Biz+

Privacy policy

Korevra Biz+ · Last updated 2 September 2026 · Governed by the Nigeria Data Protection Act 2023 and the NDPC General Application and Implementation Directive 2025

The short version. Your books live on your phone. Biz+ reads the bank alerts you already receive, removes the account numbers before saving anything, and never uploads your ledger. A few features send a defined slice to Korevra’s servers — sign-in, encrypted backup, a Loan-Ready Report you issue, the pay page behind an invoice you send, and the Pro AI copilot — and section 4 and section 5 list exactly what each one sends. Korevra never holds your money, never sells your data and never scores you in secret. You can export everything and delete everything, from inside the app, at any time.

1. Who is responsible

Korevra Technologies Limited, trading as Korevra Technology Services (“Korevra”, “we”), of Lagos, Nigeria is the data controller for the personal data described in this policy, except where the policy says you are. Write to hello@korevra.com. Our Data Protection Officer can be reached at the same address with the subject line “DPO”. Korevra’s registration with the Nigeria Data Protection Commission as a Data Controller of Major Importance is being filed; the registration reference will be added to this section when it is issued.

Biz+ keeps the books of your business, and your business may hold personal data about your customers and suppliers (names, phone numbers, what they owe). For that data you are the controller and Korevra is your processor, under the standard data-processing terms in our Terms. Biz+ processes it on your phone only, and helps you meet your own obligations to those people (reminders are factual, carry an opt-out and go out only in the hours you set).

2. What Biz+ captures, lane by lane

Biz+ has several ways of getting an entry into your book. Each one is optional and each one is a consent you can withdraw (section 6).

LaneWhat is readWhat is kept, and where
Bank and wallet alerts — pasted, shared to Biz+, opened through a link or Shortcut, or (on phones whose system allows it, with your permission in system settings) read from notifications sent by the banks and wallets on Biz+’s listThe text of the alert: amount, direction, date, description, the last digits of the account and the balance afterThe account number is removed on the device before anything is saved. The redacted text stays on your phone as the evidence behind the entry, so you can always see the alert a figure came from. Notifications from any other app are ignored and never opened.
Voice (“I sell 40 crates today, 120k”)Your speech, transcribed on the device by the phone’s own recogniser. Speech recognition is offered in English and Pidgin; in Yorùbá, Hausa and Igbo the app offers assisted text entry insteadOnly the transcript, as the note on the entry. The audio is not stored and is not sent to Korevra.
Camera (snap a receipt or a levy ticket)The photographStored on your phone, attached to the entry or the levy. It is uploaded in one case only: if you tap Read it on a snapped receipt (a Pro feature), the photo is sent to Korevra’s server and on to Anthropic to read the amount, supplier, category and date, and is then discarded — see section 5. Otherwise it never leaves the phone unless you share that entry yourself.
Statement upload (CSV)The rows of the statementParsed on the device into proposed entries; the file itself is not uploaded.
Typed entries, customers, suppliers, products, prices, obligations, levies, staffWhat you typeOn your phone.

Every entry carries a provenance tag (which lane, when) and a confirmation state. Biz+ proposes; you confirm.

3. Where your ledger lives

Your ledger — every entry, every customer balance, every cash close, every report you have built — is stored on your phone, in the app’s own storage. Korevra’s servers do not hold a copy; they hold only the slices described in section 4, and only when the feature that needs them runs. When you use Biz+ on the web the same applies: the ledger is in your browser’s storage on that device.

Because the ledger is on your phone, losing or wiping the phone loses the ledger unless you have exported it or switched on encrypted backup. Biz+ reminds you to export, and export is free on every plan.

4. What leaves your phone, and when

Each item below is sent only when the feature that needs it runs. Sample businesses never send anything. Nothing here includes an entry from your ledger.

4.1 Sign-in

If you create an account, we hold your e-mail address (or the e-mail address of the Google account you sign in with), your name if you give it, and an account identifier, using Firebase Authentication (Google). We use them to sign you in, to send the verification and account e-mails, and to tie your subscription to you. Biz+ works without an account.

4.2 Encrypted backup

If you switch on backup, Biz+ encrypts your ledger on the device with a key derived from a passphrase only you know, and stores the encrypted file on Korevra’s servers. Korevra cannot read it. If you forget the passphrase, nobody — including us — can recover the backup; that is the point.

4.3 The Loan-Ready Report

When you issue a Loan-Ready Report — whether it is included in Biz+ Pro or bought singly on the free plan — Biz+ builds it on the device and uploads it to Korevra in two parts, both with your consent on the issuance screen:

The raw ledger — the entries themselves — is not sent. Each recipient you name is a consent you can see and revoke in the app; revoking marks the report revoked on the verification page. Later edits to entries inside the report’s period are counted and flagged there — that is what makes the report tamper-evident. Each time a code is verified, Korevra logs the code, the time and a hashed form of the visitor’s address. When a report is issued, Korevra e-mails you its code and link.

4.4 Sponsor View

If you grant a sponsor access, Biz+ builds a read-only monthly summary of your business (sales, cash, stock value, capital injections tagged as sponsor capital, in the sponsor’s currency) for the link you share, so that the sponsor sees that picture and nothing else about your business. You can revoke the link at any time in More → Share with people.

