and, for material changes, email account owners before they apply. Billing questions: [email protected].