Privacy Policy

1. Who we are

Enzito is provided by BBW MULTI-SKILLS LTD (RC 8603105), a private company limited by shares incorporated in Nigeria under the Companies and Allied Matters Act 2020. "BBW Tech Innovation" is the technology brand (trading name) of BBW MULTI-SKILLS LTD; it is not a separate legal entity. In this policy "Enzito", "we" and "us" mean BBW MULTI-SKILLS LTD, which is the data controller for the personal data described here.

This policy covers the Enzito Android app, the Enzito web vault and the enzito.app website. It is written to meet the Nigeria Data Protection Act 2023.

2. The short version

• Everything you put in your vault is encrypted on your device before it reaches us. We cannot read it.
• Your master password and recovery key never leave your device. We cannot reset them or recover your vault without them.
• We keep only what we need to run your account: your email address, your profile, encrypted vault data and a few technical details listed below.
• We do not sell your data, show you ads or use your data for advertising.
• You can delete your account and everything in it at any time.

3. What we cannot see

Your vault is end-to-end encrypted. On your device, Enzito turns your master password into a key with Argon2id and encrypts your vault with AES-256-GCM before anything is uploaded. Our servers store only the encrypted result.

That means we cannot see the names, usernames, emails, passwords, PINs, notes, 2FA secrets and codes, category and folder names, document titles or document files in your vault. We also never receive your master password or your recovery key, in any form.

4. What we collect and why

We collect the following, each for the reason given.

• Account: your email address and your account password. The password is stored only as a secure hash by our authentication provider. We use these to create your account, sign you in and send you sign-in codes and security notices, such as when your email or password changes.
• Profile: the name you choose and, if you add one, a profile photo. These are not part of the encrypted vault. The photo is stored privately and only you can see it.
• Encrypted vault data: your entries, notes, codes, categories and documents, all encrypted as described in section 3, together with the information needed to unlock them with your secrets (salts, key settings and your vault key in encrypted form).
• Vault structure that is not encrypted: record identifiers, which category or folder an item belongs to, its order, when it was created and changed, whether an app is ticked on your Restore Checklist, and each document's size and upload status. We need these to sync your vault and to enforce the storage limits (10 MB per file and 100 MB per account). From them we can tell how many items you have and roughly how large your files are, but not what they are.
• Support conversations: when you write to us in the app (Help and support), we keep the messages you and our support team write, any screenshots you attach, the topic, the times, your app version and basic device information (such as the platform and Android version), linked to your account. Support conversations are not part of your encrypted vault: our support team can read them, and they can see your account email so they can help you. We use them only to answer you and to fix problems. If you email us instead, we receive your email in our support inbox.
• Notifications: if you allow notifications, we keep a code that lets us send notifications to your phone (an Expo push token). We use it only to tell you that Enzito Support has replied. The notification says only "Enzito Support replied to your request" and the request number, never the reply itself. If you have not allowed notifications, we send the same sentence to your account email instead.
• Crash reports: when the Android app crashes or hits an error, it sends a crash report through Sentry: where in the app's code the problem happened, the app version, and device details such as the phone model and Android version. Reports are cleaned on your phone before they are sent, so they never contain your vault contents, passwords, codes, keys or your email address, and they are not linked to your account. We use them only to fix problems.
• Legal acceptance: which version of these documents you accepted, when, on which platform (Android or web), and your confirmation that you are 18 or older.
• Technical records: our servers keep short technical logs of requests (such as the time, the type of request and your IP address) and of important account events, such as a support request or an account deletion. We use them to keep the service working and secure. They never contain your vault contents.

5. What stays on your device

• Master password and recovery key: used on your device to unlock your vault, then cleared from memory. Never sent to us.
• Fingerprint and face unlock: handled by Android. Enzito never receives your fingerprint or face data. If you turn this on, your vault key is kept on your phone in Android's secure hardware and is released only after a successful fingerprint or face check.
• Installed-apps check (Android, optional): if you turn on "Check which apps are installed" in the Restore Checklist, Enzito checks on your phone which of your saved apps are installed. The check runs only on your phone. Your list of apps is never sent to Enzito or anyone else, and only your on/off choice is remembered on the phone.
• Camera and photos: used only when you scan a document or a QR code, or choose a photo. Document scanning uses Google's on-device scanner in Google Play services. Pages and photos are encrypted on your phone before upload, and temporary copies are deleted from the phone.
• Notifications permission: Enzito asks whether it may send you notifications the first time you write to support, not before. You can turn notifications off at any time in your phone's settings.
• Clipboard: when you copy a password, code or note, Enzito clears it from the clipboard after about 30 seconds (60 seconds for the recovery key), unless you have copied something else since.

