Privacy Policy

We collect the information needed to create your account, fund your wallet, and complete the services you request.

Account information

• Phone number (used to register and sign in)
• Password (stored as a bcrypt hash, never in plain text)
• First name, last name, and email address
• Optional referral code
• Referral bonus credits when a referred user transacts
• Phone verification status and one-time passcodes we send to confirm it is you

Identity information

To activate a virtual bank account, you may provide a Bank Verification Number (BVN) or National Identification Number (NIN). We encrypt this number at rest with AES-256-GCM and never return it to the app or API clients.

Financial and wallet information

• Wallet balances and ledger history
• Payment records processed through our payment partner (Flutterwave)
• Virtual account number, bank name, and account name assigned to you
• Transaction PIN (stored as a bcrypt hash)

Service data

When you pay bills or buy services — airtime, data, electricity, cable TV, betting wallets, exam pins, or gift cards — we collect the details required to fulfill that request, such as:

• Beneficiary names, phone numbers, and account identifiers
• Meter numbers, decoder numbers, and betting wallet IDs
• Transaction amounts, timestamps, status, and provider references
• Saved beneficiaries you choose to keep for reuse

Gift cards

If you buy or sell a gift card, we collect product details, face value, and any e-code or comments you submit so we can complete the trade with our gift-card partners.

Support

If you open a dispute, we collect the subject, description, and related transaction so we can investigate and respond.

Device and usage information

• IP address, browser type, and device information
• Login timestamps and session data
• If you enable notifications, we may store a device token to deliver them

We use the information we collect to:

• Create and maintain your account, wallet, and virtual account
• Process payments and fulfill airtime, data, utility, betting, exam-pin, and gift-card orders
• Verify your identity, send OTPs, and prevent fraud or abuse
• Send service messages such as receipts, security alerts, and dispute updates
• Provide customer support and resolve disputes
• Comply with Nigerian legal and regulatory obligations, including financial-record keeping
• Improve reliability and understand how the platform is used

We process personal data under the Nigeria Data Protection Act 2023 (NDPA) on these bases:

• Contract: to provide the wallet and bill-payment services you request.
• Legal obligation: to keep financial records and respond to lawful requests from authorities.
• Legitimate interest: to secure the platform, prevent fraud, and improve the service, where those interests are not overridden by your rights.
• Consent: where we rely on consent (for example, optional notifications). You may withdraw consent at any time.

We may share information with:

• Payment processors: Flutterwave, to fund your wallet, issue virtual accounts, and send withdrawals to Nigerian bank accounts you provide (account number and resolved account name).
• Fulfillment partners: VTU and bill-payment aggregators that deliver airtime, data, electricity, cable, betting, and exam pins, including VTU.ng, Ogdams, Pairgate, VTPass, CheapDataHub, ClubKonnect, and similar providers we route through.
• Gift-card partners: Prestmit and Reloadly, to buy or sell gift cards.
• Communications providers: Sendchamp (SMS OTPs) and Resend (email codes and messages).
• Infrastructure providers: cloud hosts that store and run the platform.
• Regulatory authorities: when required by law, court order, or governmental regulation.
• Business transfers: in connection with a merger, acquisition, or sale of assets.

We do not sell your personal information to third parties.

Some partners (including payment, gift-card, and communications providers) may process data outside Nigeria. When that happens, we take steps consistent with the NDPA so your information remains protected, including using providers that apply appropriate safeguards.

We implement industry-standard measures to protect your data: passwords and transaction PINs are bcrypt-hashed; BVN and NIN are encrypted at rest; sessions use secure tokens; and all traffic is served over HTTPS. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.

We use essential cookies to keep you signed in, including an httpOnly refresh-token cookie for your session. These cookies are required for the app to work. We also store your theme preference in local storage. We do not currently use third-party analytics or advertising cookies. You can block cookies in your browser, but you may not be able to stay signed in.

We keep your personal information while your account is active and as needed to provide the service. Financial transaction records are retained in line with applicable Nigerian law. If you ask us to delete your account, we will delete or anonymize personal data we no longer need, except where we must keep it for legal, dispute, or fraud-prevention purposes.

Under the NDPA, you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Correction: request that we correct inaccurate or incomplete data.
• Deletion: request deletion of your personal data, subject to legal retention requirements.
• Restriction: request that we restrict processing of your data.
• Portability: request a machine-readable copy of your data.
• Withdrawal of consent: withdraw consent at any time where we rely on consent.

To exercise any of these rights, including an account-deletion request, email us at the address below.

Our services are not intended for anyone under 18. We do not knowingly collect personal information from children. If we learn that a child has provided personal data, we will take steps to delete it.

We may update this Privacy Policy from time to time. We will post the new policy on this page and update the "Last updated" date. Continued use of the platform after a change means you accept the updated policy.