Who we are and what this policy covers
This policy explains what personal data Aidapay collects, why we collect it, who we share it with, how long we keep it, and the rights you have over it under the Nigeria Data Protection Act 2023 (NDPA).
Aidapay is operated by Veqi LTD (RC1974322), a company registered in Nigeria (Head office: Bashorun, Ibadan, Oyo State, with branches in Osun State). Veqi LTD is the data controller for the personal data described here. When we say "we", "us" or "our", we mean Veqi LTD.
It covers everyone whose data we handle through our services:
- people who use the Aidapay app on Android or iOS, or sign in on this website;
- business accounts, the staff they invite, and the storefront websites they run on our platform;
- people who connect Aidapay to another app through our account-linking feature;
- visitors to our website, including readers of our articles and guides;
- people who apply to become a Field Sales Agent or ambassador, or who apply for a job with us; and
- people whose details a user gives us, such as the recipient of an airtime purchase or a next of kin.
Our Terms and Conditions set out the rules for using the service. Where the two documents differ on a question of personal data, this policy applies.
The information we collect
Information you give us
- Account details: your full name, email address, phone number, password and transaction PIN (both stored in hashed form), a recovery email address, security questions and answers, your profile photo, and how you heard about us.
- Profile details: your gender, date of birth and occupation when you add them, your home address (house address, city, state and country, with map coordinates if you allow it), and your next of kin's name, relationship, phone number, email and address.
- Identity verification (KYC): your Bank Verification Number (BVN) or National Identification Number (NIN) with your date of birth, and the bank account number you link for BVN confirmation. For higher limits we may ask for a selfie, a government-issued identity document and a proof of address. Business accounts may also be asked for their business name, address, phone, tax identification, CAC registration number and registration document.
- Transaction details: what you buy or pay for and the details needed to deliver it, such as the phone number you top up, a meter number, a smart card number, or the bank account name and number you send money to. You can also save these as beneficiaries.
- Messages and uploads: what you write to our support team, screenshots or photos you attach, and images you scan with ScanPay.
- Applications: if you apply to be a Field Sales Agent or ambassador we collect your name, phone, email, age range, gender, state and city, whether you are a student and where, how long you have used Aidapay, your social media handle and how you plan to sell. If you apply for a job we collect your name, email, phone, cover letter and CV.
Information we collect when you use the service
- Device and app data: a unique identifier for your device, its make and model, operating system and version, your app version, your push notification token, and whether notifications are allowed. We keep a list of the devices signed in to your account so you can see and remove them.
- Connection data: your IP address, browser or app identifier, and the date, time and method of each sign-in.
- Activity data: the actions you take in the app or on this website, such as the screens you open, the purchases you make, and the settings you change. We also keep a log of actions our staff take on your account.
- Location: if you allow location access, the app sends your approximate position with its requests. We keep your current position and the city and state it maps to, and a history of the places you have used the app from, updated when you move a significant distance. See App permissions for how to switch this off.
- Financial records: your wallet balances, cashback, AidaPoints and referral earnings, the virtual bank account numbers created for you at our partner banks, deposits into those accounts (including the sender's account name, number and bank, as reported by the receiving bank), and every transaction you make.
- Referral data: when you open a referral link we record a click identifier, your IP address, operating system, a hash of your browser identifier, the campaign and the page or article the link was on, so that we can credit the right referrer when you sign up.
- Game and reward activity: the games you play in the Reward Center, your spins and prizes, your streaks and tier, and your position on leaderboards.
Information we receive from others
- Identity verification: when you give us your BVN or NIN we check it with a licensed verification provider, which returns the name, date of birth, phone number and (for NIN) the photograph held against that number. We keep what is returned, together with the provider's result.
- Banks and payment providers: confirmation of your deposits and transfers, the account name behind an account number you send money to, and the status of a payment.
- Telecom and bill providers: whether a top-up, data bundle, bill payment or subscription was delivered, and any reference they return.
- Google and Apple: if you sign in with Google or Apple, we receive your name, email address and a unique account identifier from them. We never see your Google or Apple password.
- Other users: a referrer may share your phone number or you may be named as someone's next of kin, beneficiary or recipient.
