Privacy Policy.

At a glance

The short version, because a privacy policy no one reads helps no one:

• We do not sell your personal data. Not to advertisers, not to credit brokers, not to analytics firms.
• We encrypt sensitive data at rest (AES-256) and in transit (TLS 1.3).
• We only share data when legally required — for KYC/AML, with CBN/NIMC, with our licensed partners who operate the wallet and savings products.
• You can export or delete your data anytime. Settings → Account → Export / Delete.
• We comply with NDPR (Nigeria Data Protection Regulation).

1. What we collect

Identity information. Full name, date of birth, BVN, NIN, NYSC call-up number, phone number, email, residential address, photograph (selfie for verification).

Financial information. Bank account details (linked for transfers), transaction history within Alawee, loan history, savings contributions.

Device and usage data. Device model, OS version, app version, IP address, approximate location (country/city level only), usage analytics.

Communications. Messages you send to support, feedback you provide.

2. Why we collect it

• To verify your identity (KYC / AML obligations)
• To deliver the services you've signed up for
• To assess credit eligibility and calculate your limits
• To detect and prevent fraud
• To comply with legal and regulatory obligations
• To improve our products (using anonymised/aggregated data)
• To contact you about your account and important updates

3. Who we share it with

Regulatory bodies. CBN, NIMC, NDIC, relevant tax authorities — as required by law.

Our licensed partners. Our CBN-licensed partner bank (for wallet operations), our custodian (for savings), our insurance partners (for Corper Cover). Each partner has their own NDPR-compliant handling.

Credit bureaus. CRC and CreditRegistry, as required by CBN regulation for lending activities.

Service providers. Infrastructure providers (Google Cloud, AWS), analytics (anonymised only), customer support tools. All bound by strict data-processing agreements.

We do NOT share with: advertisers, data brokers, social media platforms for targeting, third parties for marketing purposes.

4. How we protect it

• All sensitive data encrypted at rest using AES-256
• All data in transit protected by TLS 1.3
• Multi-factor authentication available (and required for sensitive actions)
• Regular security audits by third-party firms
• Access controls — only employees who need data for their role can see it, and access is logged
• Data minimisation — we don't collect what we don't need

5. Your rights

Under NDPR, you have the right to:

• Access — request a copy of all personal data we hold about you
• Rectify — correct any inaccurate data
• Erase — delete your data (subject to our legal retention obligations)
• Port — receive your data in a machine-readable format
• Withdraw consent — where we rely on consent, you can withdraw it
• Complain — to NITDA if you believe we've mishandled your data

Exercise any of these rights in-app or by emailing privacy@alawee.ng.

6. Retention

We keep your personal data only as long as we need to. Typical retention:

• Active account: for as long as your account is open
• Closed account: 7 years (regulatory requirement for financial records)
• Transaction records: 7 years
• KYC documents: 5 years after account closure
• Marketing preferences: until you unsubscribe

7. International transfers

Most data stays in Nigeria. Some infrastructure (Google Cloud, analytics tools) may process data in other jurisdictions. In those cases, we use standard contractual clauses to ensure NDPR-equivalent protection.

8. Children

Alawee is not for anyone under 18. We do not knowingly collect data from minors. If you believe we've accidentally done so, email privacy@alawee.ng and we'll delete it immediately.

9. Changes to this policy

If we make material changes to this policy, we'll notify you via email and in-app at least 30 days before they take effect.

10. Contact

Data Protection Officer: privacy@alawee.ng

Alawee Technologies Ltd. · Lagos, Nigeria