Privacy Policy

Information we collect

We collect the following, and only for the reasons given below.

• Account details. Your name, email address, phone number, date of birth and the transaction PIN you set. PINs and passwords are stored hashed, never in a form we can read back.
• Identity details. Government-issued identification such as your BVN, NIN, passport or driver's licence, your residential address, a photo of the document and a selfie or face scan used to check it belongs to you.
• Financial and transaction data. Your wallet balances, funding by card or bank transfer, transfers you send and receive, bill payments, airtime purchases, peer-to-peer trades, and the transaction code generated for each one.
• Crypto data. The wallet addresses held for you in the app, the external addresses you deposit from or withdraw to, and the on-chain hashes of those transactions.
• Service details you enter. Meter numbers, smartcard or decoder numbers, the phone numbers you buy airtime for, and the bank account you withdraw to.
• Support messages. Emails you send us, along with any screenshots or transaction codes you include.
• Device and usage data. Device model, operating system, app version, IP address, notification token, the screens you visit and crash reports.
• Approximate location. Derived from your IP address, to check that Suplox is available where you are and to flag sign-ins that do not look like you. We do not collect precise GPS location.
• Email addresses given on this website. If you enter your email to hear about the launch, we use it for that and nothing else.

We do not store your full card number. Card details are entered with our licensed payment processor, which returns a token and the last four digits so you can recognise the card next time.

Identity verification and biometrics

Suplox handles money, so before you can transact we are required to confirm who you are. This means checking a government-issued identification document and, in most cases, comparing it against a selfie or short liveness check.

A face scan is biometric data. We use it for one purpose only — confirming the document belongs to you — and never for advertising, profiling or to identify you elsewhere. We do not sell it and we do not share it with other users, including anyone you trade with.

You can decline verification, but we will not be able to open a wallet or process transactions for you without it.

Wallets, transfers and the blockchain

When you send or receive cryptocurrency, the transaction is recorded on a public blockchain. That record is permanent, visible to anyone, and outside our control — we cannot edit, hide or delete it, and once a withdrawal is confirmed on-chain it cannot be reversed.

Anyone who knows one of your addresses can view its full history on that blockchain. We do not publish your name alongside an address, but you should treat an address you share as linkable to you.

Peer-to-peer trading

In a P2P trade you deal directly with another verified user. They see your display name, your verification status, your trade history summary and the payment details you choose to give them so they can pay you. They do not see your identity documents, your face scan, your other wallets or the rest of your transaction history.

We hold the crypto while payment is made, so we can see both sides of a trade. If a trade is disputed, we review the messages and payment evidence both parties submit in order to settle it.

Why we use your information

• To create your account and verify your identity.
• To fund your wallet, send transfers, pay bills, buy airtime and settle trades.
• To generate and confirm the transaction code shown before each payment goes through.
• To detect and investigate fraud, money laundering, sanctions breaches and account takeover, and to suspend accounts where we find them.
• To meet our obligations under Nigerian anti-money-laundering, counter-terrorist-financing and tax law, and to respond to lawful requests from regulators.
• To answer your support requests and trace transactions for you.
• To keep the app working — fixing crashes, and understanding which features get used.

Our legal basis

Under the Nigeria Data Protection Act 2023 we rely on the following grounds.

• Performing our contract with you — running your wallet and carrying out the transactions you ask for.
• Legal obligation — identity verification, transaction monitoring, record keeping and reporting.
• Legitimate interest — preventing fraud and abuse, securing the platform and improving the app.
• Consent — marketing emails, push notifications and any optional feature we ask you to opt into. You can withdraw consent at any time.

Who we share it with

We do not sell your personal data. We share it only as follows.

• Identity verification providers confirm your document and biometric check on our behalf.
• Payment processors and banks receive what they need to move money in and out of your wallet.
• Bill and airtime partners receive the meter, decoder or phone number for the payment you are making.
• Blockchain networks record crypto transactions publicly and permanently, as described above.
• People you trade with see only the trade details set out in the P2P section.
• Google Firebase hosts our authentication, database and file storage as a service provider on our behalf.
• Regulators, law enforcement and our professional advisers, where we are legally required to disclose information or need to establish or defend a legal claim.
• A buyer or successor, if Suplox is ever merged or acquired. We would tell you before your data moved.

Cookies and analytics

This website uses cookies and similar storage that are necessary for it to work — remembering your session and your preferences — plus basic analytics that tell us which pages people visit and how the site performs. We do not use advertising or cross-site tracking cookies.

You can block or delete cookies in your browser settings. The site will still work, though some preferences will not be remembered. The mobile app uses the equivalent device identifiers for the same purposes.

Marketing and notifications

We send transaction alerts and security notices because they are part of running your account, and you cannot turn those off while your account is open. Product news and promotional emails only go to people who asked for them, and every one carries an unsubscribe link. Push notifications can be turned off in your device settings at any time.

Where your data is stored

Our infrastructure providers, including Google Firebase, may store and process data on servers outside Nigeria. Where that happens we rely on the safeguards permitted by the Nigeria Data Protection Act, including contractual protections with the provider, so your data keeps an equivalent level of protection wherever it sits.

How long we keep your data

We keep your account information for as long as your account is open. After you close it, anti-money-laundering and tax law require us to keep your identity records and transaction history for at least five years from the end of our relationship with you. We delete your face scan once verification is complete and the retention period for the underlying check has passed, and we delete anything we are not required to keep. Blockchain records cannot be deleted by anyone, including us.

Security

Transactions are encrypted in transit, wallets are protected by your transaction PIN and a confirmation code, and access to identity documents inside Suplox is restricted to the staff who need it. We monitor for unusual activity and can freeze an account while we investigate.

Your part matters too: never share your PIN, your password or a confirmation code with anyone, including someone claiming to be from Suplox. No system is perfectly secure, and we cannot guarantee absolute security, but we will notify you and the Nigeria Data Protection Commission if a breach affects your personal data.

Your rights

You can ask us to:

• show you the personal data we hold about you;
• correct anything that is wrong;
• delete your data and close your account;
• restrict or object to a particular use of your data;
• send your data to you or another provider in a usable format;
• stop sending you marketing.

Email business@suplox.co and we will respond. Two limits are worth stating plainly: we cannot delete records we are legally required to keep, and nobody can delete a blockchain transaction. If you are unhappy with how we handle a request, you can complain to the Nigeria Data Protection Commission.

Age requirement

Suplox is a financial service and is only for people aged 18 and over. We do not knowingly collect data from anyone under 18, and we close accounts we find. If you believe a child has given us personal data, contact us and we will delete it.

Changes to this policy

We may update this policy as Suplox changes. We will update the date at the top of this page, and where the change is significant we will tell you in the app or by email before it takes effect.

Contact us

Questions about this policy or how we handle your data? Email business@suplox.co, or write to Municipality, FCT Abuja, Nigeria.