Your data. Your choices.
Clover Store · Nigeria · Clover Peer Pay
Remove income, stop nearby sharing, withdraw pending verification preferences and request a rating data review. Use the Privacy center for access, correction, deletion, restriction, profiling and complaints. Requests are recorded for human review; erasure is not automatic. A dedicated email remains unconfigured.
1. Who is responsible and what this covers
Clover Store, Nigeria, is the operator of Clover Peer Pay and is responsible for the personal information it determines how to use in the Clover service. This policy covers the public web app, signed-in features and native Android test app. It should be read alongside the Terms & Conditions and the notices shown when you choose a feature.
Clover is currently a test service. Real deposits, withdrawals, payment processing, merchant checkout, bank feeds, income verification and identity-provider checks are not connected. This policy does not imply that Clover is a licensed bank, bureau or lender. A verified operator postal address and a dedicated privacy contact channel have not yet been published; those details, retention periods and provider arrangements need to be finalised before a financial launch.
2. Information Clover collects
Sign-in identity: the account identifier, email address and available name supplied through ChatGPT sign-in. Google can be your sign-in method within ChatGPT. Clover does not receive your Google or ChatGPT password, and the current integration does not grant access to your Gmail, Google contacts or ChatGPT conversation history.
Privacy rights: the contact email you provide (or your signed-in email), request type, stated region, explanation, agent flag, receipt-code hash, response dates, status and staff replies. These are used to process and document the request. You may submit without creating an account. The application holds your current profiling preference; all visitors receive the same no-sale/no-advertising-sharing policy.
Registration: self-reported African country or territory of residence, preferred wallet currency, whether the preference follows the country or is custom, and the time you confirmed that you are at least 18 and permitted to use the test service. This is not independent age, identity or location verification. Country does not affect the credit-rating formula. Currency preferences configure separate wallets; financial records retain their currency and minor-unit amounts. The service stores reference-rate factors and NGN-equivalent principal for cross-currency risk calculations. Rates are fetched by the backend from ExchangeRate-API using a shared NGN-base request, without sending member names, emails, balances, income or country selections. This does not exchange funds.
Circle invitations: the selected email/SMS channel, a masked recipient hint, a hash of the normalised contact, a hash of the private link token, sender, circle, creation/expiry/revocation times and the account that used it. The backend processes the contact to validate and hash it, but the application stores the hash and masked hint instead of the full invitation contact. Treat hashes and hints as personal data. The full contact and link remain in the sender’s current web view, or encrypted pending-invitation storage on Android until resolved; copying a message puts it on the device clipboard.
Account and community activity: circle names, membership, join requests, approval decisions, admin roles, payout order, contribution and exit history; peer-request purposes, categories, amounts, terms, funding commitments, repayment schedules and status; references given to other members; balances, ledger entries, transaction references, timestamps and duplicate-request identifiers.
Rating and income information: the calculated rating, factors, evidence counts, restrictions, model version and evaluation time; changed-rating audit summaries; data-review reasons and administrator notes. If you consent, Clover also stores monthly take-home income, essential expenses, other debt payments, evidence source, consent date and update time. These income figures are self-reported.
Verification preferences: issuing country, preferred document type, request date and status. The current workflow does not collect ID-document images, selfies, BVN or NIN. Do not put these in a review reason or support message.
Location choices: the country and area you enter, or rounded latitude/longitude grid cells, sharing mode and expiry time. Your browser or phone may provide coordinates to the app, but Clover rounds them before transmission. It does not send those original coordinates to the Clover account backend or continuously track your location in the background.
Technical access information: essential sign-in/session data, native device-approval code and session hashes, expiry times and information needed to handle network requests. Hosting and authentication providers may process IP addresses, browser/device information and security or error logs. The app does not intentionally log income values or credentials; error diagnostics should not be treated as a channel for sensitive documents.
Information you choose to share: a rating data-review request is sent to Clover’s backend when submitted. The general support-message tool only prepares text locally until you explicitly save it or share it through another app. Android launch diagnostics are displayed locally; copying or sharing them is your choice.
3. Why information is used and the processing basis
Clover uses account identity and requested ledger/community records to identify your account, provide the service you request, keep records consistent, operate circle approvals and payouts, show repayment schedules, prevent duplicate actions, maintain security and investigate problems. Where necessary to provide an agreed service, the intended basis is performance of that service; security and misuse prevention may rely on legitimate interests where lawful and subject to your rights. Specific legal obligations may require particular records to be processed or retained.
Optional income use, verification-preference requests and nearby visibility require the explicit choices shown in their forms. Consent for one optional feature is not consent for all features or for future advertising, bank feeds or provider checks. You may decline optional income or location sharing and still explore other available features. A function that needs an area or a signed-in account cannot operate without that information.
