Privacy Policy

Last Updated: September 2026

This document explains: (a) the personal data we collect; (b) why and how we use it; (c) with whom we share it (only vetted sub-processors — we never sell); (d) how long we retain it; and (e) your rights and how to exercise them, including permanent in-app account deletion.

1. Information We Collect

1.1 Account Onboarding & KYC Identity Verification

To create and secure your wallet and comply with Nigeria's Anti-Money Laundering (AML), KYC, and CBN rules, we may collect:

• Full legal name, a chosen username, active email address, and mobile phone number (verified via SMS OTP).
• Residential / contact address (optional at Tier 0; required for higher KYC tiers).
• BVN (Bank Verification Number) and/or NIN (National Identification Number) — required for certain tiers and high-value features (e.g., larger manual funding, bulk SMS sender-ID registration, recharge-card printing).
• Optional selfie photo / government ID for elevated tiers — used only for manual KYC review. We do not perform facial-recognition or biometric matching.

1.2 Transaction & Financial Data

• Wallet balance, virtual account numbers (SecureWave / Payment Points Pay — Kolomoni / Opay / Palmpay), bank-transfer records, and manual funding evidence/receipt uploads.
• All purchase history: airtime top-ups, mobile data bundles, cable/TV subscriptions, electricity bills (IKEDC/EKEDC/AEDC/IBEDC/KEDC/JEDC/BEDC/PHED/etc), WAEC/NECO/JAMB/NABTEB Educational pins, betting wallet top-ups (Bet9ja/SportyBet/King/BetKing/1xBet/etc.), Bulk SMS batches & sender-ID registrations, Airtime-to-Cash conversions, and Recharge-Card print voucher batches & PIN generations.
• Transaction amounts, timestamps, statuses, payment methods used, and the recipient phone/account numbers you authorise.

1.3 Authentication Credentials

• Transaction PIN (5-digit): used to authorise purchases, wallet transfers, Airtime-to-Cash, Bulk SMS, and Recharge-Card printing. Your raw PIN never leaves the device in plaintext — we store only a salted cryptographic digest.
• Device Biometrics (Fingerprint / Face): optional quick-unlock for the app. Templates never leave your device; they stay in the Android Keystore / iOS Secure Enclave. Permissions used: USE_BIOMETRIC, USE_FINGERPRINT (system-only).
• JWT access + refresh tokens for per-device authenticated sessions (rotated on every token refresh).

1.4 Device, Notifications & Technical Data

• Device model, OS version, screen, and app build for crash triage (Firebase Crashlytics).
• Firebase Cloud Messaging (FCM) push token — used solely for transaction receipts, KYC updates, service alerts, and occasional promotional offers (opt-out in Settings).
• Google AD_ID (Advertising ID) — collected by the Facebook SDK and Firebase Analytics only for install-attribution and ad-campaign measurement; you can reset or disable it in your device Google Settings → Ads.
• VIBRATE permission — used solely for haptic feedback on the numeric PIN keypad.
• POST_NOTIFICATIONS (Android 13+) — runtime permission to show FCM push alerts.
• Firebase Installation ID + IP address (for audit logging, velocity/fraud checks, and abuse prevention).

1.5 Storage & File Access

• Android 12 and below — READ_EXTERNAL_STORAGE (maxSdkVersion=32) only for the system document picker to attach KYC uploads and save receipt PDFs. WRITE_EXTERNAL_STORAGE is explicitly tools:node="remove"'d from the merged manifest.
• Android 13+ — Scoped Storage / App-Specific Storage only; no broad storage permission is requested.
• Receipts and generated recharge-card voucher PDFs live on your device only; you choose if/when to share them.

1.6 Permissions We Do NOT Use

2. How We Use Your Information

• Identity & Access: open, authenticate, recover, and secure your allcheapestdata account; verify ownership of phone number, email, BVN, and NIN.
• Service Delivery: vend airtime, mobile data, cable/TV subscriptions, electricity & utility bills, educational pins, betting top-ups, bulk SMS, recharge-card vouchers, Airtime-to-Cash, and manual-wallet funding flows.
• Risk, AML & Fraud: velocity checks, sanctions/PEP screening, duplicate-Webhook 4-layer defence (HMAC + row locking + composite UNIQUE + provider transaction IDs), and manual compliance review as required by CBN/NDPR.
• Wallet & Recharge-Card Printing: ledger entries for generated voucher batches, batch statuses, and per-pin redemption audit logs.
• Support: investigate complaints, issue reversals/refunds, and reply to in-app support chat and WhatsApp/Telegram bot queries.
• Push Notifications: transaction receipts, KYC approvals/rejections, service alerts, and offers. Opt out any time in Settings.
• Performance: crash triage and slow-device optimisation (Firebase Crashlytics/Performance).
• Attribution: install-campaign measurement (Facebook SDK / AD_ID); individual user-level attribution records deleted after 180 days.

