Privacy Policy

We collect the information needed to create your account, fund your wallet, and complete the services you request.

Account information

• Phone number (used to register and sign in)
• Password (stored as a bcrypt hash, never in plain text)
• First name, last name, and email address
• Optional referral code
• Referral bonus credits when a referred user transacts
• Phone verification status and one-time passcodes we send to confirm it is you

Identity information

To activate a virtual bank account, you may provide a Bank Verification Number (BVN) or National Identification Number (NIN). We encrypt this number at rest with AES-256-GCM and never return it to the app or API clients. Flutterwave checks that number when the account is issued.

To raise gift-card and withdraw limits (Plus), you may complete a live selfie and government-ID check with Prembly IdentityPass. We store the verification result (passed or failed, and a provider reference). We do not store selfie or ID photos.

Financial and wallet information

• Wallet balances and ledger history
• Payment records processed through our payment partner (Flutterwave)
• Virtual account number, bank name, and account name assigned to you
• Transaction PIN (stored as a bcrypt hash)

Service data

When you pay bills or buy services — airtime, data, electricity, cable TV, betting wallets, exam pins, or gift cards — we collect the details required to fulfill that request, such as:

• Beneficiary names, phone numbers, and account identifiers
• Meter numbers, decoder numbers, and betting wallet IDs
• Transaction amounts, timestamps, status, and provider references
• Saved beneficiaries you choose to keep for reuse

Gift cards

If you buy or sell a gift card, we collect product details, face value, and any e-code or comments you submit so we can complete the trade with our gift-card partners. Delivered buy codes and PINs are encrypted at rest and shown to you only on your receipt after purchase. Sell codes are hashed before storage; we send the code to our partner only to complete verification.

Support

If you open a dispute, we collect the subject, description, and related transaction so we can investigate and respond.

Device and usage information

• IP address, browser type, and device information
• Login timestamps and session data
• If you enable notifications, we may store a device token to deliver them

We use the information we collect to:

• Create and maintain your account, wallet, and virtual account
• Process payments and fulfill airtime, data, utility, betting, exam-pin, and gift-card orders
• Verify your identity, send OTPs, and prevent fraud or abuse
• Send service messages such as receipts, security alerts, and dispute updates
• Provide customer support and resolve disputes
• Comply with Nigerian legal and regulatory obligations, including financial-record keeping
• Improve reliability and understand how the platform is used

We process personal data under the Nigeria Data Protection Act 2023 (NDPA) on these bases:

• Contract: to provide the wallet and bill-payment services you request.
• Legal obligation: to keep financial records and respond to lawful requests from authorities.
• Legitimate interest: to secure the platform, prevent fraud, and improve the service, where those interests are not overridden by your rights.
• Consent: where we rely on consent (for example, optional notifications). You may withdraw consent at any time.

We may share information with:

• Identity verification: Prembly IdentityPass, to run Plus KYC (government ID and live selfie matching) when you ask for higher limits.
• Payment processors: Flutterwave, to fund your wallet, issue virtual accounts, and send withdrawals to Nigerian bank accounts you provide (account number and resolved account name).
• Fulfillment partners: VTU and bill-payment aggregators that deliver airtime, data, electricity, cable, betting, and exam pins, including VTU.ng, Ogdams, Pairgate, VTPass, Ogdams, Pairgate, VTU.ng, and similar providers we route through.
• Gift-card partners: Prestmit and Reloadly, to buy or sell gift cards.
• Communications providers: Sendchamp (SMS OTPs) and Resend (email codes and messages).
• Infrastructure providers: cloud hosts that store and run the platform.
• Regulatory authorities: when required by law, court order, or governmental regulation.
• Business transfers: in connection with a merger, acquisition, or sale of assets.

We do not sell your personal information to third parties.

Some partners (including payment, gift-card, and communications providers) may process data outside Nigeria. When that happens, we take steps consistent with the NDPA so your information remains protected, including using providers that apply appropriate safeguards.

We implement industry-standard measures to protect your data: passwords and transaction PINs are bcrypt-hashed; BVN, NIN, and gift-card buy codes are encrypted at rest; sessions use secure tokens; API traffic is rate-limited to reduce abuse; and all traffic is served over HTTPS. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.

We use essential cookies to keep you signed in, including an httpOnly refresh-token cookie for your session. These cookies are required for the app to work. We also store your theme preference in local storage. We use privacy-friendly first-party analytics (Vercel Analytics) to understand page performance — not advertising trackers. You can block cookies in your browser, but you may not be able to stay signed in.

We keep your personal information while your account is active and as needed to provide the service. Financial transaction records are retained in line with applicable Nigerian law. When you delete your account in Settings, we anonymize or delete personal data we no longer need (such as name, phone, email, and identity details), except where we must keep records for legal, dispute, or fraud-prevention purposes.

Under the NDPA, you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Correction: request that we correct inaccurate or incomplete data.
• Deletion: request deletion of your personal data, subject to legal retention requirements.
• Restriction: request that we restrict processing of your data.
• Portability: request a machine-readable copy of your data.
• Withdrawal of consent: withdraw consent at any time where we rely on consent.

To delete your account yourself, sign in and go to Settings → Delete account, or follow the steps on our account deletion page. For other rights, or if you cannot sign in, email us at the address below.

Our services are not intended for anyone under 18. We do not knowingly collect personal information from children. If we learn that a child has provided personal data, we will take steps to delete it.

We may update this Privacy Policy from time to time. We will post the new policy on this page and update the "Last updated" date. Continued use of the platform after a change means you accept the updated policy.