Data Retention
How long we keep your personal data and the reasons for our retention periods.
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:
| Data Category | Retention Period | Reason |
|---|---|---|
| Account Data (name, email, phone, username) | Until you request account deletion | Required for ongoing service delivery |
| KYC / Identity Documents (ID images, BVN, date of birth) | Minimum 5 years after account closure, then permanently deleted | Nigerian anti-money-laundering law and CBN requirements, and our agreements with the licensed providers we work through. The partner that verified you also retains its own copy under the rules that apply to it. |
| Transaction Records | As required by Nigerian financial regulations (minimum 5 years). Anonymised and unlinked from your identity once you delete your account. | CBN regulatory compliance, AML/CTF obligations |
| API Logs | 30 days (automatically deleted) | Service monitoring and debugging |
| Activity & Notification Logs | 12 months, then anonymised or deleted | Security audits and service improvement |
| Device Tokens | Until you uninstall the app or disable notifications | Push notification delivery |
When data is no longer needed, it is securely deleted or irreversibly anonymised. KYC documents stored in AWS S3 are accessible only via signed URLs that expire after 1 hour, limiting exposure even within our own systems.