Privacy Notice
On this page 12 sections
Who we are
This Privacy Notice explains how Obivesta Limited, as operator of Paymarka, uses personal information when you visit our website, open an account, manage a workspace, receive a client link or contact support. It describes the information involved, why it is used, who may receive it, how long it is kept and the rights available to you.
Paymarka is operated by Obivesta Limited, a company registered in Nigeria (“Paymarka”, “we”, “us” or “our”). For privacy questions and requests, use the privacy contact form or email paymarkateam@gmail.com.
Who decides how data is used
For accounts, workspace administration, subscriptions, security, support, service analytics, abuse prevention and legal compliance, Paymarka decides how and why the information is used and acts as the data controller.
Some client and deal information is provided by the business using Paymarka (the “workspace customer”): its clients, proposals, contracts, invoices, payment proof and client-link activity. For that information the business ordinarily decides why it is used, and Paymarka processes it to deliver the service the business asked for. The business is responsible for its own instructions, lawful basis, accuracy and notices to its clients and team.
What we process
Depending on how you use Paymarka, we process account and contact details; workspace and client information; proposals, contracts, signatures, invoices, uploaded payment evidence and receipts; purchase and billing references; communications; and security or diagnostic information. In more detail:
- Account: name, email, password (stored only as a secure hash), email-verification status, workspace memberships, roles and invitations.
- Workspace profile: business name, country, address, contact details, logo, signature image, payment instructions, notification settings and branding.
- Clients and deals: client name, email, phone, company, address and notes; deal details, values, payment structures, milestones, negotiations, proposals, contracts, invoices and feedback.
- Signatures and evidence: signer name and email, typed or drawn signature, signing consent, document fingerprints (hashes), signing time, IP address and browser details, audit events, generated PDFs and uploaded files.
- Billing: plan, subscription and checkout references and status for Paymarka's own charges. Your clients' payments to you are made outside Paymarka; we record the references and proof you or they add.
- Communications: messages we send for you or to you, delivery status, and support or contact requests.
- Founding Users invitations: if we invite your business to try Paymarka, we keep the business name, contact name and email, business category, country, how we found you, and notes our team made from publicly available information when choosing to invite you. We record when the invitation is sent, when its page is opened (an approximate count, since some email apps open links automatically), when it is claimed, and how far the free deal has progressed. Invitation links are private and stop working once used, withdrawn or expired.
- Sample pack requests: if you ask for the sample documents on our home page, we keep your email address, when you asked, and whether you ticked the box to receive occasional Paymarka updates. Without that box ticked, we send you the samples and nothing else.
- Free proposal drafts on the home page: the job description and price you type are sent to our AI provider to write the draft. Paymarka does not save them; your IP address is held briefly to limit the number of free drafts.
- Security and diagnostics: request identifiers, pages and actions requested, IP address, browser details, sign-in and link-access events, and error information.
We receive this from you, from your workspace team, from the business that added you as a client, from signers, from our payment provider for Paymarka's own checkout, and from the browser or device you use.
Why we use it
We use this information to operate the service, deliver requested documents and notifications, maintain billing records, provide support, prevent abuse, secure accounts and meet legal obligations. The Nigeria Data Protection Act 2023 allows processing on the basis of consent, contract, legal obligation, vital interests, public interest, or legitimate interests that do not override your rights. We rely on the basis that actually applies:
- Providing Paymarka (accounts, workspaces, client links, documents, receipts): contract and legitimate interests.
- Sending service messages (verification, invitations, documents, reminders, receipts): contract and legitimate interests.
- Billing and fraud prevention: contract, legitimate interests and legal obligations.
- Security and accountability (permissions, sessions, rate limits, audit trails, incident response): legitimate interests and legal obligations.
- Improving the service (understanding which features are used): legitimate interests, or consent where the law requires it.
- Founding Users invitations (choosing who to invite, preventing misuse of free deals, and learning whether the pilot works): legitimate interests. You can ask us not to contact you again at any time.
- Sample pack: to send the documents you asked for, and to stop the form being used to flood someone's inbox: legitimate interests. Occasional updates only if you ticked the box: consent, which you can withdraw at any time through the privacy contact form.
- Marketing: only where you have agreed where that is required. You can object to direct marketing at any time.
Optional AI drafting and analytics involve additional processing, described below. We do not use AI to make decisions about people that have legal or similarly significant effects.
Who receives it
We share only what a provider needs to do its job, under contracts and instructions. Depending on the features in use, these include:
- Email delivery (Resend): recipient, sender, subject, message content and delivery status.
- Paymarka checkout (Paystack): references and status for Paymarka's own one-off and subscription payments. Paystack processes payment details under its own terms.
- File storage (Cloudinary): uploaded logos, signatures, PDFs, receipts and payment-proof files.
- AI drafting (OpenAI), when you use it: the deal, proposal or contract context you ask it to draft from. Don't include information you aren't authorised to share. AI output needs human review and is not legal advice.
- Product analytics (PostHog), where enabled: feature-use events, which can include workspace, user and deal identifiers.
- Website analytics (Google Analytics), only if you allow it: pages visited and key website actions.
- Hosting, database and infrastructure providers that run the service on our behalf.
We may also disclose information where the law requires it, to protect people or the service, or to establish, exercise or defend legal rights.
Processing outside Nigeria
We may use service providers that process information outside your country. Where a transfer is subject to data-protection rules, we assess and apply the safeguards required by applicable law, including the Nigeria Data Protection Act 2023 and the NDPC's General Application and Implementation Directive. Our list of providers and transfer arrangements is kept current as integrations change.
Your rights
You may have rights to access, correct, delete, restrict, object to or obtain a copy of personal information, and to withdraw consent where consent is the legal basis. Applicable rights and exceptions depend on the law and the processing involved.
For personal information kept by a business in its Paymarka workspace (for example, as one of its clients), you can contact that business first; we will assist where required. For Paymarka's own processing, use the privacy contact form. We may need to confirm your identity and will explain any lawful reason we cannot fully act on a request. You may also raise a complaint with the Nigeria Data Protection Commission or another competent authority where applicable.
Security and incidents
We protect information with access controls, permission checks, hashed passwords, session controls, rate limits and audit records. No internet-connected service can guarantee perfect security; see the Security Summary for more.
If we confirm a personal-data breach, we will investigate and contain it, keep the records the law requires, notify the Nigeria Data Protection Commission within 72 hours where the law requires it, and tell affected people in plain language where there is a high risk to them. To report a suspected incident, use the security report form.
How long we keep it
We keep information only as long as needed for the purpose it was collected for, including providing the service, accounting, security, legal obligations and resolving disputes. A workspace owner can delete the workspace from its settings. Some billing, security, audit or legally required records, and copies held by providers or backups, may take longer to remove or be kept for a lawful period. The Data Retention Policy explains this in more detail.
Children and sensitive information
Paymarka is a business tool and is not intended for children. Please don't enter sensitive personal information or a child's information unless you have a lawful need and the right safeguards in place. Contact us if you believe such information was added without a lawful basis.
Changes to this notice
We update this notice when our processing, providers, safeguards or the law change, and show the date of the latest version above. It is written with the Nigeria Data Protection Act 2023and the NDPC's General Application and Implementation Directive 2025 in mind.