Privacy Policy

1. Who We Are

iPay NG is a CAC-registered Nigerian digital payment platform that allows users to purchase airtime, data bundles, pay utility bills, fund betting wallets, buy gift cards, and access other VTU services. References to "we", "us", or "our" in this document refer to iPay NG.

For privacy enquiries, contact us at [email protected] or via WhatsApp.

2. Information We Collect

We collect only the information necessary to provide our services and keep your account secure.

Data Type	What We Collect	Why
Account Info	First name, last name, email address, phone number, hashed password	To create and identify your account
Transaction Data	Service type, amount, recipient details, timestamp, and outcome	Service delivery, receipts, and dispute resolution
Wallet Funding	Payment reference numbers and amounts from our payment partners	To verify and credit your wallet. We never store card details
Cashback & Referrals	Bonus credits earned, withdrawal history, referral activity	To accurately track and pay your earned rewards
KYC Documents	Government-issued ID (where required for verification)	Identity verification and regulatory compliance
Technical Data	IP address, device type, browser information	Fraud detection, debugging, and performance improvement

3. How We Use Your Information

• To process and deliver the services you request on the platform
• To send transaction receipts, OTP codes, and account notifications
• To calculate and credit cashback rewards and referral bonuses
• To verify your identity and comply with Nigerian financial regulations (including NDPR)
• To detect, prevent, and investigate fraud or unauthorised access
• To resolve disputes and respond to support enquiries
• To improve our platform, features, and overall user experience

4. How We Share Your Information

We do not sell, rent, or trade your personal information. We share data only in the following limited circumstances:

• Payment processors — to facilitate wallet funding (e.g., Monnify, PalmPay)
• VTU service providers — to deliver airtime, data, electricity tokens, cable TV renewals, exam PINs, and other services to the correct network or provider
• Legal authorities — when required by Nigerian law, a court order, or to prevent fraud and protect users

All third parties are contractually required to handle your data securely and only for the purpose for which it was shared.

5. Data Security

We apply industry-standard security measures to protect your data at every layer:

• All data in transit is encrypted via HTTPS (TLS)
• Passwords are stored as irreversible bcrypt hashes — plain-text passwords are never stored
• Transaction PINs are hashed and verified without ever being stored in plain text
• Every financial operation requires PIN authorisation at the application level
• We apply rate limiting and login lockouts to prevent brute-force attacks
• Sensitive operations use atomic database transactions to prevent partial state and fund leakage

6. Data Retention

Your account data is retained for as long as your account remains active. Transaction records — including cashback history and referral logs — are kept for a minimum of 7 years in compliance with Nigerian financial record-keeping regulations, even after account closure.

When data is no longer required, it is securely deleted or anonymised.

7. Your Rights

Under the Nigeria Data Protection Regulation (NDPR), you have the following rights regarding your personal data:

To exercise any of these rights, contact us at [email protected]. We will respond within 14 business days.

8. Cookies

We use a single session cookie strictly to maintain your authenticated login session. This cookie contains no personal information beyond a session identifier. We do not use advertising cookies, tracking pixels, or third-party analytics tools that profile your behaviour.

9. Children's Privacy

iPay NG is not intended for persons under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has registered on our platform, please contact us immediately and we will promptly investigate and remove the account.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services or legal requirements. We will notify registered users of any material changes via email and/or an in-app notice at least 7 days before they take effect. Continued use of the platform after that date constitutes acceptance of the revised policy.