App permissions
The app asks your phone for permission before it uses any of these. You can change your mind at any time in your phone's settings, and the rest of the app keeps working.
- Contacts: used only to open your phone's contact picker so you can choose a recipient. Only the single number you pick is sent to us. We do not read, upload or store your contact list.
- Camera and photos: used to scan a QR code or an account number with ScanPay, to take or choose a selfie and identity documents for verification, and to attach a screenshot to a support message. Text recognition and barcode reading first run on your device.
- Location: used to understand where our users are, to detect sign-ins or spending patterns that do not fit your account, to show offers relevant to your area, and to pre-fill your address. If you deny it, the app does not collect your position.
- Biometrics (fingerprint or Face ID): used to unlock the app or confirm a payment. Your biometric data never leaves your phone; the phone only tells the app whether the check passed.
- Notifications: used to tell you about transactions, security events and offers. Promotional notifications can be turned off in Account Settings or in your phone's settings.
- Advertising identifier: the Reward Center can show a rewarded video advertisement, served by an advertising network, in exchange for a free spin. On iOS the app asks for tracking permission first; on Android it uses the advertising ID with your device's ad settings. If you decline, you can still use every other part of the app.
How we use your information, and the legal basis for it
The NDPA requires us to have a lawful basis for each use of your personal data. These are ours.
| What we do | Why we are allowed to |
|---|---|
| Create and run your account, process your purchases, deposits, transfers and refunds, deliver what you paid for, pay cashback and referral rewards, and answer your support requests. | Performance of our contract with you. |
| Verify your identity, apply transaction limits by verification level, keep transaction records, report where required, and respond to lawful requests from regulators, law enforcement and courts. | Legal obligations, including Nigerian anti-money-laundering and know-your-customer rules and the terms of our licences. |
| Detect and prevent fraud, account takeover and abuse: checking devices, sign-in locations, deposit sources, referral activity and recipient details, and placing holds or restrictions while we review. | Our legitimate interest in protecting you, other users and the service, and legal obligations. |
| Send you transaction receipts, security alerts, verification codes and service notices by push notification, email, SMS or WhatsApp. | Performance of our contract and legitimate interest in keeping your account safe. |
| Send you offers, newsletters and reminders, and choose which users receive a campaign based on how they use the service. | Your consent, which you can withdraw at any time (see Your rights and choices). |
| Run referral programmes, streaks, tiers, games and leaderboards. | Performance of our contract and your choice to take part. |
| Improve the service: measuring which features are used, fixing errors, planning capacity and understanding our users as a group. | Our legitimate interest. Where we can, we do this with aggregated or anonymised data. |
| Provide ScanPay, the AI support assistant and spending recaps, which process your images, messages and transaction summaries with AI services. | Performance of our contract when you choose to use the feature. |
| Share your data with another app you connect to your account. | Your consent, given on the permission screen and revocable at any time. |
We do not sell your personal data, and we do not use it to make decisions about credit.
Automated decisions and AI
- Fraud and risk checks run automatically. They can hold a payment or reward, limit a device, or flag a referral for review. A hold or restriction that affects your money is always reviewed by a member of our team, and you can ask us to explain or reconsider any such decision.
- ScanPay reads an account number or a payment screenshot. The image is recognised first on your device and then by an AI service. We keep the text and account details extracted from it; we do not keep the image.
- The support assistant drafts replies to your support messages using an AI service. To answer, it may look up your recent transactions and wallet activity. Your messages and the details it looks up are sent to the provider to generate the reply. You can ask for a human at any time, and the assistant hands over to our team when it cannot help.
- Spending recaps turn your transaction totals into a short summary. Only totals and counts are sent to the AI provider, together with your first name.
- Automated messages such as reminders, follow-ups and tier updates are sent when your activity meets a rule we have set, for example not finishing verification or reaching a new agent tier.
We do not use your data to train our own AI models, and the AI services we use process it only to generate the response we asked for.
