The short version: we collect what we need to run your wallet, pay your bills and keep your money safe. We check your identity because the law requires it. We share data only with the companies that help us provide the service, and never sell it.
Your BVN, NIN and ID number are encrypted, your contacts are never stored, and you can ask to see, correct or delete your data.
1. Who we are
SwiftBuddy is a wallet and bills app operated by Revamped Swiftbuddy Technology Limited, a company incorporated in Nigeria with its office in Lagos State (“SwiftBuddy”, “we”, “us”). We are the data controller for the personal data described in this policy.
This policy covers the SwiftBuddy mobile app, the website at swiftbuddy.africa, and the emails, text messages and support we provide. It explains what we collect, why, who we share it with, how long we keep it and the rights you have under the Nigeria Data Protection Act 2023 (“NDPA”).
2. What we collect
Information you give us
| Information | When | Why |
|---|---|---|
| Name, username, phone number, email address, password | When you sign up | To create and secure your account, send receipts and codes, and let your buddies find you |
| Transaction PIN | When you set it | To confirm every payment |
| Date of birth, home address, BVN, ID type and number | When you upgrade to Tier 2 | To verify your identity, as required for higher limits, and to open your dedicated bank account |
| National Identification Number (NIN), proof-of-address type | When you upgrade to Tier 3 | To verify your identity for the highest limits |
| Profile photo, next of kin | Only if you add them | To personalise your profile and help with account recovery |
| Bill account numbers (phone, meter, smartcard, betting ID) and saved bill profiles | When you pay or save a bill | To pay the biller and let you pay again quickly |
| Bank account details for withdrawals | When you withdraw | To pay out to your own bank account and remember it for next time |
| Saved card details | Only if you save a card | We keep only the card brand, last four digits, expiry date and cardholder name. We never store your full card number or CVV |
| Messages to support and transaction reports | When you contact us | To resolve your issue |
| Notes on transfers, requests and gifts | When you add them | To show them to the person you're paying or asking |
| Name, email and phone on the website waitlist | When you join the waitlist | To send you launch news and a short welcome series |
Information created when you use SwiftBuddy
- Transactions: your wallet balance, a ledger of every movement, receipts, references, statuses and electricity tokens.
- Buddies, requests and gifts: who you've added, and what you've asked for, paid or gifted.
- Rewards: your referral code, who joined with it, and the loyalty points you've earned.
- Security information: a random installation ID created by the app (not taken from your phone's hardware), the type of device you sign in from, your IP address while you use the service, and records of security events such as PIN lockouts.
- Identity check results: whether the details you gave matched official records. We keep the match result, not the record returned by the verification provider.
Your phone contacts
If you choose “Find friends” and allow access to your contacts, the app sends the phone numbers to us so we can show you which contacts already use SwiftBuddy. We don't store your contacts. The numbers are compared with our users and then discarded. You can say no and still use every other feature.
Biometrics
If you turn on Face ID or fingerprint sign-in, the check happens entirely on your phone. SwiftBuddy never receives your biometric data.
3. How we use your data, and our lawful basis
The NDPA requires a lawful basis for each use of personal data. Ours are:
- To provide the service you signed up for (contract): running your wallet, making payments, transfers, gifts, requests, withdrawals and scheduled payments, sending receipts and tokens, and providing support.
- To meet our legal obligations: verifying identity under the Central Bank of Nigeria's tiered know-your-customer rules, keeping financial records, preventing money laundering and fraud, and responding to lawful requests from regulators and law enforcement.
- For our legitimate interests, balanced against your rights: keeping accounts secure, detecting unusual activity, limiting abuse, investigating disputes, and improving the app.
- With your consent: matching your contacts, marketing emails and announcements, and the website waitlist. You can withdraw consent at any time, and this doesn't affect what we did before.
We don't sell your personal data, and we don't use it for advertising by other companies.
4. Decisions made automatically
Some decisions are made by our systems so the service can work quickly and safely:
- Account upgrades: a clear identity match is approved automatically. If the match isn't clear, a member of our compliance team reviews it. We never refuse an upgrade without a person looking at it. Tier 3 upgrades are always reviewed by a person.
