Privacy Policy

YZ-pay (“YZ-pay”, “we”) is the data controller for the personal data described here. This policy explains what we collect when you use our website, apps, business dashboard, checkout, POS terminals and API, why we use it, and the choices you have. We process personal data in line with the Nigeria Data Protection Act 2023 and other laws that apply to us.

• Account details — name, email address, phone number, password (stored only as a secure hash), transaction PIN (hashed) and account preferences.
• Verification details — for businesses: registration details, director and ownership information and documents; for individuals where required: identity information and documents.
• Transaction details — deposits, withdrawals, conversions, payments, wallet addresses, transaction hashes, card and gift card orders, gift card recipients’ email addresses, and bank account details for payouts.
• Payer details — when you pay a YZ-pay business, the email address and name you give at checkout, and your transaction details.
• Technical details — IP address, device and browser information, and security logs such as sign-in attempts.
• Communications — messages you send through the contact form, support chat or email.

• to create and run your account and provide the Services you ask for (performance of our contract with you);
• to verify identities, prevent fraud, money laundering and terrorist financing, and keep records the law requires (legal obligation);
• to secure the Services — rate-limiting sign-ins, detecting unusual activity and protecting accounts (legitimate interests);
• to send transaction receipts, security alerts and service messages (contract and legitimate interests);
• to answer support requests — some chat messages are answered first by an automated assistant, and you can ask for a person at any time (legitimate interests);
• to send product news, only where you have agreed, with an unsubscribe link in every message (consent).

We do not sell your personal data, and we do not use it for automated decisions that have legal effects on you without human review.

We share personal data only as needed to run the Services, with:

• payment, blockchain-infrastructure and banking partners that process deposits, withdrawals, conversions and naira payouts;
• our card-issuing partner (for virtual cards) and our gift card fulfilment partner (including the recipient’s email address);
• service providers for hosting, email delivery, customer support and security, under contracts that require them to protect your data;
• the business you pay, which receives the details of your payment;
• regulators, law-enforcement agencies and courts where the law requires it, or to protect our users and the Services.

Transactions on public blockchains — including wallet addresses, amounts and times — are visible to anyone and cannot be deleted, by us or anyone else. We don’t publish your name alongside them.

Some of our partners and service providers are located outside Nigeria. When we transfer data abroad we use safeguards permitted by the Nigeria Data Protection Act, such as contractual protections, and share only what is needed.

We keep account data while your account is open. Verification and transaction records are kept for at least five years after the account closes or the transaction completes, as anti-money-laundering law requires. Security logs are kept for a shorter period. After that, data is deleted or anonymised.

Passwords, PINs and session tokens are stored as one-way hashes. Data is encrypted in transit, access to personal data is limited to staff who need it, and admin actions are logged. No system is perfectly secure; if a breach affects you, we will tell you and the regulator as the law requires.

You can ask us to:

• give you a copy of your personal data, or send it to another provider;
• correct data that is inaccurate or incomplete;
• delete your data, where we are not required to keep it;
• restrict or object to some uses, and withdraw consent at any time.

Email support@yzpay.io from the address on your account. We respond within the time the law allows, usually 30 days. If you’re unhappy with our response you can complain to the Nigeria Data Protection Commission.

We use only essential cookies — to keep you signed in and protect your session — and your browser’s local storage for small preferences such as a remembered tab. We do not use advertising or cross-site tracking cookies.

The Services are not for anyone under 18, and we do not knowingly collect their data. If you think a child has given us data, contact us and we will delete it.

We will post any update here with a new effective date, and tell you by email or in the app if the change is significant.

Questions or requests about your data: support@yzpay.io.