Clover uses the rating to explain recorded behaviour and apply test eligibility restrictions. It does not use the data to issue a real credit approval. The operator must assess and document the appropriate processing basis and safeguards before materially changing these purposes. A future incompatible use requires an appropriate legal basis and clear notice, and new consent where required.
4. Credit profiling, income and human review
Clover automatically calculates a 1.00–10.00 rules-based rating when your Clover account is created and recalculates it on account/profile/quote access and relevant posted activity unless you pause optional rating profiling. The weights are repayment and timeliness 55%, consistent settled spending and commitments 20%, contribution history 10%, responsible completed credit frequency 10% and income affordability 5%. New accounts start at 5.50, provisional.
The inputs are recorded Clover activity and any consented income profile, not your complete bank spending. Account age, documented repayment history, late and overdue obligations, activity consistency and current commitments affect the result. Larger spending, extra applications and split contributions do not earn direct score bonuses. Gender, ethnicity, religion, disability, location, contacts and device characteristics are not rating inputs.
You can pause optional rating profiling in the Privacy center or Android Privacy choices. While paused, the backend does not calculate a new score and does not display your derived score to other members. Account screens may show a neutral placeholder marked Profiling paused; it is not a new credit assessment. Test quotes require a rating and are unavailable during the pause. This is a functional consequence, not a charge or retaliation for exercising a privacy right. Existing debts, contributions and ledger access remain. Historical ratings require separate retention/erasure review.
Self-reported income has 25% evidence strength within its 5% factor. Missing or older-than-90-day income is neutral, not assumed to be zero. Fresh income and recorded commitments also inform a separate affordability preview. No income-verification provider is connected.
A provisional account, score below 7.00, overdue balance or known insufficient affordability budget can block an instalment preview. The policy is not calibrated against actual defaults, a bureau report or an automatic lending decision. Open Profile to see factors and restrictions or request a review of incorrect data. An authorised administrator can record a review note, but this does not automatically correct source records, override a score or approve credit. Your applicable rights to challenge processing and seek human intervention remain available.
5. Who can see information inside Clover
Public visitors can explore the interface and planner; the public preview does not expose signed-in members’ account records. Signed-in members can browse circle summaries and funding requests. A funding request can display your name, request purpose/category, amount, terms, funding progress and rating to other signed-in members. Avoid including sensitive personal details in a public-to-members request purpose or circle name.
Current circle members can see fellow members’ names and recorded contribution counts in that shared circle. The Trust page lists up to three top contributors by contribution count, with ties shown alphabetically. Former members and people outside the circle do not receive this list. This summary does not include private credit scores, income, contact details or wallet balances.
Circle creators and current co-admins can see masked invitation recipients, channel, expiry and request status, including an applicant’s name once a link creates a request. Email invitations require the matching signed-in email. A phone invitation is not phone verification; the admin must confirm the recipient before admission. An invitation does not auto-enrol a person or appoint an admin.
Circle creators and current co-admins can see member names/roles and pending admission requests needed for circle administration. Members sharing a circle may see names needed for community references. Counterparties see the relevant request and their own ledger/funding activity. A circle admin role does not grant access to other members’ private wallets or site administration.
If you activate nearby sharing, matching signed-in members can see your name and approximate area for one hour. Nearby results do not include email/contact details, income, exact coordinates, verification documents or financial records. Stop sharing ends that visibility sooner.
Authorised site administrators can monitor account summaries, circles, credit, transactions, overdue records, verification-request status and data-review requests for service operation and security. Operators with authorised database access may access underlying personal records when necessary for that purpose. Role restrictions reduce access; they are not a promise that service operators can never access your data.
6. Providers, external links and other disclosures
Clover uses OpenAI Sites/ChatGPT for hosting access and sign-in, and Cloudflare infrastructure for application execution and account-database storage. These providers process information needed to operate or secure those services under their own arrangements and privacy notices. Using Google within ChatGPT also involves Google’s sign-in service. Clover does not store their passwords.
Clover does not currently send invitation email or SMS through a delivery provider. The sender explicitly opens an email or SMS draft and sends it using their own app or carrier; the destination app/provider processes the recipient, message and private link under its own terms. Carrier charges may apply. Creating a link or opening a draft is not proof of delivery. Send only expected invitations, never bulk or unsolicited messages. The web invitation token is in the URL fragment rather than the server path/query; anyone who obtains a phone invite link may request admission, so keep it private.
External merchant links, an email app, Android’s share sheet or an official regulator website are separate destinations. Visiting them can disclose normal network information to that destination. Saving or sharing a statement, support message or diagnostic is your choice; review the content and recipient before sending. The current app has no connected KYC, income-verification, bank-feed or merchant-checkout provider to receive those documents or perform checks.
Clover has no advertising or data-broker integration in the current application and does not sell personal data. It may disclose information where lawfully required by a competent authority, or where necessary and lawful to address fraud, security incidents or legal claims. No future data sale or materially different sharing purpose is authorised merely by displaying this policy.
7. Cookies, browser storage and phone storage
The web app uses local browser storage for light/dark mode, reduced transparency and accessibility preferences (text size, contrast, text spacing, link styling and motion), when you choose those settings. These accessibility choices stay in the browser and are not included in the credit rating. The automatic sign-in prompt uses only in-memory page state; it does not store a prompt-history cookie or session-storage flag. Account responses are intended for private, uncached access. The authentication/hosting platform may use essential cookies or equivalent session technology for sign-in and security. The current app does not include an optional advertising or cross-site analytics SDK.
The Android app keeps its native session, an offline account snapshot, pending-operation state and sign-in state in encrypted app storage protected by Android Keystore. Appearance preferences are saved on the device. The app disables its normal Android backup and cleartext HTTP access. Its font and legal documents are bundled locally. A saved account view can be stale and should be refreshed before relying on it.
Device access uses a short-lived single-use approval code, valid for two minutes, followed by a native session valid for seven days. The backend stores hashes of these codes/tokens rather than their plain values. Signing out on that device clears its saved account data and attempts remote revocation; if offline, the remote session can remain usable until expiry. Changing browser storage or uninstalling the Android app does not erase the Clover server account.
8. Retention, expiry and deletion limits
Invitation links expire after seven days, allow one account to request admission and can be revoked by a current circle admin before use. Expiry or revocation disables the link; it does not erase its masked hint, contact hash or audit metadata. Those records and registration information follow the current test-record limitations below, with no automatic purge. No full email/SMS delivery logs or address book are collected by this app.
Current test-account ledger, membership, loan, rating-audit and review records do not have an automatic scheduled purge. They remain in the backend unless replaced or removed through an authorised process. A production retention schedule has not been finalised. The operator must limit retention to a justified operating, security, legal or record-keeping need and establish appropriate deletion and backup procedures before financial launch; this policy is not permission for unnecessary indefinite retention.
Nearby visibility expires after one hour; expired records are excluded from discovery but are not automatically purged solely because the hour passed. Stop sharing removes the active location record through the current control. Removing income deletes the live income entry and recalculates the rating; older derived audit/review records and ledger facts remain. Cancelling an awaiting-provider KYC request removes that saved preference request.
Income becoming neutral after 90 days, the rating’s observation windows and authentication-code/session expiry are validity rules, not promises of complete record deletion. Provider security logs and backups may have separate retention arrangements. Their exact locations and retention periods have not been confirmed in this policy. General account erasure requires a reviewed request through the Privacy center. Submitting it does not automatically erase all records; staff must assess the request, any necessary retention and provider-held records, perform approved actions and explain any lawful exception. No automatic general erasure job or final production retention schedule is configured.
9. Security and processing outside Nigeria
Clover uses HTTPS, server-side authentication and authorisation, origin checks for web changes, role restrictions, native encrypted storage and hashed device credentials. These safeguards cannot guarantee that every device, provider or internet connection is secure. Protect your sign-in account, avoid shared unlocked devices and do not put passwords, card details or identity documents in free-text fields.
Sites/ChatGPT and Cloudflare are international services, so information may be processed outside Nigeria. This is not a promise of Nigeria-only storage. Specific processing countries, transfer safeguards, provider contracts and backup residency have not yet been verified for this test service. The operator must assess and document an applicable lawful transfer mechanism and protections where required before financial launch. Accepting this policy is not blanket consent to unrestricted international transfers.
10. Your choices, privacy rights and complaints
Available controls: the Privacy center at /privacy-center accepts access, correction, deletion/account-closure, restriction, objection, profiling/human-review, privacy-complaint and authorised-agent requests without requiring account creation. Signed-in members can download a machine-readable copy of application-held account, activity, income, rating and privacy-request records. Secrets and other people’s identifiers are excluded. A large export requires a reviewed access request rather than silent truncation. Hosting/provider logs and backups are outside the instant download and must be assessed in a full access response.
Available controls also include: change or remove your current income in Profile; cancel an awaiting-provider verification request; Stop sharing on Overview or Android Home; request a rating data review in Profile; export the available wallet activity statement; sign out of the current device. The statement export is not a complete personal-data access response. Leaving a circle, signing out, removing the app or withdrawing an optional permission does not delete every historical record.