3. Third-Party Sub-Processors & Data Sharing

We never sell your personal information. We only share personal data with vetted, contractually-bound sub-processors, each under a Data Processing Agreement (DPA) or equivalent Standard Contractual Clauses:

• Virtual-Account & Wallet Partners — SecureWave (Kolomoni), Payment Points Pay (Opay / Palmpay virtual accounts). Data: name, phone, KYC level, tx amounts, virtual account numbers.
• Data/Airtime/Bills/Cable/Edu-Pin/Betting/Bulk-SMS Aggregators / Hubs — data-plan networks (MTN/GLO/Airtel/9mobile), DStv/GOtv/Startimes/Showmax cable hubs, electricity disco APIs, WAEC/NECO/JAMB/NABTEB educational pin vendors, betting provider funding APIs, bulk-SMS gateway partners, recharge-card print / pin-generation engines. Data: recipient number/account id, amount, product code, tx reference.
• KYC Vendor — Prembly / VerifyMe / Smile Identity (or current CBN/NITDA-approved vendor) for BVN/NIN lookups and optional ID OCR/liveness. Data: BVN/NIN digits, name, DOB, uploaded ID photo, selfie.
• Google Firebase (Google LLC) — phone OTP auth, FCM push, Crashlytics, Performance, Remote Config, Cloud Storage for optional KYC uploads. Privacy.
• Facebook Meta SDK — install attribution and advertiser-id collection. Privacy. Disable in-app via Settings → Disable Analytics.
• Backend Servers (Laravel / PostgreSQL, VPC hosted) — TLS 1.3 in transit, AES-256-GCM at rest for PII columns, daily encrypted backups rotated after 90 days.

Legal Disclosure: we will disclose personal information only when compelled by a valid Nigerian court order, CBN directive, NDPB subpoena, or EFCC/ICPC investigation — always after verifying authority and, where lawful, notifying you first.

4. Data Retention

• Financial ledger & transaction history: 7 (seven) years from the last transaction — mandatory CBN / AML / BOFIA 2020 retention. We cannot shorten this even on request.
• KYC documents (selfies, ID photos, BVN/NIN match reports): 7 years from account closure, then cryptographic erase + tape overwrite.
• Account profile (name, email, phone, address, username, PIN digest): permanent irreversible hard delete within 30 calendar days of a valid deletion request, minus the 7-year ledger fields above.
• FCM push tokens & installation-ids: deleted within 7 days of logout or permission revocation.
• Crash/performance data (Firebase): auto-retired after 90 days.
• Facebook install-attribution: de-identified after 180 days.
• Biometric templates: never stored on our servers at all.

5. Your Rights & Account/Data Deletion (Google Play Compliant)

We provide THREE valid methods to request permanent account and data deletion. Any of them counts as a "submitter-initiated request" under Google Play rules:

1. In-app (Recommended): allcheapestdata → Me (Tab) → Settings → "Delete My Account". Opens a confirmation flow requiring your account password; on success your request is time-stamped and queued immediately.
2. Email: send a signed request from the email on file to privacy@allcheapestdataapi.com with subject: "GDPR / NDPR Erasure Request — [Full Name]".
3. Support Chat: send "delete my account" inside the in-app Help Centre chat or WhatsApp bot; an agent verifies 2FA before opening the ticket.

We will: (1) acknowledge within 48 hours; (2) return any residual wallet balance via bank transfer or reversal to the last funding source (per your instructions); (3) complete the hard-delete within 30 calendar days (minus the 7-year ledger hold above); (4) email a final deletion confirmation.

6. Data-Subject Rights (NDPR / GDPR)

• Right of Access (Art. 16 NDPR / Art. 15 GDPR): free JSON export of all personal data we hold, once per 12 months.
• Right to Rectification (Art. 17 NDPR / Art. 16 GDPR): update name, phone, email, and address in Me → Edit Profile.
• Right to Erasure — "Right to Be Forgotten" (Art. 18 NDPR / Art. 17 GDPR): see §5.
• Restriction, Portability, Objection: write to privacy@allcheapestdataapi.com.
• Opt-out of Push: Settings → Notifications toggle off, or revoke POST_NOTIFICATIONS in Android App Info.
• Opt-out of Analytics / AD_ID: Settings → Disable Analytics & Ad-Tracking.
• Revoke any runtime permission (Storage, Notifications, Biometrics) in Android Settings → Apps → allcheapestdata → Permissions.
• Regulator complaint: Nigeria Data Protection Bureau — ndpb.gov.ng.

7. Children & Age Policy

allcheapestdata is a regulated financial service. By creating an account you confirm you are 18 years or older. We do not knowingly collect data from children under 13 (COPPA threshold) or minors under 18. If a minor account is discovered we will: freeze it; refund any balance to a parent/legal guardian (upon proof of guardianship); and permanently delete all PII within 14 days (except the 7-year ledger hold). Report to privacy@allcheapestdataapi.com.

8. Cross-Border Data Transfers

Some sub-processors (Firebase, Facebook) process data outside Nigeria (EEA / UK / US). Cross-border transfers use Article 37 NDPR safeguards: EU Standard Contractual Clauses (SCCs 2021/914), Binding Corporate Rules, or a registered DPA with each processor. Request a copy via privacy@allcheapestdataapi.com.

9. Security

• Transport: HTTPS TLS 1.3; certificate pinning on API endpoints.
• At rest: AES-256-GCM for BVN, NIN, phone, email, address, card mask, PIN digest.
• Auth: per-device refresh-token rotation; JWT with short-lived access tokens; PIN + OTP for every high-sensitivity transaction.
• Passwords & PINs: bcrypt / PBKDF2-HMAC-SHA256, ≥120,000 work factor, unique 16-byte salt per user.
• Hosting: private VPC; WAF + rate-limiting on every edge route; quarterly penetration tests by an NITDA-approved CERT firm.
• Webhook Checkmate: HMAC-SHA256 timing-safe signature verification + DB transaction with lockForUpdate() + composite unique (gateway, transaction_id) + provider idempotency checks.

We will notify you and the NDPB within 72 hours of any personal-data breach posing a high risk to your rights (Art. 40 NDPR).

10. Contact the Data Protection Officer

11. Changes to This Policy

We may occasionally update this policy to reflect new services (e.g., new educational exams, new betting providers, new disco bills), new vendors, or regulatory changes. Material updates are communicated via in-app banner, push, and/or email. Continued use after the Last-Updated date = acceptance.