Privacy Policy

1. Who controls your information

The controller of personal information processed for Lenz depends on the service:

• US dollar accounts and visitors contracting with the US company: Clive Alliance LLC, 13012 Wilmslow Ct, Orlando, Florida 32832, United States. EIN 92-0357259. Florida document number L22000401378.
• United Kingdom: Clive Alliance Limited, company number 17076861, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.
• Nigeria, including naira accounts: Clive Alliance, registered with the Corporate Affairs Commission of Nigeria, operating from Victoria Island, Lagos, Nigeria.

Privacy requests go to privacy@lenzfinance.com. That address reaches the controller for the service the request is about. This policy is effective 19 October 2026.

2. Information we collect

Account and company information

Name, work email, phone number, role, and the company the person represents. For the company: legal name, trading name, registration or EIN, tax identifier, incorporation date, registered and operating address, industry, website, ownership, and a description of what the business does, where its money comes from, and the countries it deals with.

Identity information

For directors, signatories, and beneficial owners: date of birth, nationality, residential address, and a photograph taken in the product. Nigerians also provide a Bank Verification Number and a National Identification Number, which are checked with the national registries. A US person provides a Social Security number or ITIN. Anyone else provides a passport number. Signatories provide a specimen signature. We also collect the result of the check: match, mismatch, or unable to complete.

Financial information

Account numbers and routing details issued by the banking partner, balances, payments, payroll, invoices, beneficiaries, statements the Customer uploads, and the purpose and amount of expected activity declared at onboarding.

Information from systems the Customer connects

If the Customer connects Google, the connection can include billing-account metadata, Workspace domain and seat information, and, for Gmail, messages we search for invoices, receipts, and payment confirmations under the read-only scope the Customer approves. If the Customer connects Amazon Web Services, we receive Cost Explorer data through a role the Customer creates. We do not receive a broader set than the scopes shown before connection.

Device, security, and support information

IP address, browser type, approximate location derived from IP, sign-in events, passkey credentials, and the contents of messages the Customer sends to support, security, privacy, or complaints.

3. How we use it, and why

• To provide Lenz. Creating the workspace, showing balances, sending payments the Customer approves, running payroll, and issuing invoices. The legal basis is the contract.
• To verify the company and its people, and to prevent financial crime. The checks in the Business verification and AML and sanctions policies. The legal basis is our legal obligations, and our legitimate interest in not moving criminal funds where an obligation is not specific.
• To run intelligent features. Explaining the company’s position and drafting actions for a person to confirm. The legal basis is the contract. Amounts come from the books, not from the model.
• To keep the service secure. Detecting compromised sign-ins, abuse, and duplicate or altered payouts. The legal basis is legitimate interests, which we balance against the Customer’s rights.
• To respond to the Customer. Support, complaints, and security reports. The legal basis is the contract, or a legal obligation where the message is a complaint we must handle.
• To send product notices. Changes to terms, fees, and security alerts. The legal basis is the contract. Marketing email is sent only with consent, and every marketing email has an unsubscribe link.

4. Intelligent-system processing

Drafting and explanation use a language model reached through OpenRouter. The model receives only the organisation-scoped information needed for the question the user asked. It cannot call the bank, the ledger, the signer, or a payment network. Prompts and outputs are logged for security and support. We do not allow the model provider to use Customer content to train a public model. People who use Ask Lenz should not paste a secret that the question does not require.

5. Who we share information with

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

• The US banking partner when the Customer applies for or uses a US dollar account: the business, its owners and control persons, and the payment information the partner needs to open and operate the account.
• The Nigerian banking partner named at account opening (Zikora or SkyPay) for naira accounts, payments, and statements.
• Dojah for Bank Verification Number, National Identification Number, face match, liveness, corporate-registry, tax, and sanctions, politically exposed person, and adverse-media screening.
• Mailgun to deliver email, and Termii to deliver SMS verification codes in Nigeria.
• Google and Amazon Web Services, only after the Customer connects them, for the scopes the Customer approved.
• OpenRouter for the model calls described above.
• Google Cloud for file storage of documents the Customer uploads, and Vercel and our application host for serving the website and the product.
• Authorities when the law requires a report or a lawful request, including the Nigerian Financial Intelligence Unit and, for the US dollar program, FinCEN. We do not tell the Customer about a suspicious-activity report.

Staff see identity documents only when their role requires it, and that access is logged. A screening match is not shown to the Customer.

6. International transfers

Information is processed in Nigeria, the United States, and the United Kingdom, because that is where Clive Alliance operates and where the partners above are located. Where UK GDPR applies and we transfer personal information outside the United Kingdom, we use a lawful transfer mechanism, including the UK International Data Transfer Agreement or Addendum where the recipient is not in a country the United Kingdom has found adequate. Where the Nigeria Data Protection Act applies, cross-border transfers are made to a recipient that provides an adequate level of protection, or under another basis the Act allows, including the Customer’s explicit consent where that is the basis we rely on.

7. How long we keep it

• Identity, ownership, and transaction records: at least five years after the account closes, which is the period United States Bank Secrecy Act rules and Nigerian anti-money laundering rules require.
• Support and complaint correspondence: five years after the complaint is closed.
• Server logs that are not part of the financial record: 12 months.
• Marketing contact details: until the person unsubscribes, then a suppression record so we do not email them again.
• A workspace that never opened an account: company and identity data submitted in the application is deleted or irreversibly anonymised 24 months after the last activity, unless a screening match or a legal hold requires us to keep it.

8. Security

Bank Verification Numbers, National Identification Numbers, Social Security numbers, passport numbers, and identity documents are encrypted, masked in the interface, and stored apart from ordinary product data. One-time codes, passwords, and provider credentials are not written to application logs. Files sit in access-controlled storage. Customer and workforce sessions are separate. No method of transmission or storage is perfectly secure. Vulnerabilities should be reported to security@lenzfinance.com, as described on the Security page.

9. Your rights

Depending on where the person lives, they may have the right to access, correct, delete, or receive a copy of their personal information, to object to or restrict certain processing, to withdraw consent, and to complain to a regulator. A request goes to privacy@lenzfinance.com. We respond within 30 days. We may ask for information to confirm the requester’s identity. We may decline a deletion request where a financial-crime, tax, or accounting law requires us to keep the record, and we will explain that.

Nigeria

Rights under the Nigeria Data Protection Act, 2023, are exercised through the same address. A complaint may be made to the Nigeria Data Protection Commission, ndpc.gov.ng, after we have had a chance to resolve it.

United Kingdom

Rights under UK GDPR are exercised through the same address. A complaint may be made to the Information Commissioner’s Office, ico.org.uk. Clive Alliance Limited is the controller for personal information processed in the United Kingdom.

United States, including California

We do not sell personal information and we do not share it for cross-context behavioural advertising. A California resident may ask us to disclose the categories and specific pieces of personal information we hold, to correct it, and to delete it, subject to the retention rules above. We will not discriminate against a person for exercising these rights. We honour an opt-out preference signal as a request not to sell or share, which changes nothing in practice because we do not sell or share.

10. Children

Lenz is not for anyone under 18. We do not knowingly collect personal information from a child. If we learn that we have, we delete it, unless a record of a rejected application must be kept.

11. Cookies

Cookies and similar storage are described in the Cookie Policy.

12. Changes

We will post changes on this page with a new effective date. A material change is also notified by email or in the product at least 15 days before it applies.