Subject to applicable law and its conditions, you may request confirmation/access and a copy of your personal data; correction, erasure or restriction; portability where applicable; object to processing; withdraw consent for optional processing; and challenge relevant profiling or seek human intervention. Withdrawing consent does not itself undo lawful prior processing or erase records held on another lawful basis.
The Privacy center records the request and immediately displays a reference and private receipt code. Return with that code to see status and staff replies, or view signed-in requests in your account. The receipt does not verify identity or prove fulfilment. Staff must check identity or agent authority proportionately before disclosure or erasure, explain any refusal or retained category and provide relevant complaint/appeal information. Do not upload ID documents here. A dedicated privacy email, email notifications and a secure supplementary evidence channel are not configured. The general support-message tool still does not send a message.
Clover uses a one-calendar-month planning target for EU/EEA, UK and other requests, and 45 days for California access, correction and deletion. The public receipt immediately acknowledges recording; staff must respond without undue delay under applicable rules. The tool does not automatically stop, reset or extend legal clocks; any lawful extension needs a timely reasoned notice. A privacy request must not cause unlawful discrimination or retaliation.
You may consult or complain to the Nigeria Data Protection Commission through its official website. NDPC is an independent authority, not Clover’s support inbox. You do not have to waive statutory remedies or complete an unavailable internal process before using an available legal remedy. When Clover publishes a privacy channel, requests should identify the account and desired action without including passwords or unnecessary identity documents; proportionate identity checks may be needed through a secure process.
11. Children and future services
Clover’s account and financial-community features are intended for people aged 18 or over. The current sign-in flow is not an independent age-verification check. Do not submit a child’s income, identity documents or other sensitive information. If the operator learns that a child’s information has been supplied contrary to this scope, it should restrict further use and assess appropriate removal subject to applicable law.
Connecting payments, identity or income verification, collecting documents, introducing bank feeds, enabling real lending, changing the rating’s uses or adding analytics would require an updated notice, appropriate safeguards and permissions or consent where required. None of those future activities is authorised by an optional choice made for the current test features.
12. Policy changes and contact details
Policy version: 2026-10-20.2. Material changes will be identified by an updated version and notified as required before any new use; new consent will be sought where required. Publishing this notice is not proof that you agreed to a new financial contract or consented to all optional processing.
Operator: Clover Store, Nigeria. A dedicated privacy email and operator postal contact details will be published once provided and configured. Submit privacy requests at /privacy-center in the meantime. This test-service notice requires operator and relevant Nigerian, EU/EEA, UK and Californian legal review of the remaining contact, retention and provider-transfer details before a financial launch.
13. EU/EEA, United Kingdom and California
EU/EEA: where the GDPR applies, the relevant rights include access, rectification, erasure, restriction, portability, objection, consent withdrawal and safeguards concerning relevant automated decisions. You may complain to the supervisory authority competent for your circumstances. UK rights are assessed under UK GDPR and the Data Protection Act 2018 as amended, including the Data (Use and Access) Act 2025. The UK ICO provides current guidance and complaint routes. This notice does not treat all European countries as one legal regime.
California: where the relevant laws apply, rights may include knowing/accessing collected information, correction, deletion, opt-out of sale or sharing, limits on certain sensitive-information use, and non-discrimination. Identifiers, account/financial activity, approximate location, recorded device/session information and rating inferences are the categories described above. Sources are you, your authentication provider, your chosen device inputs and relevant Clover counterparties. Purposes, recipients and current retention criteria are explained by category in this policy and the notices at collection. A full CCPA applicability and retention assessment is still required; this notice does not assume a small business is automatically exempt from every California privacy law.
Clover does not sell personal information, share it for cross-context behavioural advertising, or offer a financial incentive for doing so. Global Privacy Control is honoured through that universal prohibition, without requesting identity or requiring an account. Browser Do Not Track does not enable advertising tracking. No optional analytics or ad SDK is integrated in the current application. Necessary authentication and hosting storage still require provider-specific review. Optional income, location and KYC preferences can be withdrawn; a restriction or objection request can ask for a wider assessment.
These controls are not a certification or permission for a financial launch. Current registration remains Africa-focused. Controller contact details, any required EU/UK representatives, processor terms, international-transfer safeguards, impact assessments, retention/erasure execution and financial authorisations have not been verified. No EU, UK or California lending, payment or investment authorisation is claimed. Local mandatory rights and complaint remedies are preserved.
Official guidance and provider notices
These links open external websites. No privacy request is submitted by opening a link.
EU/EEA supervisory authorities