Privacy Policy
Last updated: 5 November 2026
This document is published in English.
Coopadi is a cooperative management platform operated by Trivet Labs (CAC registration number 3164913), referred to here as "Trivet Labs", "we" or "us". Cooperative officers and auditors use Coopadi on the web, and members use it through the mobile app. This policy explains what personal data passes through Coopadi, why we use it, who receives it and what rights you have under the Nigeria Data Protection Act 2023 ("NDPA").
1. Who is responsible for your data
Each cooperative decides which member information to record and why. The cooperative is the data controller for its member and financial records, and Trivet Labs processes those records on its behalf as a data processor. If you are a member, your cooperative is usually the best first contact for questions about your records, and we will help it respond.
Trivet Labs is the data controller for visitors to our website, for officer accounts and cooperative applications, and for billing, support and security records.
2. The data we handle
- Cooperative applications: the cooperative's details, its officers' contact details and the supporting documents submitted when it applies to use Coopadi.
- Officer and auditor accounts: name, contact details, role and sign-in credentials.
- Member profiles: name, member number, joining date, phone number, email address, home address, state, employee ID, photo, preferred language and next of kin details, plus any extra fields the cooperative chooses to add.
- Financial records: contributions, shares, loans, repayments, guarantors, fines, dividends, statements and receipts.
- Documents: forms, payment evidence and other files uploaded by a member or officer.
- Billing records: subscription plan, invoices, payment status and transaction references. Card details are entered with our payment processor and we do not store them.
- Technical and security data: IP address, browser or device details, a record of actions taken in the account, app installation ID, push notification token and when the app was last used.
- Support messages: anything you send us when you ask for help.
Coopadi does not ask for a Bank Verification Number (BVN) or National Identification Number (NIN) as standard. A cooperative can add its own member fields and should only collect what it genuinely needs.
If you turn on fingerprint or face unlock in the mobile app, your device performs the check. We do not receive your biometric data.
3. Where the data comes from
We receive data from you, from your cooperative's officers (including spreadsheets and payroll files they import), from other members who name you as a guarantor or next of kin, and from our payment processors. Technical data is collected automatically when you use Coopadi. If you give us details about another person, such as your next of kin, please let them know.
4. Why we use it and our lawful basis
Where we act as a processor, we use member data only to provide Coopadi to the cooperative, and the cooperative is responsible for its own lawful basis. Where we act as a controller, we rely on the following bases:
- Performing a contract: providing accounts, reviewing cooperative applications, billing and support.
- Legal obligation: keeping required records and responding to lawful requests from authorities.
- Legitimate interests: securing the service, preventing fraud, keeping an audit trail, and fixing and improving Coopadi.
- Consent: optional features such as push notifications. You can withdraw consent at any time in the app or your device settings.
We do not use member data for advertising, and we do not sell personal data.
5. Who can see it
- Your cooperative: its officers and auditors, according to the role each one holds.
- Other members: only what is needed for a specific purpose, such as the loan details a guarantor needs in order to decide.
- Trivet Labs staff: authorised staff, where needed for onboarding, support or security.
- Service providers: companies that help us run Coopadi, under contract and only for that purpose. They include payment processors (Paystack and Flutterwave), file storage (such as Cloudinary), hosting, email delivery and push notification services (Expo, Apple and Google).
- Authorities: regulators, law enforcement or courts, where the law requires it.
- A successor: a buyer or successor business if Trivet Labs is reorganised or sold, subject to this policy.
6. International transfers
Some of our service providers may store or process data outside Nigeria. Where that happens, we rely on the transfer grounds and safeguards the NDPA allows.
7. How long we keep it
We keep a cooperative's records for as long as it uses Coopadi. Financial entries are not edited or removed, because corrections are recorded as reversals to keep the ledger accurate. This means individual financial records generally cannot be erased while the cooperative remains active.
When a cooperative leaves Coopadi, it has 90 days to export its data. We then delete or anonymise that data, except records we must keep by law or need for a legal claim. Copies in backups are removed as those backups are replaced. We keep our own billing and business records for as long as tax and accounting laws require.
8. How we protect it
We use measures such as encrypted connections, hashed passwords and PINs, role-based access, separation of each cooperative's data and an audit trail of account activity. No system is completely secure, so please keep your credentials private and tell us immediately if you suspect misuse.
If a personal data breach occurs, we will notify the affected cooperative without undue delay. Where we are the controller and the law requires it, we will notify the Nigeria Data Protection Commission ("NDPC") within 72 hours and tell the people affected.
9. Your rights
Subject to the NDPA and other laws, you have the right to:
- get a copy of your personal data and information about how it is used;
- correct data that is inaccurate or incomplete;
- ask for your data to be deleted, or its use to be restricted;
- object to processing, and receive your data in a portable format;
- avoid decisions with significant effects being based solely on automated processing;
- withdraw consent where we rely on it; and
- complain to the NDPC.
Send requests to your cooperative or to us using the contact details below. We may need to confirm your identity, and we aim to respond within 30 days. We may be unable to fully meet a request where the law or a cooperative's record-keeping duties require us to keep the data.
10. Cookies and app permissions
Our website uses only the cookies it needs to work: one keeps you signed in and another remembers your language for up to a year. We do not use advertising or third-party analytics cookies.
The mobile app asks for permission before using your camera, photos, files, notifications or biometric unlock. You can refuse or change these permissions in your device settings, although some features may then not work.
11. Children
Coopadi is intended for people aged 18 or over. If you believe a child's data has been added without the consent of a parent or guardian, please contact us or the cooperative concerned.
12. Changes to this policy
We may update this policy and will change the date at the top when we do. We will tell you about significant changes by email or in the app before they take effect.
13. Contact us
Trivet Labs (CAC registration number 3164913) operates Coopadi. For privacy questions or requests, contact us here: