Privacy policy
Last updated: 1 October 2026
Who we are
Nxtpay is a trading name of Nxtedge Digital Solutions ("we", "us"), a business name registered with the Corporate Affairs Commission (BN 9818707), whose principal place of business is 53, Charity Road, Abuleegba, Lagos State, Nigeria. This policy explains what personal data we collect through the Nxtpay website (nxtpay.nxtedgestudio.com) and the Nxtpay service (app.nxtpay.nxtedgestudio.com), why, and your rights.
For questions or requests about your data, email privacy@nxtedgestudio.com.
Two different roles
- On our website, and for the people who sign in to Nxtpay, we decide how personal data is used: we are the data controller.
- For the employee data our customers put into Nxtpay (names, salaries, bank details, deductions), the customer is the data controller and we process it on their behalf and on their instructions, as their data processor. If you are an employee of one of our customers, contact your employer about your data; we will help them respond.
What we collect, and why
When you request a demo or contact us
- What: your name, work email, company, number of employees, how you run payroll today, and anything you write to us.
- Why: to reply to you and arrange a demo.
- Lawful basis: our legitimate interest in responding to people who ask about Nxtpay, and steps you ask us to take before a contract.
- Kept: 12 months from your request, then deleted, unless you become a customer.
When you visit the website
- What: pages viewed, the referring site, browser and device type, and country, collected by Vercel Web Analytics without cookies and without identifying you.
- Why: to understand which pages are useful.
- Lawful basis: our legitimate interest in running and improving the website.
When you use Nxtpay (people with an account)
- What: your name, work email, role, organization, sign-in times, the devices and network address you sign in from, your two-factor setup (stored encrypted), your email preferences, and a record of what you do in Nxtpay (the audit log).
- Why: to let you sign in securely, to protect the service and your organization's data, to send you the emails the service needs, and to keep the record your organization relies on.
- Lawful basis: performance of our contract with your organization, and our legitimate interest in keeping the service secure.
- Kept: while your organization uses Nxtpay. When your organization leaves, this data is deleted with the rest of its data, within 30 days of giving the organization its export, unless the organization asks us in writing to keep it longer or the law requires us to keep it.
Employee data held for our customers
- What: the employee records and payroll data a customer enters or imports.
- Why: only to provide Nxtpay to that customer, on their instructions.
- Kept: as the customer decides, within our agreement with them. When a customer leaves, we provide an export of their data and delete it, as agreed with them.
Who we share it with
We do not sell personal data, and we do not share it for advertising. We use these service providers, who process it for us under contract:
| Provider | What for | Where |
|---|---|---|
| MongoDB Atlas | The Nxtpay database | Stockholm, Sweden (AWS eu-north-1) |
| Vercel | Hosting the website and the service; website analytics | Outside Nigeria |
| Resend | Sending email | Outside Nigeria |
| Sentry | Error reports, with submitted data, signed-in user and cookies removed, and amounts, account numbers and email addresses masked | Outside Nigeria |
| Sanity | Storing demo requests and website content | Outside Nigeria |
Sentry and Sanity receive data only once they are switched on for Nxtpay. Ask us at privacy@nxtedgestudio.com for the region each provider uses. We may also disclose data where the law requires it.
Transfers outside Nigeria
Some of these providers store or process data outside Nigeria, including in the European Union and the United States. We transfer data only as the Nigeria Data Protection Act 2023 allows, relying on the contractual safeguards in our agreements with these providers, which require them to protect personal data to a standard at least as protective as the Act.
How we protect it
Two-factor sign-in for anyone who can see pay, encryption of bank account numbers and two-factor secrets, strict separation between organizations, an audit log that cannot be edited, and no pay figures or account numbers in email or error reports. More on our security page.
If a breach puts personal data at risk, we will notify the Nigeria Data Protection Commission and, where required, the people affected and our customers, within the time the law requires.
Your rights
You can ask us to:
- tell you whether we hold your data, and give you a copy;
- correct it;
- delete it;
- restrict or object to how we use it;
- give it to you, or another organization, in a common format;
- withdraw consent, where we rely on it.
Email privacy@nxtedgestudio.com. We will reply within 30 days. We may need to confirm who you are first. If your request is about employee data a customer holds in Nxtpay, we will pass it to them and help them answer.
If you are not satisfied with our answer, you can complain to the Nigeria Data Protection Commission.
Cookies
See our cookie policy. In short: the website sets no tracking cookies; the Nxtpay service uses only the cookies it needs to keep you signed in and remember a display setting.
Changes
If we change this policy, we will update the date above, and tell customers by email of any change that affects them.