Legal

Privacy Policy

Effective 11 November 2026

This policy explains what personal data BillAm collects when you use our mobile app, web app and website, why we collect it, who we share it with, and the choices and rights you have under the Nigeria Data Protection Act 2023 (NDPA).

1. Who we are

BillAm ("BillAm", "we", "us") provides a naira wallet for buying airtime, data bundles, prepaid electricity tokens, gift cards and betting wallet top-ups in Nigeria. We are the data controller for the personal data described here. You can reach us at [email protected].

2. Data we collect

Information you give us

• Account details: full name, email address, phone number and password (stored only as a one-way hash).
• Identity verification (KYC): to raise your wallet limits we ask for your BVN and/or NIN and related identity details, as required for financial services in Nigeria.
• Payment details you enter: phone numbers, meter numbers, betting account IDs, gift card choices and saved beneficiaries.
• Funding reports: when you report a bank transfer, the amount, sender name and bank you provide.
• Support conversations: messages you send our support team.

Information created when you use BillAm

• Transactions and wallet records: purchases, amounts, fees, references, status, refunds, wallet credits and debits, and receipts.
• Details returned by service providers: for example the name and address registered to an electricity meter, the token and units issued, or the name on a betting account, so you can confirm you are paying the right account and keep a complete receipt.
• Security data: sign-in times, IP address, one-time sign-in codes (stored only as hashes and deleted from use once they expire), whether two-factor authentication is on, and transaction PIN attempts.
• Device information: basic technical details such as app version and device type, used to keep the service working.

What we do not collect

• Fingerprints and face data: biometric unlock is handled entirely by your phone's operating system. BillAm only receives a yes/no result and never sees or stores your biometric data.
• Card details: BillAm wallets are funded by bank transfer. We do not ask for or store debit card numbers.
• Your contacts, photos or location.

3. How we use your data

• To create and secure your account, including sign-in codes, two-factor authentication, the app lock and your transaction PIN.
• To credit your wallet when you fund it, and to process the bill payments you request.
• To verify meters and accounts before you pay, and to show tokens, codes and receipts.
• To refund failed transactions and resolve disputes and support requests.
• To verify your identity, apply wallet limits, and prevent fraud, money laundering and abuse.
• To meet legal, regulatory, tax and accounting obligations.
• To send service messages such as sign-in codes and important account notices. We do not sell your data and we do not use it for third-party advertising.

4. Legal bases

Under the NDPA we process your data because it is necessary to perform our contract with you (providing the wallet and payments), to comply with legal obligations (for example KYC, anti-money-laundering and record-keeping rules), for our legitimate interests in keeping BillAm secure and preventing fraud, and, where we ask for it, with your consent, which you may withdraw at any time.

5. Who we share data with

We share only what each party needs to do its job:

• Bill payment providers (such as VTU.ng and other licensed aggregators) receive the recipient details of each purchase (phone, meter or account number and amount) so they can deliver it. Mobile networks, electricity distribution companies, betting operators and gift card issuers receive the same through them.
• Banks and payment processors (such as Paystack or other licensed collection partners, when enabled) to issue funding account numbers and confirm transfers into your wallet.
• Identity verification partners, when you complete KYC, to confirm your BVN/NIN details.
• Infrastructure providers that host and run BillAm on our behalf, such as our cloud database and server host (Supabase), website hosting, and our email delivery provider for sign-in codes. They process data only on our instructions.
• Authorities such as regulators, law enforcement or courts, when the law requires it.
• A successor business, if BillAm is reorganised or sold, under the same protections described here.

6. International transfers

Some of our infrastructure providers store or process data on servers outside Nigeria. When that happens we rely on transfer mechanisms permitted by the NDPA, such as contractual safeguards, and we choose providers that apply strong security controls.

7. How long we keep data

We keep your account data while your account is open. Transaction, wallet and KYC records are kept for as long as Nigerian financial, anti-money-laundering and tax laws require after a transaction or after your account closes. Sign-in codes expire after 10 minutes. When data is no longer needed we delete or anonymise it.

8. Security

We protect your data with encryption in transit (HTTPS), hashed passwords and PINs, encrypted storage of sensitive secrets such as two-factor keys and provider credentials, one-time sign-in codes, optional authenticator-app 2FA, an automatic app lock, strict role-based access for our staff, and a tamper-evident audit log of sensitive staff actions. No system is perfectly secure, so please keep your password, PIN and codes private. BillAm staff will never ask for them.

9. Your rights

Under the NDPA you have the right to:

• be informed about how your data is used, and access a copy of it;
• have inaccurate data corrected;
• have data deleted, unless we must keep it by law;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent where processing is based on consent;
• complain to the Nigeria Data Protection Commission (NDPC).

To use any of these rights, email [email protected] from the email address on your account. We may need to verify your identity first, and we will respond within the time the law requires.

10. Children

BillAm is for people aged 18 and over. We do not knowingly open accounts for children. If you believe a child has an account, contact us and we will close it.

11. Changes to this policy

We may update this policy as BillAm changes or the law requires. We will post the new version here with a new effective date, and tell you in the app or by email about significant changes.

12. Contact us

Questions, requests or complaints about privacy: [email protected]. You can also read our Terms of Service.