This policy explains how Mosh HR ("Mosh", "we", "us") collects, uses and protects personal data when you visit moshhr.com, use the Mosh app at app.moshhr.com, or contact us. Mosh is a product of Gresh Global Enterprise (RC 9902078), 2 Oyinkansola Williams Street, KayFarm Estate, Obawole, Lagos, Nigeria.
We follow the Nigeria Data Protection Act 2023 (NDPA) and the guidance of the Nigeria Data Protection Commission (NDPC).
- 1. Our role
- 2. Data we collect
- 3. How we use it
- 4. Lawful bases
- 5. Who we share it with
- 6. International transfers
- 7. Security
- 8. How long we keep it
- 9. Your rights
- 10. AI features
- 11. Children
- 12. Changes and contact
1. Our role
When you use our website or sign up for an account, Gresh Global Enterprise is the data controller for your data.
When a company uses Mosh to manage its staff, that company (our customer) is the data controller for its employees' data, and we act as its data processor. We process employee data only on the customer's instructions and to provide the service. If you are an employee and want to access or correct your data, please contact your employer first. We will help them respond.
2. Data we collect
Data you give us
- Account details: name, work email, phone number, company name and team size.
- Messages: anything you send through our contact, careers or mailing list forms, or by email or WhatsApp.
- Billing details: plan, billing period and payment status. Card and bank payments are handled by our payment provider, Flutterwave. We do not store full card numbers.
Data our customers put into Mosh
- Employee profiles: names, contact details, job titles, departments, start dates and reporting lines.
- Payroll data: salary, allowances, deductions, tax and pension identifiers, and bank account details.
- HR records: onboarding tasks, documents and e-signatures, leave, appraisals, KPIs and wellbeing check-ins.
Data collected automatically
- Basic technical data such as IP address, browser type, device and pages visited, used for security and to keep the site running.
- Cookies and similar technologies, as explained in our cookie policy.
3. How we use it
- To create and run your account and provide Mosh's features, including onboarding, payroll, leave and appraisals.
- To calculate payroll and verify bank account names before payments.
- To send service emails, such as sign-in codes, onboarding invites and billing notices.
- To respond to your messages and support requests.
- To send our mailing list, if you joined it. You can unsubscribe at any time.
- To keep Mosh secure, prevent fraud and fix problems.
- To meet legal, tax and accounting obligations.
We do not sell personal data. We do not use customers' employee data for advertising.
4. Lawful bases
Under the NDPA we rely on: contract (to provide the service you signed up for), legitimate interests (to secure and improve Mosh and respond to enquiries), legal obligation (tax and accounting records) and consent (for our mailing list and non-essential cookies). You can withdraw consent at any time.
5. Who we share it with
We use carefully chosen service providers to run Mosh. They may only use data to provide their service to us.
| Provider | Purpose |
|---|---|
| Supabase | Database, authentication and file storage |
| Cloudflare | Website hosting, security and email routing |
| Resend | Sending service emails |
| Flutterwave | Subscription payments |
| Paystack | Bank account name verification |
| AI model provider | Onboarding checklists, the HR Copilot and document drafting |
| Google Fonts | Serving the typeface on our website |
We may also share data if the law requires it, to protect our rights or users' safety, or as part of a business sale or restructuring, in which case we will tell you.
6. International transfers
Some providers store or process data outside Nigeria. Where that happens, we rely on the safeguards allowed by the NDPA, such as adequacy, contractual protections and the providers' own security commitments.
7. Security
We protect data with encryption in transit, row-level security that keeps each company's data separate, private file storage scoped to each company, passwordless sign-in with one-time codes, and server-side controls for sensitive actions such as removing staff. No system is perfectly secure. If we become aware of a breach that affects you, we will notify you and the NDPC as the law requires.
8. How long we keep it
- Account and HR data: for as long as the customer's account is active. After an account is closed, we delete or anonymise it within 90 days, unless the law requires us to keep it longer.
- Payroll and billing records: for up to six years, to meet tax and accounting rules.
- Enquiries: up to 24 months after our last contact.
- Careers talent pool: up to 12 months, unless you ask us to delete it sooner.
- Mailing list: until you unsubscribe.
9. Your rights
Under the NDPA you can ask to access, correct or delete your data, object to or restrict how we use it, receive a copy in a portable format, and withdraw consent. Email [email protected] and we will respond within the time the law allows. If you're not happy with our answer, you can complain to the Nigeria Data Protection Commission.
10. AI features
Mosh uses AI for onboarding checklists, the HR Copilot and document drafting. When you use these features, we send our AI model provider only the information needed for that request, such as a role title or the team data relevant to your question. AI output is a starting point, so please review it before relying on it.
11. Children
Mosh is a business tool and is not meant for anyone under 18. We do not knowingly collect children's data.
12. Changes and contact
We may update this policy as Mosh changes. We'll post the new version here and, for important changes, let account holders know by email.
Questions? Contact Gresh Global Enterprise at [email protected], call +234 913 915 2724, or write to 2 Oyinkansola Williams Street, KayFarm Estate, Obawole, Lagos.