RecoverKit

Privacy Policy

Last updated 12 November 2026

RecoverKit is operated by RecoverKit ("we", "us"). This policy explains what data RecoverKit handles at https://recoverkit.padiconnect.com, why, and the choices you have. It is written with the Nigeria Data Protection Act 2023 (NDPA) in mind.

Who is responsible for which data

  • Your RecoverKit account: for the details of the businesses and people who sign up to RecoverKit, we are the data controller.
  • Your customers' data: when a business connects its website, app, payment gateway or database, it decides what customer data RecoverKit processes and why. The business is the data controller and we process that data on its behalf, only to provide RecoverKit to that business.

What we collect

About account holders: email address, business name, the kind of payments you take, a password stored as a one-way scrypt hash, sign-in sessions, and a log of important account actions (such as sign-ins and settings changes) with the IP address.

Settings you enter: your writing voice, payment link, payment-gateway webhook secrets, messaging-provider keys and AI-provider keys. Secrets are encrypted with AES-256-GCM.

About a business's customers, when the business connects RecoverKit:

  • Identifiers: email addresses and phone numbers are turned into one-way hashes on the customer's device or the business's server before they reach us, and are hashed again on our server.
  • Contact details, only if the business chooses to share them so RecoverKit can send its messages: email, phone and first name, stored encrypted.
  • Activity: event types (such as signed up, started checkout, funded wallet, purchased), page paths with IDs and emails removed, amounts and times.
  • Messages: follow-up messages drafted, approved and sent, with their status, and replies received on WhatsApp.

We never collect card numbers, bank details, passwords of the business's customers, or the contents of forms they fill in.

Why we use it

  • to provide RecoverKit: find customers worth following up, draft messages, send the ones the business approves, and count recovered sales
  • to keep accounts secure: sign-in, password resets, rate limits and audit logs
  • to send service emails: invitations, password resets and notices about messages waiting for approval

The legal bases are performing our agreement with you, our legitimate interest in running a secure service, and, for a business's customers, the lawful basis the business has for contacting them.

We do not sell personal data, and we do not use it for advertising.

Who else is involved

Data only goes to providers that the business sets up, to do what the business asked:

  • messaging providers it connects, such as Meta (WhatsApp Cloud API), Termii (SMS) or Resend (email), to deliver approved messages
  • an AI provider it chooses, to draft messages. The model never receives names, emails or phone numbers.
  • payment gateways that send signed webhooks about payments
  • our hosting provider, which stores the service's data

We may disclose data where the law requires it.

How long we keep it

  • Activity events: deleted after 395 days.
  • Account and business data: kept while the account exists. When a business is deleted in Settings, its data is deleted.
  • Unconfirmed sign-ups: deleted once their confirmation link expires.
  • Database backups: kept for about 7 days.

Your rights

You can ask to access, correct or delete your data, object to processing, or ask for a copy. Customers of a business can ask that business, which can delete a person instantly with RecoverKit's erasure feature, or ask us. Anyone can stop follow-up messages with the unsubscribe link in each message, or by replying STOP on WhatsApp. To use your rights, use the contact details on https://recoverkit.padiconnect.com. You can also complain to the Nigeria Data Protection Commission.

Cookies and similar technology

The RecoverKit dashboard uses one essential cookie to keep you signed in. The website script a business installs keeps a random anonymous ID in the visitor's browser storage, and does nothing if the visitor's browser asks not to be tracked (Do Not Track or Global Privacy Control).

Security

We use encryption for stored secrets and contact details, hashed identifiers, signed webhooks, strict browser security headers, and rate limits. No system is perfectly secure; if a breach affects you, we will tell you and the regulator as the NDPA requires.

Children

RecoverKit is a business service and is not meant for children.

Changes

We will update this page when our practices change, and change the date below.

Last updated: 12 November 2026.