Privacy Policy

1. Information We Collect

When you use FlashPay, we collect information that is necessary to provide you with financial services, verify your identity, and keep your account secure.

Information you provide directly:

• Full name, phone number and email address when you register
• A 6-digit login PIN and 4-digit transaction PIN that you create
• Bank Verification Number (BVN) and National Identity Number (NIN) for KYC verification
• Government-issued ID documents for full verification
• Profile information and preferences you set in the app

Information collected automatically:

• Transaction history including amounts, dates, recipients and bill payments
• Device information including device model, operating system version and unique device ID
• Login history including timestamps and device information for security monitoring
• App usage data to improve performance and user experience
• Push notification tokens to send you transaction alerts

Information we do NOT collect:

• Your biometric data. Fingerprint and Face ID data stays on your device only
• Your contacts or messages from your phone
• Your location data unless you specifically grant permission
• Any information from social media accounts

2. How We Use Your Information

We use the information we collect for the following purposes:

• To create and manage your FlashPay account
• To process transfers, bill payments, airtime purchases and other transactions
• To verify your identity and prevent fraud
• To send you transaction notifications, security alerts and account updates
• To provide customer support when you contact us
• To improve our app, detect bugs and enhance security
• To comply with Nigerian financial regulations and legal requirements
• To calculate and award your FlashPoints rewards

3. How We Share Your Information

FlashPay does not sell your personal data. We share your information only in the following limited circumstances:

Service providers:

• VTPass for processing airtime, data and bill payment transactions
• Flutterwave for processing bank transfer transactions
• Monnify for wallet funding and payment processing
• Supabase for secure database storage of your account data
• Brevo for sending transactional emails and OTP codes

Legal requirements:

• When required by Nigerian law or regulatory authorities
• To comply with the Central Bank of Nigeria (CBN) guidelines
• To respond to lawful requests from law enforcement agencies
• To protect the rights, property or safety of FlashPay and our users

All third party service providers are required to protect your data and use it only for the specific purpose we have engaged them for.

4. Data Security

We take the security of your data very seriously and use multiple layers of protection:

• Your PIN is hashed using bcrypt encryption and is never stored in plain text
• All data transmitted between your device and our servers is encrypted using HTTPS with 256-bit SSL
• JWT tokens with automatic expiry are used to secure every session
• Your account is locked after 5 incorrect PIN attempts to prevent unauthorized access
• Our systems use rate limiting and anomaly detection to identify and block suspicious activity
• All sensitive data is stored in encrypted databases with restricted access

While we take all reasonable measures to protect your data, no security system is completely impenetrable. We encourage you to use a strong unique PIN and enable biometric login for maximum protection.

5. Your Rights

Under the Nigeria Data Protection Act (NDPA), you have the following rights regarding your personal data:

• The right to access the personal data we hold about you
• The right to correct any inaccurate information in your account
• The right to request deletion of your account and personal data
• The right to object to how we process your data in certain circumstances
• The right to download a copy of your transaction history
• The right to withdraw consent for optional data processing at any time

To exercise any of these rights, contact our support team at privacy@flashpay.ng. We will respond to all data rights requests within 30 days.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you with services. Specifically:

• Account information is retained for the lifetime of your account
• Transaction records are retained for 7 years as required by Nigerian financial regulations
• Login history and security logs are retained for 12 months
• If you close your account, we delete your personal data within 90 days, except where we are required by law to retain it

7. Cookies and Tracking

The FlashPay mobile app does not use cookies. Our website may use essential cookies for functionality. We do not use tracking cookies for advertising.

We use anonymous analytics data to understand how users interact with our app and website so that we can improve the experience. This data does not identify you personally.

8. Third Party Services

FlashPay integrates with the following third party services to deliver our features. Each has their own privacy policy:

• VTPass (vtpass.com) for utility and airtime payments
• Flutterwave (flutterwave.com) for bank transfers
• Monnify (monnify.com) for wallet funding
• Supabase (supabase.com) for database and authentication infrastructure

We recommend reviewing the privacy policies of these services as they are separate from this policy.

9. Children's Privacy

FlashPay is a financial services app intended for adults aged 18 and above. We do not knowingly collect personal data from anyone under the age of 18.

If you believe a minor has created a FlashPay account, please contact us immediately at privacy@flashpay.ng and we will delete the account promptly.

10. Changes to This Policy

We may update this privacy policy from time to time as our services evolve or as required by law. When we make significant changes, we will notify you through the app and by email.

The date at the top of this policy indicates when it was last updated. Continued use of FlashPay after changes are posted means you accept the updated policy.

11. Contact Us

If you have any questions, concerns or requests regarding this privacy policy or how we handle your data, please contact us:

• Email: privacy@flashpay.ng
• Support: support@flashpay.ng
• Company: ESSENCE BUSINESS PLATFORM LIMITED
• Address: Ibafo, Ogun State, Nigeria