Legal
Privacy policy
Last updated 17 August 2026
You are trusting us with your staff's names and salaries. This page says exactly what we do with that, in plain terms. It covers what we collect, who else sees it, and what you can ask us to do about it.
Who we are
Komply is payroll and compliance software for Nigerian businesses, operated at komply.ng. In this policy, "we" means Komply; "you" means the business using it.
This policy is written to meet the Nigeria Data Protection Act 2023 (NDPA). If you are an employee of a business that uses Komply and want to know how your data is handled, the section on employee data explains who to ask.
What we collect
Only what the product needs to do its job. There is no tracking for advertising, and we do not buy or enrich data about you.
Your account
Email address and password credentials, handled by our authentication provider. We never see your password.
Your business
Company name, TIN, state, industry, approximate annual turnover, contact email and phone, and your logo if you upload one. Turnover and state are needed because some obligations are triggered by them.
Employee records
Name, job title, TIN if provided, state of residence, employment start date, salary and allowances, pension scheme details, and engagement type.
Payroll results
What each run calculated: gross, PAYE, pension, other statutory deductions and net pay. Also which version of the tax rules produced it.
Billing
Your plan, subscription status, renewal date and the identifiers our payment provider gives us. We never receive or store your card details.
Support messages
What you send us through the contact form or by email, so we can reply and keep a record of the conversation.
Usage counters
Counts of actions like emails sent, documents produced and AI questions asked, to enforce plan limits and prevent abuse. Counts, not content.
Employee data, and who controls it
This distinction matters legally, so it is worth stating plainly. For the employee records you enter, you are the controller and we are the processor. You decide what to enter and why; we hold and process it on your instructions.
Practically, that means we do not contact your employees, do not use their records for anything other than running your payroll, and will not disclose them to anyone but you except where the law requires it. If one of your employees asks us directly for their data, we will refer them to you. It is your record, not ours to hand over.
It also means the responsibility for having a lawful basis to hold your staff's data, and for telling them you do, sits with you as their employer.
Why we process it
We process your data to:
- Run payroll and calculate PAYE, pension and other statutory deductions.
- Produce payslips, remittance schedules and filing documents for your review.
- Tell you when a filing or remittance is due, by email and in the app.
- Answer your questions through the in-app assistant and through support.
- Take payment for your subscription and keep your access correct.
- Keep the service secure, prevent abuse, and enforce plan limits.
- Meet our own legal and accounting obligations.
We do not sell your data, we do not share it with advertisers, and we do not use your payroll figures or your employees' records to train AI models.
Who else touches your data
We use a small number of established providers to run the service. Each receives only what it needs, and each is bound to process it only on our instructions. Some are outside Nigeria, so your data may be transferred abroad under contractual safeguards.
Supabase
Database hosting and authentication. Holds your account, company, employee and payroll records.
Vercel
Application hosting and content delivery. Processes requests to the site and keeps operational logs.
Resend
Sends transactional email: deadline reminders, invitations, password resets. Receives the recipient address and the message.
Paystack
Takes subscription payments. Receives your email and the amount; handles card details directly so we never see them.
Anthropic
Powers Ada, the in-app assistant. Receives the text of a question and the context needed to answer it. See the next section.
Ada and AI
Adais the assistant inside the product. When you ask her something, your question and the context needed to answer it are sent to Anthropic's API, which generates the reply.
Two things we hold to here. First, your data is not used to train AI models. Second, AI is never what decides a tax figure. Every calculation you see comes from our own tested, versioned rule engine, not from a language model. Ada explains figures; she does not produce them.
How long we keep it
Payroll records are statutory records, and you may need them years later for an audit or a query from a revenue service. So we keep your approved payroll runs, schedules and payslips for as long as your account exists, and they remain readable and downloadable even if you stop paying.
If you close your account, tell us and we will delete your company and employee data within 90 days, apart from anything we must keep for our own legal or accounting obligations. Support correspondence is kept for up to two years. Usage counters are aggregated and retained only as long as needed to enforce limits.
How it is protected
Traffic is encrypted in transit, and data is encrypted at rest by our hosting providers. Access within a company is limited by role. An accountant you invite for read-only access cannot change figures, and billing is restricted to the owner. Access to production data by us is limited to what is needed to operate and support the service.
Please do not send passwords, bank details or full staff records by email. If we need something sensitive, we will show you a safe way to provide it.
Your rights
Under the NDPA you may ask us to give you a copy of your data, correct it, delete it, or restrict how we use it, and you may object to particular processing. You can also ask for your data in a portable form. Much of it is already exportable from the app as CSV or PDF.
Write to support@komply.ng and we will respond within 30 days. If you are not satisfied, you may complain to the Nigeria Data Protection Commission.
Changes to this policy
If we change how we handle your data, we will update this page and the date at the top. Some changes are significant: a new processor, or a new purpose. We will tell you about those by email rather than rely on you noticing.
Contact us
Questions about this policy, or about your data, go to support@komply.ng or 0706 678 9324. You can also send a message.