Privacy Policy
Last updated: 8 October 2026
- We collect what we need to run a safe bill-payment service: your contact details, payment and bill details, transaction records and, if you verify, your NIN and a selfie.
- Card details are handled by our payment partner. We never see or store your full card number.
- We do not sell your data, and we do not use advertising or analytics trackers.
- You have rights under the Nigeria Data Protection Act 2023. Email [email protected] to use them.
1. Who we are
Egoyibo ("we", "us") is the data controller for personal data processed through egoyibo.com, app.egoyibo.com and the Egoyibo mobile apps (the "Service"). This policy explains how we handle personal data in line with the Nigeria Data Protection Act 2023 ("NDPA") and the regulations and guidance of the Nigeria Data Protection Commission ("NDPC").
For any privacy question or request, contact us at [email protected] with the subject line "Privacy".
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account details | Full name, email address, phone number, password (stored only as a secure hash), transaction PIN (stored only as a hash) | You |
| Top-ups | Amount, payment method type (card, transfer, USSD), the payment partner's transaction reference and status. Card details are entered on our payment partner's page, and we do not receive full card numbers. | You and our payment partner |
| Bill payments | Biller, phone, meter, smartcard or customer number you enter, the name the provider returns for it, tokens and receipts | You and bill providers |
| Bank details (for withdrawals) | Bank name, account number and the account name returned by the bank | You and our payment partner |
| Identity verification (optional, for higher limits) | National Identification Number (NIN, stored encrypted), the name, date of birth and photo returned for that NIN, a selfie you take in the app, and the face-match result | You and our identity-verification provider |
| Device and security | Trusted-device records, IP address, browser or app version, sign-in and security events, push-notification token | Your device |
| Communications | Emails and messages you send us, and our replies | You |
When you use fingerprint or face unlock in the app, that check happens on your phone. We never receive your fingerprint or face data from it.
3. How we use it, and our lawful basis
| Purpose | Lawful basis (NDPA s.25) |
|---|---|
| Run your account and balance, process top-ups, bill payments and withdrawals, send receipts and notifications | Performance of our contract with you |
| Prevent fraud and misuse of cards, apply limits, keep records, report to authorities where required | Legal obligation, and our legitimate interest in keeping the Service safe |
| Face matching of your selfie against your NIN photo (if you choose to verify) | Your explicit consent, and legal obligation |
| Secure your account (new-device codes, idle sign-out, PIN and biometric confirmation) | Legitimate interest and contract |
| Answer support requests and complaints | Contract and legitimate interest |
| Service updates and product news | Legitimate interest for service messages, and consent for marketing. You can opt out of marketing at any time. |
4. Who we share it with
- Payment partners (such as Flutterwave), to process top-ups, confirm bank account names and send withdrawals.
- Bill payment providers (such as Monnify and our data-bundle provider), to deliver the airtime, data, electricity or TV service you pay for.
- Identity verification provider, if you choose to verify, to look up your NIN against official identity records.
- Email delivery (Resend) for receipts and security emails, and push notifications (Google Firebase Cloud Messaging) in the mobile apps.
- Hosting, security and content delivery (including Cloudflare), which process technical data such as IP addresses.
- Authorities: regulators, law-enforcement agencies, courts and tax authorities, where the law requires or allows it.
- Professional advisers and, if Egoyibo's business is ever reorganised, sold or merged, the new owner under equivalent privacy protections.
Face matching runs on our own servers, not with a third party. We do not sell your personal data.
5. International transfers
Some of our providers, such as Cloudflare, Google Firebase and Resend, may process data outside Nigeria. Where personal data is transferred outside Nigeria, we do so in line with Part VIII of the NDPA. We rely on an adequate level of protection, appropriate contractual safeguards, or another basis permitted by the NDPA.
6. How long we keep it
- Transaction records (top-ups, bills, withdrawals) and any identity verification records: while your account is open and for at least 5 years after it closes or the transaction completes, to meet legal, tax and fraud-prevention requirements.
- Device and security logs: for as long as needed for security, normally no more than 2 years.
- Tax and accounting records, such as fee and payment records: at least 6 years, as Nigerian tax law requires.
- Support emails: up to 3 years after the issue is resolved, or longer where they form part of a transaction record.
When data is no longer needed, we delete or anonymise it.
7. How we protect it
We use encryption in transit (HTTPS) and encryption at rest for sensitive fields such as your NIN. Passwords and PINs are stored only as one-way hashes. Card details are handled by our PCI DSS-compliant payment partner, not by us. Access is restricted to authorised staff, and administrative actions are logged. If a personal data breach is likely to put your rights at risk, we will notify the NDPC within 72 hours and tell you without undue delay where the NDPA requires.
8. Your rights
Under the NDPA you have the right to be informed; to access your data and get a copy; to have it corrected; to have it erased where we are not legally required to keep it; to restrict or object to processing, including direct marketing; to data portability; to withdraw consent at any time; and not to be subject to a decision based solely on automated processing without human review.
To use these rights, email [email protected] from your registered email address. We may need to confirm your identity first. We will respond within 30 days. If a request is complex or we receive many from you, we may need longer, and we will tell you why within those 30 days. We do not charge for reasonable requests. If you are not satisfied with our response, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).
9. Children
The Service is only for people aged 18 and over. We do not knowingly collect data from children.
10. Cookies and similar storage
We use only essential cookies and device storage needed for sign-in, security and your settings. See our Cookie Policy.
11. Changes to this policy
We will update this policy when our practices change. If the changes are material, we will let you know by email or in the app.
12. Contact
Egoyibo · [email protected] (subject: "Privacy")