Who we share your information with
We share personal data only where it is needed to provide the service, meet a legal duty or protect the service. Every provider below receives only what its job requires.
| Who | What they receive and why |
|---|---|
| Telecom networks, electricity distribution companies, TV and internet providers, betting operators and the licensed aggregators that connect us to them. | The recipient number, meter, card or account you are paying for, and the amount, so the purchase can be delivered. |
| Licensed partner banks, payment processors and card and transfer gateways. | Your name, phone, email and BVN or NIN to open a virtual account in your name; the account name and number you send money to; and payment references. Wallet balances are held with licensed financial institutions. |
| Licensed identity verification providers. | Your BVN or NIN, date of birth and, for liveness checks, your selfie and identity document, to confirm who you are. They return the record held against that number. |
| Technology platforms behind the app: push notification, usage analytics, advertising and sign-in services. | Push tokens and app events for notifications and usage statistics; the advertising identifier for rewarded ads; and your sign-in identity if you choose to sign in with Google or Apple. Website visits are measured with analytics tags (see Cookies). |
| AI services. | ScanPay images, support messages and the account details the assistant looks up, and spending totals for recaps, to generate the result you asked for. |
| Messaging providers: SMS gateways, our WhatsApp Business provider, and our email delivery service. | Your phone number or email address and the content of the message, so it can be delivered. Delivery status comes back to us. |
| Cloud hosting and infrastructure providers. | They host our servers, store uploaded documents and carry our traffic. They do not use your data for their own purposes. |
| Apps you connect to your account. | Only the data covered by the permissions you approve on the connection screen: your profile, balance, transaction history, or the ability to pay bills or send transfers from your wallet. You can see and revoke each connection in the app. |
| The person who referred you, and people you pay. | A referrer sees that you joined and your referral progress, with your phone number partly hidden. Someone paying you through a ScanPay payment link sees the name on your account. Leaderboards show a partly hidden phone number and your score, never your name. |
| Business account owners and their staff. | If you buy through a business's storefront, that business sees the order and the recipient details you entered. If you are a staff member a business invited, the owner sees your name, email, phone and activity. |
| Regulators, law enforcement and courts, including the Nigeria Data Protection Commission, the Nigerian Communications Commission, financial regulators and the Nigerian Financial Intelligence Unit. | What a valid legal request requires, or what we must report by law. |
| Professional advisers and a buyer or successor of our business. | What is needed for audits, legal advice, or a merger, acquisition or restructuring, under confidentiality obligations. |
Our team is alerted internally, including through our messaging tools, when an account needs attention, for example a failed verification or a suspicious deposit. Those alerts identify the account and the issue and are seen only by staff.
How we protect your information
- All traffic between the app or website and our servers is encrypted, and the app encrypts its request contents a second time.
- Passwords and transaction PINs are stored as one-way hashes. Nobody at Aidapay can read them.
- Access to customer data inside our company is limited by role. Sensitive staff actions require two-factor authentication and are logged with the staff member's identity and reason.
- Payments are protected by your PIN or biometrics, device checks, transaction limits that depend on your verification level, and automated fraud monitoring.
- You can see the devices signed in to your account, remove one, turn on two-factor authentication, and set a recovery email in Account Settings.
No system is perfectly secure. If we discover a breach that is likely to put your rights at risk, we will notify the Nigeria Data Protection Commission within 72 hours and tell you without undue delay, as the NDPA requires.
How long we keep your information
We keep personal data for as long as your account is open and for the periods below after it closes. When a period ends we delete the data or strip it of anything that identifies you.
| Data | Kept for |
|---|---|
| Account, profile, saved beneficiaries, devices, notification preferences, referral links and unused rewards. | Until 30 days after your account is closed. The 30 days is a recovery window in case the closure was a mistake. |
| Transaction records, deposits, transfers, wallet statements and the KYC records behind them. | Five years after your last transaction, as Nigerian financial and anti-money-laundering rules require. |
| Records needed for an open dispute, chargeback, fraud investigation or legal request. | Until the matter is resolved and any appeal period has passed. |
| Support conversations and attachments. | Up to five years, because they are often the evidence for a transaction dispute. |
| Location history, sign-in records and activity logs. | Up to two years, then deleted or aggregated. Short-lived screen activity used for automated reminders is kept for seven days. |
| ScanPay images. | Not stored. Only the extracted text and account details are kept with the transaction. |
| Referral click records that never led to a sign-up. | Up to 12 months. |
| Job, Field Sales Agent and ambassador applications. | Up to 12 months after a decision, or longer if you join us. |
| Marketing preferences and opt-outs. | For as long as we need to honour your choice. |
Our account deletion page explains how to close your account from inside the app or by email, and exactly what is deleted and what we must keep.