- Withdrawals: we only pay out to bank accounts in your own name, may hold the first withdrawal on a new account for up to 24 hours, and apply daily limits by tier.
- Security: payments pause for 15 minutes after repeated wrong PIN attempts, and we limit how often sign-in and codes can be tried.
If you disagree with an automatic decision, contact us (see Contact us) and a person will review it.
6. Transfers outside Nigeria
Some of our providers store data outside Nigeria. Our app, database and website are hosted by Render on servers outside Nigeria, and Brevo processes email in the European Union. Where data leaves Nigeria we rely on the safeguards the NDPA allows, including the strong data protection laws of the countries involved and written contracts that require providers to protect your data to the NDPA's standard. You can ask us for details of these safeguards.
7. How we protect your data
- All connections between the app and our servers are encrypted.
- Your BVN, NIN and ID number are encrypted before they're stored, and are only ever shown masked.
- Your password and PIN are stored using one-way hashing, so nobody at SwiftBuddy can read them.
- Your sign-in is kept in your phone's secure storage. New phones must be confirmed with a code sent by SMS.
- Every payment needs your PIN, and sensitive changes need a code sent to your email.
- Our staff only see what their role needs, sign in with a password and an authenticator app, and every action they take is recorded. Manual changes to a wallet need two members of staff.
8. How long we keep your data
- While your account is open, we keep the data needed to run it.
- When you close your account, we sign you out everywhere and straight away delete your contact details from the account, along with your buddies, saved bills, cards, devices and notifications. The records the law requires are kept encrypted, used for nothing else, and deleted when the retention period below ends.
- Financial and identity records (transactions, the ledger, and identity verification records) are kept for at least five years after the transaction or after your account closes, as Nigerian anti-money-laundering law requires.
- Support conversations are kept for as long as they're needed to handle disputes, and no longer than the financial records they relate to.
- One-time codes expire within minutes, and records that stop duplicate payments are deleted after 24 hours.
- Waitlist details are kept until you unsubscribe or until launch updates end.
When data is no longer needed, we delete it or make it anonymous.
9. Your rights
Under the NDPA you have the right to:
- Access the personal data we hold about you and get a copy;
- Correct data that is wrong or incomplete;
- Delete your data, unless we must keep it by law (see How long we keep your data);
- Restrict or object to how we use your data, including for marketing;
- Receive your data in a commonly used format, and have it sent to another provider where that's technically possible;
- Withdraw consent you've given, at any time; and
- Ask for a person to review a decision made automatically.
You can see and update much of your information in the app, and delete your account yourself under Profile → Delete Account. For anything else, contact us (see Contact us). We'll confirm your identity first, then respond within 30 days.
You can turn off marketing and notification emails in the app under Profile → Notifications, or use the unsubscribe link in any marketing email. We'll still send emails you need about your account and money, such as receipts and security alerts.
If you're not happy with how we've handled your data, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng). We'd appreciate the chance to put things right first.
10. Children
SwiftBuddy is only for people aged 18 and over, and we ask for your date of birth when you sign up. We don't knowingly collect data from children. If you believe a child has an account, contact us and we'll close it.
11. Our website and cookies
The swiftbuddy.africa website doesn't use advertising or analytics cookies. If you join the waitlist, the details you enter are sent to Brevo to manage our email list. Our hosting provider keeps standard technical logs, such as IP addresses, to keep the site secure.
12. If something goes wrong
If a personal data breach is likely to put your rights at risk, we'll report it to the Nigeria Data Protection Commission within 72 hours of finding out, as the NDPA requires. If the risk to you is high, we'll also tell you directly, explain what happened and what you can do.
13. Changes to this policy
We'll update this policy when our services or the law change. The date at the top shows the latest version. If a change matters to how we use your data, we'll tell you in the app or by email before it takes effect.
14. Contact us
For questions about your data or to exercise your rights:
- Email info@swiftbuddy.africa with “Privacy” in the subject
- Call (234) 906 967 9142
- Chat with support in the SwiftBuddy app
Revamped Swiftbuddy Technology Limited, Lagos State, Nigeria.