This Privacy Policy explains how Nina Wallet ("Nina Wallet", "we", "us") collects, uses, shares, and protects your information when you use our mobile app, web wallet, and related services (together, the "Service"). By creating an account or using the Service, you agree to the practices described here.
1. Information We Collect
Information you provide
- Account details — first name, last name, email address, phone number, and a password you choose.
- Identity verification (KYC) — a profile photo/ID image and your residential address and street, submitted to verify your identity before certain actions (such as sending money).
- Transaction PIN — a 4-digit PIN used to authorise money-out actions. We store only a one-way cryptographic hash of it, never the PIN itself.
- Payment methods — when you add or use a card or bank account, our payment partners return a token or reference that we store. We do not store full card numbers or CVV.
Information we collect automatically
- Device & push tokens — a device identifier and a push-notification token so we can deliver alerts.
- Approximate location — derived from your IP address at sign-in (country and city), used for security and fraud monitoring.
- Usage & transaction records — top-ups, transfers, ticket purchases, and the resulting wallet ledger entries.
Information from third parties
- Payment processors — Stripe and Paystack confirm payment status and return card metadata (brand, last 4 digits) and, for bank transfers, virtual-account details.
- Bank-transfer notifications — CIMPay/Paystack notify us of incoming transfers to your dedicated virtual account so we can credit your wallet.
2. How We Use Your Information
- Create and secure your account, and authenticate you at sign-in (including one-time codes by email).
- Process top-ups, wallet-to-wallet transfers, and ticket purchases, and keep your balance accurate.
- Verify your identity (KYC) and meet anti-fraud and regulatory obligations.
- Send transactional notifications (e.g. "Wallet Funded", "Money Received") by in-app message and push.
- Detect, investigate, and prevent fraud, abuse, and unauthorised access.
- Provide customer support and improve the reliability and features of the Service.
3. How We Share Your Information
We do not sell your personal information. We share it only as needed to run the Service:
- Payment & banking partners — Stripe, Paystack, and CIMPay, to process payments and bank transfers.
- Messaging providers — our email provider (for OTP and receipts) and Google Firebase Cloud Messaging (for push notifications).
- Other Nina Wallet users — when you send or receive a transfer, the other party sees the sender/recipient first name and last name for that transaction (a name enquiry shows the account holder's name).
- Legal & safety — where required by law, regulation, or valid legal process, or to protect the rights, property, and safety of users and the Service.
4. Cookies & Local Storage
The web wallet uses your browser's local storage to keep you signed in (your session token) and to manage idle/auto-logout timers. The admin dashboard uses a session cookie. We do not use third-party advertising or tracking cookies.
5. How We Protect Your Information
- Passwords and your transaction PIN are stored as bcrypt hashes, never in plain text.
- Sign-in uses one-time email codes, and sessions use short-lived access tokens with rotating refresh tokens.
- Repeated wrong-PIN attempts trigger a temporary lockout, and inactive web sessions are logged out automatically.
- Money movements are recorded in an auditable ledger to keep balances consistent and traceable.
No method of transmission or storage is 100% secure, but we work to protect your information using appropriate technical and organisational measures.
6. Data Retention
We keep your information for as long as your account is active and as needed to provide the Service. Transaction and KYC records may be retained longer where required for legal, regulatory, accounting, or fraud-prevention purposes. See our Data Policy for category-by-category detail.
7. Your Rights & Choices
- Access & update — view and edit your profile and resubmit unverified KYC fields in the app.
- Notifications — control push notifications through your device settings.
- Account & data deletion — request deletion of your account at any time (see below).
If you are in Nigeria, you have rights under the Nigeria Data Protection Act/Regulation (NDPA/NDPR); similar rights may apply under your local data-protection laws.
8. Delete Your Account
You can request deletion of your Nina Wallet account and associated personal data — without needing to contact support — at:
https://ninawallet.com/delete-account
Enter your account email, confirm the request with the one-time code we email you, and our team will close your account. Once processed, your account is deactivated and you can no longer sign in.
Certain records (for example, transaction history and identity-verification data) may be retained for a limited period where required by financial, regulatory, accounting, or fraud-prevention obligations, after which they are deleted. You can also email privacy@ninawallet.com for help with a deletion request.
9. Children
The Service is not directed to anyone under 18. We do not knowingly collect information from children. If you believe a minor has provided us information, contact us and we will remove it.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will revise the "Last updated" date above and, where appropriate, notify you in the app.
11. Contact Us
Questions about this policy or your data? Email privacy@ninawallet.com or support@ninawallet.com.
See also our Data Policy for how specific categories of data are processed, stored, and retained.