Privacy Policy

• We collect only what is needed to open your account, verify you where the law requires it, deliver the products you pay for, and keep your money and account safe.
• We do not sell your personal information.
• We do not track you across other companies’ apps or websites, and we use no advertising or analytics SDKs. Apple’s App Tracking Transparency prompt therefore does not appear, because there is no tracking to consent to.
• We do not collect your location, your contacts, your photos, or your device’s camera or microphone data.
• You can delete your account from inside the app at any time: Profile \u2192 Delete account.

2.1 — Information you give us

2.2 — Information created by your use of the Service

Wallet and transaction data

Your wallet balance; the dedicated Nigerian bank account number assigned to you for funding; funding transfers received; every purchase with its amount, product, provider, status, reference and timestamp; commission earned; and receipts.

Account status

Email-verification status, KYC level, account type (Personal or Agent), and whether a transaction PIN is set.

Session and device information

A device identifier generated by the app, the device name (for example “Joseph’s iPhone”), and session activity. This exists so that you can see the devices signed in to your account and sign any of them out remotely (Profile → Signed-in devices), and so that we can detect suspicious sign-ins.

Technical and security logs

IP address, timestamps, and error diagnostics generated when your device communicates with our servers. Used for security, fraud prevention and debugging.

2.3 — Stored only on your device, and never received by us

2.4 — Information we do not collect

We do not request or receive location data (precise or coarse), your contacts, your photo library, your camera, your microphone, your health data, your browsing history in other apps, or advertising identifiers such as the IDFA.

The app requests no other device permissions.

We use personal information to:

1. 01Create and operate your account, and sign you in securely.
2. 02Verify your email address and, for KYC, your phone number and identity.
3. 03Assign you a dedicated bank account number and credit your wallet when a transfer arrives.
4. 04Process the purchases you authorise with your transaction PIN, and deliver those products to the phone line, meter or smartcard you specified.
5. 05Calculate and display the commission discount applied to eligible purchases, and your earnings.
6. 06Show your transaction history and generate receipts you can save, print or share.
7. 07Comply with Nigerian financial-services obligations, including customer identification (KYC) and anti-money-laundering and anti-fraud rules, and respond to lawful requests from regulators and law-enforcement authorities.
8. 08Detect, investigate and prevent fraud, account takeover, and abuse of the Service.
9. 09Provide customer support and resolve disputed or failed transactions.
10. 10Send service messages about your account and transactions, and maintain and improve the app’s reliability.

We do not use your data for behavioural advertising or profiling, and we do not make automated decisions that produce legal effects about you without human review.

Legal bases

Where the NDPA 2023, the GDPR or similar law applies.

Performance of a contract

Operating your wallet and delivering purchases.

Legal obligation

KYC, AML, tax and record-keeping duties.

Legitimate interests

Securing accounts, preventing fraud, and improving the Service.

Consent

Optional items such as biometric unlock, which you can withdraw at any time in the app’s settings.

Product providers

Mobile network operators (MTN, Airtel, Glo, 9mobile), cable TV broadcasters (such as DStv, GOtv and Startimes) and electricity distribution companies. They receive the recipient detail needed to deliver what you bought — the phone number, meter number or smartcard number, and the amount.

Our licensed Nigerian payment service provider

Issues and operates your dedicated funding account number and notifies us of incoming transfers, so your wallet can be credited.

Identity-verification partners and the bank verification registry

To confirm your phone number, date of birth and BVN when you choose to complete KYC.

Infrastructure providers

Hosting, database and email-delivery services acting on our instructions under contract, who may not use your data for their own purposes.

Regulators, courts and law-enforcement authorities

Where we are legally required to disclose, or where disclosure is necessary to investigate fraud or protect our users.

A successor entity

If VTUAgent is involved in a merger, acquisition or asset sale, your information may transfer, subject to this Policy.

Two technical services are contacted by the app itself: Google Fonts, which serves the typeface, and the Apple App Store, which the app queries to tell you when an update is available and to show Apple’s own rating prompt. Neither receives your account data. Ratings you submit go to Apple, not to us.

We are based in Nigeria and process data there. Some infrastructure providers may store or process data outside Nigeria. Where that happens we rely on contractual safeguards requiring a level of protection consistent with the Nigeria Data Protection Act 2023 and, where applicable, standard contractual clauses.

Account and profile data

For as long as your account is open.

Transaction, wallet and KYC records

Retained for the period Nigerian financial and anti-money-laundering law requires — currently a minimum of five years after the transaction or after the account closes, whichever is later.

Security and technical logs

Typically up to 12 months, unless needed for an ongoing investigation.

Support correspondence

Up to 24 months after the matter is closed.

When a retention period ends, data is deleted or irreversibly anonymised.

Deletion closes your account permanently and revokes your sessions on every device.

• All communication between the app and our servers uses HTTPS/TLS encryption.
• Passwords are stored only as salted hashes; your transaction PIN is verified server-side and is never shown back to you.
• Session tokens live in the iOS Keychain or Android Keystore, not in ordinary app storage. The access token is short-lived and held in memory.
• Every purchase requires your transaction PIN, and the app can additionally be locked with Face ID, Touch ID or a local PIN.
• You can review the devices signed in to your account and sign out any of them remotely.
• If we detect that a session token has been reused or stolen, we end that session automatically.

No system is perfectly secure, but we work to protect your data and will notify you and the Nigeria Data Protection Commission of a breach affecting your personal data as the law requires.

Access

The personal information we hold about you.

Correct

Information that is inaccurate or incomplete.

Delete

Your account and the data we are not legally required to keep.

Object or restrict

Certain kinds of processing.

Port

Receive a copy of the data you gave us, machine-readable.

Withdraw consent

For anything you consented to, such as biometric unlock, without affecting processing that already took place.

You may also complain to the Nigeria Data Protection Commission, or to your local supervisory authority.

To exercise any of these, email [email protected] from your registered address. We respond within 30 days. We may need to verify your identity before acting, to make sure we are not disclosing your data to somebody else.

The Service is not directed to children. You must be 18 or older to open a VTUAgent account, as Nigerian financial-services rules require. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we delete the account and its data. If you believe a minor has created an account, contact [email protected].

We send transactional and security messages — such as email verification codes, transaction confirmations and account alerts — because they are part of the Service and cannot be turned off while your account is open. Any promotional email includes an unsubscribe link, and opting out never affects your ability to use the app.

We may update this Policy as the Service or the law changes. The “Last updated” date at the top always reflects the current version. If a change materially affects how we use your information, we will tell you in the app or by email before it takes effect. Continuing to use the Service after a change means you accept the updated Policy.