We collect the minimumto run this.

What this notice covers.

This notice applies to Cashogi.org and every page, form and email we run from it. It applies whether you're browsing without applying, applying to an open cycle, paying a fee through Paystack, subscribing to the newsletter, or writing to us at any of our published email addresses.

It does not apply to third-party sites we link to, including Paystack, where you'll have your own privacy relationship covered by their notice.

What we collect, and when.

The table below is exhaustive. If something isn't in here, we don't collect it.

Why we collect each thing.

• Name & WhatsApp — so we can confirm your application, send your reference, and call you if you're a recipient. WhatsApp number is unique per grant (one entry per number per cycle) so people can't game volume.
• Email — optional. We send a written confirmation if you give it, and decisions in writing. We will only use it for newsletter content if you tick the separate consent box.
• Essay — scored against the four published criteria (names redacted) and reviewed by the Cashogi team to decide recipients. Stored for the duration of the cycle and 180 days after.
• Payment reference — to reconcile your application to your fee. We need this to issue refunds where Paystack reverses a transaction.
• IP & device — to catch duplicate-form abuse (the same device firing the form 40 times in an hour). Dropped after 30 days, never tied to your record after that.

Where your data lives.

All applicant data is stored on infrastructure operated by us in Nigeria, plus an encrypted backup with a tier-one cloud provider with EU-region servers. No applicant data leaves these two locations.

Newsletter emails are stored with a third-party email provider listed in our subprocessors page. You can unsubscribe at any time from the footer of any email.

Who can see it.

• The Cashogi team. The small in-house group who run the cycles and review applications.
• Paystack. For payment, refund, and reconciliation only. They do not see your essay.
• Our subprocessor list. Email provider, backup cloud, error-monitoring. Listed publicly with addresses on our subprocessors page.
• Regulators. When compelled by law. We will tell you if this happens, unless prohibited.

How long we keep it.

• Applications (essay, name, WhatsApp): kept for the duration of the cycle plus 180 days, then archived to a name-only ledger and the essay deleted.
• Payment reference: kept for 7 years for tax reasons (Nigerian regulatory minimum).
• Newsletter subscription: until you unsubscribe.
• IP and device fingerprint: 30 days.
• Recipient name + grant + cycle: public on the recipients page forever, unless you ask for removal.

Your rights under the NDPA.

The Nigeria Data Protection Act gives you specific rights. We honour all of them:

• Access — ask what we hold about you. We reply within 7 working days with a copy.
• Correction — fix something we got wrong. Same response time.
• Deletion — remove your data. Required retentions (payment ref, 7 years tax) excepted; we'll tell you what's left.
• Portability — get a machine-readable copy.
• Objection — stop us using your data for newsletter or non-essential processing.

To exercise any of these, write to legal@cashogi.ng from the email address tied to your application. Don't send your card or ID — name and email are usually enough.

Cookies and analytics.

Cashogi runs a privacy-friendly analytics setup: page-level pageview counts only, no cross-site tracking, no third-party advertising tags, no Google Analytics. We do not use cookies for advertising; the only cookies we set are a session cookie for the application form and a preference cookie for whether you dismissed the site banner.

Children and applicants under 18.

Cashogi grants are open to applicants 18 and older. The Education Fund has a sixth-form exception for applicants between 16 and 18 entering tertiary education — for those, a parent or guardian's WhatsApp number is required in addition to the applicant's, and we process the parent's data on a separate basis. Beyond this, we do not knowingly collect data from minors.

Changes to this notice.

We post a notice on the notice board whenever we update this document. The version number changes (v2.1 → v2.2) and the effective date is reset. Material changes — a new data category, a new subprocessor, a longer retention — are announced at least 14 days before they take effect.