6. Using Enzito in a web browser

In the web vault your data is also encrypted in your browser, and your master password never reaches our servers. But a browser runs the code our server sends each time you open Enzito. If that code were ever tampered with, it could capture your master password. The Android app does not have this risk in the same way, because its code is installed and signed. We protect the web vault with a strict security policy, no third-party scripts or trackers, and automatic locking. For the most sensitive use, we recommend the Android app.

7. Who helps us run Enzito

We use a small number of service providers. Each processes data only to provide its service to us.

• Supabase: our database, sign-in, file storage and server functions. It stores your account details, your profile and your encrypted vault data.
• Resend: sends our emails, such as sign-in codes, security notices and the notice that support has replied.
• Expo: its push service delivers our notifications to your phone, using Google's Firebase Cloud Messaging.
• Sentry: receives the crash reports described in section 4, to help us fix problems.
• Cloudflare: hosts the enzito.app website and web vault and protects them from attacks. It processes your IP address and basic browser information to deliver the pages.
• Google: distributes the Android app through Google Play, provides the on-device document scanner through Google Play services, and carries notifications to Android phones through Firebase Cloud Messaging.

8. Data outside Nigeria

Our providers may store or process data outside Nigeria. When personal data is transferred abroad, we rely on the safeguards the Nigeria Data Protection Act allows, such as contractual protections with our providers. Your vault data stays encrypted wherever it is stored.

9. Why we are allowed to use your data

• To provide the service you signed up for (performance of our agreement with you): your account, profile, encrypted vault data and support conversations.
• To keep Enzito secure and working (our legitimate interests): technical records, crash reports and abuse prevention.
• To meet legal duties: keeping records of your acceptance of these documents, and answering lawful requests.
• With your consent: optional features such as notifications, the installed-apps check, fingerprint or face unlock and your profile photo. You can turn these off at any time.

10. How long we keep data

• Your account, profile and encrypted vault data: until you delete them or delete your account.
• Unfinished document uploads: removed automatically by a scheduled clean-up.
• Support conversations and their screenshots: kept while your account exists, and deleted with your account. Emails you send to our support address are deleted when they are no longer needed to help you.
• Notification codes (push tokens): kept until you sign out of the app on that phone, Android tells us the code no longer works, or you delete your account.
• Crash reports: kept by Sentry for a limited period, then deleted.
• Technical records: kept only for a limited period for security and troubleshooting.
• Our providers may keep backup copies for a limited time before they are overwritten.

11. Deleting your data

Delete account (Settings, Danger zone, or the "Delete your account" page on enzito.app) permanently deletes your documents and their files, entries, categories, profile photo, profile and your sign-in account. Your support conversations and screenshots, notification codes and legal-acceptance records are deleted with it. This cannot be undone.

Start fresh, for when you have lost both your master password and your recovery key, permanently deletes everything in your vault but keeps your account and email.

12. Your rights

Under the Nigeria Data Protection Act you have the right to be informed about how we use your data, to access it, to have it corrected, to have it deleted, to restrict or object to how we use it, to receive it in a portable form, and to withdraw consent at any time without affecting what we did before.

You can do much of this yourself in the app: edit your profile, export your vault (still encrypted) in Settings, Data, and delete your account. For anything else, email support@enzito.app. Because we cannot read your vault, we cannot give you its contents in readable form; only you can, by unlocking it. If you are unhappy with how we handle your data, you can complain to the Nigeria Data Protection Commission.

13. Enzito is for people aged 18 or older

You must be 18 or older to use Enzito, and you confirm this when you accept these documents. Enzito is not meant for children. If you believe a child has created an account, contact us and we will delete it.

14. How we protect your data

Besides encrypting your vault on your device, we use encrypted connections, access rules that let each account reach only its own data, server-side limits, and restricted access for our staff. Our support team never has access to your vault contents, signs in to our support tools with two-step login, and will never ask for your passwords, codes or recovery key. No system is perfectly secure, so please choose a strong master password and keep your recovery key safe.

15. Changes to this policy

When we change this policy we publish a new version with a new date. If the change affects you, Enzito asks you to read and accept the new version before you continue.

16. Contact

For questions about privacy or to use your rights, email support@enzito.app.