Privacy Policy

⚠️ This is clear, standard-for-category placeholder text aligned to the Nigeria Data Protection Regulation (NDPR) — not reviewed by legal counsel. Have a Nigerian-qualified lawyer review it before relying on it commercially.

1. Who we are & what this covers

SwiftSub ("we") is a virtual top-up platform. This policy explains what personal data we collect, why, how long we keep it, and the rights you have under the Nigeria Data Protection Regulation (NDPR) and the Nigeria Data Protection Act 2023.

2. Data we collect

• Account data — name, email, phone number, password (hashed), 4-digit transaction PIN (hashed).
• Identity data — BVN or NIN, only if you choose to upgrade your tier: we send it to our verification partner and store only the verification result (provider reference + verified-at) — the raw number is discarded and never stored.
• Transaction data — purchases, recipients (phone/meter/IUC numbers), amounts, references, vendor responses, IP address.
• Wallet data — balances and a complete immutable ledger of every debit/credit.
• Beneficiaries — numbers you explicitly save for quick-select.
• Support data — tickets and messages you send us.

3. Why we process it (lawful bases)

To perform the service you asked for (purchases, wallet), to meet legal and anti-fraud obligations (KYC, records), and — where you consent — to verify your identity for higher tiers. Consent can be withdrawn; withdrawing may limit tier features that require verification.

4. Who we share it with

• Payment gateway — to operate your dedicated funding account and process deposits.
• VTU vendors & network operators — only the details needed to deliver your purchase (e.g. phone number, plan).
• KYC verification partner — your BVN/NIN for tier verification, on your explicit request.
• Email provider — your email address for verification, receipts and password resets.
• Authorities — where required by Nigerian law or to prevent fraud.

We never sell your personal data.

5. Security & retention

Passwords and PINs are hashed (never readable, even to us). API keys are stored hashed. Financial records are retained as required by Nigerian financial regulations (commonly 6+ years); other data is kept only while your account is active or as needed for the purposes above.

6. Your rights

You may request access, correction, or deletion of your data, and object to certain processing. Note we cannot delete transaction/ledger records required by financial law, and deletion closes your account. To exercise any right, raise a ticket in-app — we respond within 30 days.

7. Cookies & local storage

We use only essential session storage (login, security tokens) and a local theme preference. No advertising or third-party tracking cookies.

8. Changes & contact

Material changes will be announced in-app. For privacy questions or complaints, raise a ticket or contact our support line. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC).