Last Updated: July 1, 2026 | Servana Nigeria (Nortbitech Groups) | support@servana.ng

Data Retention Policy

This Data Retention Policy explains how long Servana retains different categories of personal and transactional data, when data is deleted, and what happens upon account deletion. This policy supports our compliance with the Nigeria Data Protection Regulation (NDPR) and financial record-keeping requirements.

1. Retention Principles

We retain data only as long as necessary for the purposes described in our Privacy Policy, or as required by law. When data is no longer needed, it is securely deleted or anonymized.

2. Retention Periods by Data Category

Account & Profile Data

• Active accounts: Retained while your account is active
• Deleted accounts: Personal identifiers removed after 14-day grace period; see Account Deletion Policy
• Profile photos: Deleted upon account deletion

Transaction & Financial Records

• Orders, bookings, payments: 7 years (tax and financial compliance)
• Wallet transactions: 7 years
• Invoices and receipts: 7 years
• Refund records: 7 years

KYC & Identity Documents

• Active verified accounts: Retained while account is active and verification is valid
• Deleted accounts: Document files removed from active storage upon deletion; metadata retained in anonymized form for regulatory period
• Rejected submissions: Deleted within 90 days

Communication Data

• In-app chat messages: 2 years after last activity in conversation
• Support tickets: 3 years after resolution
• Email and SMS logs: 2 years
• Push notification logs: 1 year

Technical & Security Data

• Security and access logs: 2 years
• Crash reports and diagnostics: 1 year
• IP address logs: 1 year
• Device tokens (FCM): Deleted upon account deletion or token invalidation

Marketing & Analytics

• Marketing consent records: Until consent is withdrawn, plus 1 year
• Promotional engagement data: 2 years
• Anonymized analytics: Indefinitely (no personal identifiers)

3. Anonymization

When personal data must be retained for legal or business purposes after account deletion, we anonymize it by removing all identifiers that could link the data to you. Anonymized data is used only for aggregate analytics, fraud prevention patterns, and regulatory reporting.

4. Data Deletion Process

Upon account deletion request:

1. Account enters 14-day grace period (cancellable)
2. After grace period, personal identifiers are permanently deleted
3. KYC document files are removed from active storage
4. Authentication tokens and session data are invalidated
5. Transaction records are anonymized and retained per legal requirements

5. Legal Holds

Data subject to legal proceedings, regulatory investigation, or law enforcement requests may be retained beyond standard periods until the matter is resolved.

6. Your Rights

You may request deletion of your data at any time via Settings → Delete Account or by emailing privacy@servana.ng. You may also request a copy of your data via Settings → Privacy → Export Data or GET /api/privacy/export.

7. Contact

Data protection inquiries: privacy@servana.ng

---

Questions? Contact support@servana.ng or privacy@servana.ng.