Your rights and choices
Under the NDPA you have the right to:
- Access the personal data we hold about you and receive a copy;
- Correct data that is inaccurate or incomplete. Name, email and phone changes go through verification, and we keep a history of previous values for fraud prevention;
- Delete your data where we have no legal reason to keep it, by closing your account;
- Restrict or object to processing based on our legitimate interests, including marketing;
- Withdraw consent at any time where consent is the basis, without affecting what was done before;
- Receive your data in a commonly used, machine-readable format, and have it sent to another provider where technically possible;
- Not be subject to a decision based solely on automated processing that significantly affects you, and ask for a human review of any such decision; and
- Complain to the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng if you believe we have breached your rights. We would appreciate the chance to resolve the issue first.
To use any of these rights, email help@aidapay.ng from the email address on your account. We may ask you to confirm your identity so that nobody else can access or change your data. We respond within one month, and will tell you if a complex request needs more time.
Choices you can make yourself
- Marketing: turn promotional emails and WhatsApp messages off in Account Settings, use the unsubscribe link in any marketing email, and manage push notifications in Account Settings or your phone's settings. Transaction receipts and security alerts are not marketing and continue while your account is open.
- Location: withdraw the permission in your phone's settings. The app stops sending your position.
- Advertising identifier: decline tracking on iOS, or reset or delete your advertising ID in Android settings. Rewarded ads then stop personalising.
- Connected apps: review and revoke any app connected to your account in Account Settings.
- Devices: remove a device you no longer use from the device list in Account Settings.
- Profile: update your photo, gender, date of birth, occupation, address and next of kin in Account Settings.
Children
Aidapay is for adults. You must be at least 18 years old to open an account. We do not knowingly collect personal data from anyone under 18, and the NDPA requires us to verify age and obtain a parent's consent before doing so. If you believe a child has given us their data, email help@aidapay.ng and we will remove it.
Cookies and website analytics
Our website uses a small number of cookies and similar technologies:
- Essential cookies keep you signed in to the web panel, protect forms against forgery and remember your "keep me signed in" choice. The site cannot work without them.
- Preferences such as your light or dark theme and where you stopped reading an article are saved in your browser's local storage. They never leave your device.
- Attribution: when you arrive from an article, guide or advert we note the source in your browser so that, if you install the app, we can tell which page or campaign brought you. This is tied to a random click identifier, not to your name.
- Google tag (Google Analytics and Google Ads): measures how the website is used and whether an advert led to an app install. Google sets its own cookies for this. You can opt out with Google's browser add-on or by blocking third-party cookies.
- Meta Pixel: used only on pages we advertise through Meta, to measure that advertising. You can control this through your Facebook ad preferences.
Most browsers let you refuse or delete cookies. Doing so may sign you out of the web panel but does not affect the app.
Information about other people
When you give us someone else's details (a recipient's phone number, a bank account you pay, a next of kin, or a staff member you invite to your business account), you confirm that you are allowed to share them with us. We use those details only to carry out what you asked for and to protect the service, and this policy applies to them. If someone has entered your details into Aidapay and you want them removed, contact us at help@aidapay.ng.
Businesses that run a storefront on our platform are responsible for their own customers under the NDPA. We process their customers' order details on the business's behalf and to deliver the purchase.
Changes to this policy and how to contact us
We update this policy when our services or the law change. The date at the bottom of the page shows the latest version. If a change significantly affects how we use your data we will tell you in the app or by email before it takes effect.
- Privacy questions and rights requests: help@aidapay.ng
- Account deletion requests: hello@aidapay.ng
- General support: help@aidapay.ng
- Post: Veqi LTD, Head office: Bashorun, Ibadan, Oyo State, with branches in Osun State