Legal

Privacy policy

What we collect, why, and what you can tell us to do about it.

Last updated: [DATE]. We give at least 30 days notice before a material change takes effect.

Who is responsible for your data

The data controller is [PayLab Technologies Limited], registered in Nigeria with number [RC NUMBER], registered office [ADDRESS]. Our Data Protection Officer can be reached at dpo@vaultly.app. We are registered with the Nigeria Data Protection Commission under [REGISTRATION NUMBER].

What we collect

✓Identity. Your name, date of birth, phone number, email and address. Your BVN or NIN, a government-issued ID, and a selfie for matching.
✓Financial. Wallet balance, transaction history, linked bank accounts, card details, savings goals and SafeLock elections.
✓Loan information. Income and employment details you give us when applying, and repayment history.
✓Device and usage. Device model, operating system, app version, IP address, screens viewed, and error logs.
✓Transaction metadata. Times, amounts, recipient categories and payment channel.
✓Support interactions. Messages and attachments you send us.
✓Approximate location, derived from your IP address, used to detect fraud and to show the right regional billers.

What we do not collect

We do not ask for access to your contacts, your photo gallery, your call logs or your messages. We never make access to any of them a condition of using Vaultly or of borrowing. If an app or a person claiming to be Vaultly asks you for this, it is not us.

We do not collect precise GPS location, and we do not record phone calls.

Your face and fingerprint

Biometric information is sensitive personal data under the Nigeria Data Protection Act, and we treat it that way. Face ID and fingerprint checks happen on your device. Your biometric template stays on your phone, controlled by the phone's own secure hardware. It is never sent to us and we never store it. Your device only tells us whether the check passed.

We rely on your explicit consent to use biometrics, given when you switch the feature on. You can turn it off at any time in Settings and continue using your passcode instead.

Why we use it, and on what legal basis

To run your account and process payments

Performance of our contract with you

To verify your identity and meet anti-money-laundering duties

Legal obligation

To detect and prevent fraud

Legitimate interest, and legal obligation

To assess whether a loan is affordable for you

Performance of a contract, and legal obligation

To answer your questions and handle complaints

Performance of a contract

To send you marketing

Your consent, which you can withdraw at any time

To use biometrics

Your explicit consent

To improve the product using aggregated, de-identified data

Legitimate interest

Automated decisions, including credit

Some decisions are made automatically. Fraud monitoring may hold a transaction for review. Loan eligibility and affordability are assessed automatically using the information you give us, your Vaultly history and data from licensed credit bureaux.

If an automated decision affects you significantly, such as declining a loan, you have the right to ask for a human being to review it, to have the reasoning explained to you in plain terms, and to contest the outcome. Email privacy@vaultly.app or use the app. A person will look at it, not a re-run of the same model.

Who we share it with

We do not sell your personal information. We share it with:

✓Banks and payment partners, to carry out the payments you instruct.
✓Identity verification and fraud prevention providers.
✓Licensed credit bureaux, where you have a loan. This is a regulatory requirement.
✓Cloud hosting and infrastructure providers, under written confidentiality obligations.
✓Our professional advisers, where necessary.
✓Regulators, law enforcement and courts, where the law requires it.
✓A buyer, if the business is sold, subject to equivalent protection continuing.

Sending data outside Nigeria

Some of our providers store data outside Nigeria. Where that happens we transfer it only to a country the Nigeria Data Protection Commission recognises as adequate, or under a written contract containing standard contractual clauses that give your data the same protection it has here. You can ask us which mechanism applies to a specific provider.

How long we keep it

Account and identity records

For as long as you are a customer, then 5 years, as anti-money-laundering law requires

Transaction records

5 years from the date of the transaction

Loan records

5 years from final settlement

Complaint and case records

5 years from closure

Support messages

2 years

App usage and error logs

13 months

Marketing consent records

Until you withdraw consent, then 2 years as proof it was withdrawn

If a longer period is required by a regulator, a court or an active investigation, we keep it for that period and no longer.

Your rights

✓Get a copy of the personal data we hold about you.
✓Correct anything inaccurate or incomplete.
✓Ask us to delete data, where we are not required to keep it.
✓Receive your data in a portable format.
✓Object to processing based on legitimate interest, including profiling.
✓Withdraw consent at any time, for marketing or for biometrics.
✓Ask for a human review of an automated decision.

Use Settings then Privacy in the app, or email privacy@vaultly.app. We respond within 30 days. If we need longer we will tell you why within those 30 days. Exercising a right is free and we will not treat you differently for it.

If we get it wrong

If a data breach is likely to result in a high risk to you, we will tell you without undue delay, describe what happened, what data was involved, and what you should do. We report qualifying breaches to the Nigeria Data Protection Commission within 72 hours.

Complaining to the regulator

You can complain to us at privacy@vaultly.app, and we would prefer the chance to fix it. You also have the right to complain directly to the Nigeria Data Protection Commission at info@ndpc.gov.ng, whether or not you have raised it with us first.

Children

Vaultly is for people aged 18 and over. We do not knowingly collect information from anyone under 18, and we delete it if we discover we have.

Contact

Data Protection Officer, [PayLab Technologies Limited], [ADDRESS]. dpo@vaultly.app or privacy@vaultly.app.

Need a hand, or want to complain?

Every case gets a reference you can track and a written outcome. We acknowledge complaints within one business day.

Help centre → Make a complaint