Privacy policy

Last updated 19 October 2026

This policy explains what information Surba ("we") collects when you use the Surba web and mobile apps, why we collect it, and the choices you have. We process personal data in line with the Nigeria Data Protection Act 2023 and, where they apply, other data protection laws such as the GDPR.

Information we collect

Account details: your name, work email, phone number, password (stored only as a one-way hash) or Google sign-in identifier, and profile photo if you add one.
Company details you enter during onboarding and in Settings: company name, size, industry, address and team members.
Spend data you add: subscriptions, company expenses, transactions, budgets, contracts, investor records, receipts and other files you upload.
Card details: card label, holder name, network, expiry and the last four digits only. We never store full card numbers or security codes.
Identity documents you upload to request a Surba virtual card or buy-now-pay-later financing, used only for verification.
Usage and device information: sign-in times, IP address, browser or device type and push-notification tokens, used for security and to deliver the service.

How we use it

To provide Surba: show your spend, send renewal reminders and alerts, record payments and produce reports.
To keep accounts secure: verification emails, password resets, audit logs and fraud prevention.
To process payments you start (for example card funding) through our payment providers.
With your workspace's AI features switched on, relevant spend data is sent to our AI provider to generate recommendations; it is not used to train their models.
To improve Surba using aggregated, de-identified statistics.

Sharing

We share data only with service providers that help us run Surba (hosting, email delivery, payment processing, card issuing and lending partners when you use those features, and AI processing), each bound by contract to protect it. We do not sell personal data. We may disclose information when the law requires it.

Your workspace

Data you add to a workspace is visible to its members according to the roles and page access the workspace admins set. Workspace admins can export and delete workspace data.

Retention

We keep your data while your account is active and for as long as needed to meet legal, tax and accounting obligations. You can ask us to delete your account at any time.

Your rights

You can access, correct, export or delete your personal data, object to or restrict processing, and withdraw consent. Contact support@surba.io. You may also complain to the Nigeria Data Protection Commission or your local data protection authority.

Security

Data is encrypted in transit; integration secrets are encrypted at rest; access is limited by role; and every change is recorded in your workspace audit trail.

Contact

Questions about this policy: support@surba.io.