Privacy policy

This policy explains how FraudLens AI (“FraudLens”, “we”, “us”) handles information when you visit fraudlense.com.ng, create an account, or use the screening workspace. FraudLens is a decision-support tool: it flags records for human review and never determines that a person or business has committed fraud.

• Account details: your email address and a one-way Argon2id hash of your password. We never store or see your plain-text password.
• Files you upload: CSV transaction exports and invoice documents (PDF, PNG, JPEG), plus the records, findings and extracted invoice fields derived from them. Original cell values are kept so every finding can be traced to its source row.
• Review activity: finding statuses, notes you write, and an audit trail of significant actions (for example uploads, analyses, status changes, exports and deletions). Audit entries record what happened and when, not the contents of your financial records.
• Technical data: your IP address is used briefly in memory to rate-limit sign-in attempts, and our servers keep standard request logs (time, path, status code) for security and troubleshooting. Logs never contain passwords, session tokens or the contents of uploaded files.

• To provide the service: authenticate you, run the screening rules you request, and show and export your results.
• To keep the service secure: prevent abuse, investigate incidents and enforce access controls.
• To respond when you contact us.

• We do not sell your data or use it for advertising.
• We do not use your uploaded data to train machine-learning models.
• We do not connect to your bank or payment accounts, and FraudLens never blocks payments or takes action on your behalf.
• We do not use analytics, advertising or third-party tracking cookies.

We use two strictly necessary cookies, set only after you sign in or start a demo:

• fl_session: keeps you signed in. It is HttpOnly, so page scripts cannot read it, and it expires after your session ends (12 hours by default).
• fl_csrf: a random value that protects your account against cross-site request forgery.

Because these cookies are required for the service to work, they cannot be switched off while you are signed in.

AI summaries are off by default. If the operator of this deployment has configured an AI provider and you turn the feature on in Settings, requesting a summary sends that finding’s rule identifier, severity, review priority score and numeric evidence to the provider. Vendor names, descriptions, categories, reference normalizations, raw rows and record identifiers are redacted first. The provider’s own terms and privacy policy apply to that processing. You can turn the feature off at any time.

Your data is visible only to your own account; other users cannot access it. We share data only with infrastructure providers that host and run the service on our behalf, with the AI provider described above if you opt in, or where the law requires us to.

• Uploaded files and everything derived from them (records, findings, notes, extracted invoice fields) are kept until you delete the batch. Deletion is immediate and permanent and removes the stored file.
• After a deletion, one minimal audit entry remains (the action, time, batch identifier and row count) so the deletion itself is accountable. It contains no financial data.
• Temporary demo workspaces contain synthetic data only and are removed by scheduled cleanup, by default after 24 hours.
• To delete your account and all associated data, contact us from the email address on the account.

We use hashed passwords, encrypted connections (HTTPS) in production, per-account access checks on every request, upload validation and limits, and protections against spreadsheet formula injection in exports. No system is perfectly secure; if you believe you have found a vulnerability, please report it to us.

You can view and export your findings at any time (CSV and PDF), correct invoice fields, and delete batches yourself. Depending on where you live, you may also have rights to access, correct, delete, restrict or object to the processing of your personal data, or to receive a copy of it. To exercise them, contact us. We may need to verify your identity first.

Transaction exports and invoices can contain information about other people and businesses. You are responsible for having a lawful basis to upload and screen that data. Where you do so, we process it only on your instructions to provide the service. Please use synthetic or properly authorised data, and avoid uploading information you do not need.

If we change how we handle data, we will update this page and the date below. Material changes will be highlighted in the application before they take effect.