4.5 Customer statements

If you send a customer a statement link, the entries for that customer only (what was sold on credit, what was paid, what remains) are made available at that link so that the customer can see and query what they owe. The link is revoked when you opt that customer out, and all statement links are removed when you delete your account.

4.6 Pay pages behind invoices

When you send an invoice, quote or job card from a signed-in account, Biz+ registers a pay page with Korevra under that invoice’s code so that your customer’s phone can open it. The page carries: your business name, the institution and last digits of the bank or wallet account you receive money into (never the full number), the amount outstanding, the invoice number and due date, and the item descriptions as a memo. Anyone who holds the link can open the page. Korevra hosts the page and never holds the money — the customer pays you directly into your own account. A card-or-transfer checkout by Paystack, a licensed payment service provider, appears on the page only when Korevra has enabled it; then Paystack receives the amount, a reference and the payer’s own details, and tells Korevra when the payment succeeded (the reference, the amount and the channel) so the page can show it as paid. Pay pages are removed when you delete your account.

4.7 Purchases

Subscriptions and single reports are bought through the app store where you installed Biz+. Korevra receives the store’s purchase token or receipt and the resulting entitlement; Korevra never sees your card or bank details.

5. The AI copilot

“Ask your business” answers every question on the phone, from your own ledger, and nothing leaves. The AI copilot — a Biz+ Pro feature; the server refuses the free plan — is the one part of Biz+ that sends your figures to a server, and only when you ask it a question. To write an answer, Biz+ sends a numbers snapshot, not the ledger:

The snapshot and your question go to Korevra’s server (Google Cloud, europe-west1) and on to Anthropic’s API (Claude) to produce the answer, with an opaque account identifier so that Anthropic can enforce its own abuse limits. Korevra does not keep the question, the snapshot or the answer — only a count of how many questions you have asked, with the time each took and the tokens used, for the plan limit (sixty a day). Under Anthropic’s API terms the content is not used to train models. On-device answers never leave the phone. The receipt reader in section 2 uses the same path: the photo alone is sent, read, and discarded.

Every capture lane and every recipient is a consent record in Biz+ (Compliance → Privacy), showing what you allowed, why, and when. Withdrawing a lane stops future capture through it; withdrawing a recipient stops future sharing with them. Sponsor and accountant links are revoked in More → Share with people. A report already issued stays verifiable as issued, because the lender may still hold it; it is not re-shared. You can also revoke notification access in your phone’s settings at any time.

7. How long we keep things

8. Deleting your account

More → Account → Delete my account (shown when you are signed in; confirm, then type DELETE) erases your ledger from this phone and, at once, asks Korevra’s servers to erase what they hold: your account record and everything under it (entitlement, report credits, backups, allowances and mail preferences), your copilot counters, your purchase records, the full body of every report you issued, and every sponsor link, statement link and pay page you own — and then the sign-in account itself. The issuance record of each report is kept for the retention period above, marked revoked, with your business name removed and no link to your account. If you never created an account, Wipe this phone (More → The fire-proof book) erases everything and there is nothing on our servers to delete. Details, including how to ask by e-mail, are on delete-account.html. Deleting the app or the account does not cancel a store subscription — cancel it in the store where you bought it.

9. Children

Biz+ is for business owners and their staff and is not directed at anyone under eighteen. We do not knowingly collect data from children; if you believe a child has created an account, write to us and we will delete it.

10. Where data is processed

Korevra’s servers run on Google Cloud in europe-west1 (Belgium); the AI copilot and the receipt reader are served by Anthropic in the United States. Transfers outside Nigeria are made under the safeguards the NDPA and GAID allow — standard contractual clauses with those providers and, for the copilot, your consent: the transfer notice in section 5 is shown, in your language, on the Biz+ Pro purchase screen above the buy buttons, and the copilot sends nothing until you ask it a question. Where Nigerian regulation requires particular data to be stored in-country by a set date, Korevra will comply by that date.

11. Security

Data in transit is encrypted with TLS; data at rest on Korevra’s servers is encrypted; backups are encrypted on your device before upload. Your ledger is a hash-chained journal, so an altered entry is detectable. Korevra’s databases are not reachable from the app directly — every server call is a signed, audited function. Staff you add get a role and a four-digit PIN that limits what they can do at the till; Biz+ has no app lock of its own, so use your phone’s own screen lock. No system is perfect; if something goes wrong, section 12 applies.

12. If there is a breach

If a breach of personal data occurs, Korevra will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, and will tell affected users without undue delay in plain language: what happened, what data was involved, what we have done and what you should do.

13. Your rights

Under the NDPA you may ask to see the personal data we hold about you, correct it, erase it, restrict or object to its processing, receive it in a portable form (Biz+ export does this in one tap), and withdraw consent at any time without affecting what was lawful before. Write to hello@korevra.com; we answer within thirty days. You may also complain to the Nigeria Data Protection Commission.

14. Phone permissions

Biz+ asks for permissions only when you use the feature that needs them: notification access (on phones that allow it) to read bank alerts; camera to snap receipts; microphone to speak entries; notifications for reminders the app composes on the phone (Biz+ registers no push token); files to save exports. Biz+ never asks for your contacts, your call log or your location, and never reads any notification from an app that is not a bank or wallet on its list.

15. Changes and contact

If this policy changes in a way that matters, Biz+ will show you the change in the app before it applies. Questions, requests and complaints: hello@korevra.com, subject “Privacy”.