Recur reads your bank transactions to find the charges that
repeat. That is about as personal as data gets, so this page says plainly what
we collect, why, who else touches it, and how to make us delete it.
The short version. We read your transactions, we never
see your bank login, we cannot move your money, we do not sell anything to
anyone, and you can delete everything from inside the app.
Who we are
Recur is operated by Recur Software Limited, a company
registered in Nigeria. For anything in this notice, write to
support@recur.website.
Who to contact about your data
For any question about this notice, or to exercise any right below, write to
support@recur.website and mark it for
the attention of our data protection contact. We answer within 30 days, which is
the period the Nigeria Data Protection Act allows.
What we collect
Your account
Email address, and a password stored as a one-way hash we cannot reverse
The name you choose, and a profile picture if you add one
Keeping your account safe
One-time codes, stored hashed, valid for ten minutes
Session tokens, stored hashed and revocable
A device identifier, your IP address and browser or device description,
so we can tell you when something signs in from a device we have not
seen before
Your bank connection
The bank's name, and the last digits of the account number. We never
store the full number
An identifier that lets us ask Mono about that account
We never see your bank login. You sign in inside a screen
hosted by Mono, a CBN-licensed open banking provider. Your credentials never
reach us.
Your transactions
The date, amount, description and payee of transactions on the account
you connected
What we work out from them: which charges repeat, how often, what they
cost, and what is coming next
Budgets you set, categories you correct, and trials you log
What you tell us to send
Whether you want renewal reminders and how many days ahead
Whether you want the weekly digest
Why we are allowed to hold it
Under the Nigeria Data Protection Act 2023 we rely on:
Your consent for everything to do with your bank
account, your transactions and the emails we send. You give it when you
connect a bank and you can take it back at any time
Performing our contract with you for your account
itself, since we cannot run an account without an email address and a
password
Our legitimate interest in security for the device and
IP details behind new-device alerts
Decisions made automatically
Finding what repeats is automatic. Recur groups your debits by merchant and
by amount, works out how often each one comes back, and estimates when the next
one is due. Those are inferences, and they can be wrong, which is why every one
of them is presented as something you can correct rather than as fact.
Nothing Recur decides has a legal effect on you. It does
not score you, rank you, grant or refuse you credit, and does not share its
conclusions with anyone who could. It reads your account and tells you what it
sees. You can change any label it applies, and you can delete the lot.
Who else touches it
Only the companies that make the product work:
Mono, for the bank connection and transaction history
Supabase, which hosts our database
Render, which runs our servers
Vercel, which serves this website
Resend, which delivers our email. A reminder or digest
names the subscription it is about, so Resend handles that detail too
Some of these process data outside Nigeria. Supabase,
Render, Vercel and Resend all run their infrastructure abroad, which means your
data is transferred out of the country to reach them. We rely on your consent to
use Recur at all, and on the contractual data protection commitments each of
those providers makes to us, and we will only keep using a provider on a footing
the Nigeria Data Protection Act permits.
What we never do
We never sell, rent or share your data for advertising
We do not run advertising or third-party tracking in the app or on this
site
We cannot move your money. Recur has no payment capability of any kind,
so no transfer, payment or withdrawal is possible through it
We never ask for your bank password, PIN or OTP. If anything claiming to
be Recur asks, it is not us
How long we keep it
Your account and transaction data, while your account
exists. Deleting the account deletes it
One-time codes, ten minutes
Session tokens, up to thirty days, or until you sign out
Waitlist emails, until we open, or until you ask us to
remove you
Your rights
You can ask us to show you what we hold, correct it, delete it, stop using
it, or hand it over. Most of it you can do yourself:
Delete everything. In the app, delete your account. We
ask for your password, unlink you from Mono, and remove your data:
transactions, detected subscriptions, budgets, sessions, all of it
Stop the bank connection. Unlink the account in the app
and we stop reading anything new
Stop the emails. Every email has an unsubscribe link,
and the settings screen has a switch for each kind
A copy of your data. You can ask us for what we hold on
you in a portable form. There is no download button for this yet, so write to us
and we will put it together.
For anything else, write to
support@recur.website. If you think
we have handled your data badly, you can complain to the Nigeria Data
Protection Commission.
How we protect it
Passwords and one-time codes are hashed with argon2id and cannot be read
back
Sign-in tokens are short-lived and can be revoked
Secrets we must store are encrypted at rest with AES-256-GCM
Everything travels over HTTPS
Your bank credentials never reach us at all
Children
Recur is not for anyone under 18, and we do not knowingly collect their
data. If you believe a child has an account, tell us and we will remove it.
Changes
If we change this notice we will update the date at the top, and tell you in
the app or by email if the change is one that matters.