Amaripay Privacy Policy
Amaripay Tagline: Building Digital Trust Across Africa
Effective date: 15 September 2026
Last updated: 15 September 2026
Contact: hello@amaripayglobal.com
1. Who we are and what this Policy covers
Amaripay is a digital trust platform designed to support identity-aware, document-aware, and payment-enabled transactions across Africa and the diaspora. Depending on the product flow, Amaripay may provide account access, identity and document verification, property or merchant workflows, messaging, transaction records, conditional settlement instructions, customer support, and related trust infrastructure through the Amaripay mobile application, websites, APIs, and connected services. Together, these are the Services.
This Privacy Policy explains how Amaripay collects, uses, stores, discloses, protects, and deletes personal information when you use the Services, contact us, create or use an account, submit verification information, list or view a property or service, request a role upgrade, make or receive a payment, communicate with another user, or otherwise interact with Amaripay.
The Services may contain links to third-party websites, payment pages, identity-verification pages, or other services. Those services have their own privacy notices. This Policy does not make Amaripay responsible for the privacy practices of a third party that operates independently of Amaripay.
2. The information we collect
We collect information that is necessary to operate the Services, protect users, meet legal and compliance obligations, and investigate disputes or misuse. The categories below describe the information we may process; the exact categories depend on the features you use.
| Category | Examples | How it is obtained |
| Account and identity information | Name, email address, phone number, profile details, date of birth where required, country, role, and account identifiers | From you, your sign-in provider, or account records |
| Authentication and security information | Firebase user identifier, sign-in method, verification status, two-factor authentication settings, recovery-code status, login events, device and session information | From your use of the Services and our authentication and security systems |
| KYC and identity-verification information | BVN, NIN, identity-document details, document images, selfie or liveness information, verification responses, risk signals, and provider reference numbers | From you and identity-verification providers such as Prembly, where you initiate or are required to complete verification |
| Payment and transaction information | Transaction reference, amount, currency, payer and recipient details, payment status, refunds, chargebacks, settlement instructions, payment timestamps, and provider responses | From you, the transaction, and payment providers such as Flutterwave |
| Property, merchant, and role information | Listing details, property documents, ownership or authority information, business information, upgrade requests, verification evidence, and communications | From you and, where relevant, an authorised administrator or counterparty |
| User content and communications | Messages, enquiries, support requests, uploaded documents, photographs, descriptions, reviews, and other content you submit | From you or other users who communicate with you |
| Technical and usage information | IP address, device model, operating system, app version, browser type, crash data, approximate location inferred from network data, pages or screens viewed, actions, timestamps, and referral information | Automatically from devices, browsers, app logs, and service infrastructure |
| Corporate enquiry information | Name, email address, enquiry category, message, and privacy acknowledgement | From you when you use the corporate website contact form |
| Marketing and preference information | Communication preferences, consent records, campaign or referral identifiers, and responses to communications | From you and from our communications systems |
Please do not send BVN, NIN, payment-card numbers, bank passwords, identity-document images, or other sensitive information through a general corporate enquiry form. Use the relevant secure in-app workflow instead.
3. Sensitive personal information
Some information used for identity verification, fraud prevention, or regulated financial and transaction processes may be sensitive or subject to enhanced legal protection. This can include government-issued identifiers, biometric or liveness information, identity-document images, financial or transaction information, and information about suspected fraud or compliance concerns.
We process sensitive information only when it is necessary for a stated purpose and when we have an appropriate lawful basis, authorisation, contractual arrangement, legal obligation, or other permission recognised by applicable law. We apply access controls and limit sensitive information to personnel and providers who need it for the relevant purpose. We do not ask for more information than reasonably necessary for the feature or verification level involved.
4. How we use information
We may use personal information to create and administer your account; authenticate you; provide the Services; determine and manage account roles; process identity and document verification; connect you with payment, transaction, property, merchant, or other platform participants; initiate and reconcile payments; administer conditional settlement instructions; maintain transaction history; send security, verification, service, and support communications; respond to enquiries; detect, prevent, investigate, and document fraud, money laundering, abuse, unauthorised access, and other prohibited conduct; resolve disputes and chargebacks; protect the rights, safety, and property of Amaripay and users; comply with tax, court, regulatory, law-enforcement, and other legal obligations; troubleshoot, secure, maintain, and improve the Services; measure performance and understand how features are used; administer referrals or partnerships where enabled; and establish, exercise, or defend legal claims.
We do not use identity or payment information for unrelated advertising. If we introduce optional marketing or profiling features, we will provide the notices and choices required by applicable law.
5. Lawful bases
Depending on the context and applicable law, Amaripay may rely on one or more of the following bases: performance of a contract or steps requested before entering a contract; compliance with a legal or regulatory obligation; consent, where consent is required or is the appropriate basis; legitimate interests in operating a secure and reliable trust platform, preventing fraud, supporting users, improving services, and protecting rights, provided those interests do not override applicable rights; and establishment, exercise, or defence of legal claims.
Where we rely on consent, you may withdraw it through the available control or by contacting us. Withdrawal does not affect processing already carried out lawfully before withdrawal and may mean that a feature cannot be provided.
6. Verification and provider decisions
Amaripay may use third-party verification services to validate identity, documents, liveness, or other information. A provider may return a verified, failed, pending, unavailable, or other status. Amaripay may use those results with other information to decide whether a feature, role, listing, transaction, or account action can proceed.
A verification result does not guarantee that a person is honest, that a document proves ownership, that a property is suitable, or that a transaction will be completed safely. Where a significant decision is made using automated or provider-generated information, you may contact us to request clarification, correction, or human review where required by applicable law.
7. Payments and transaction information
Payments may be initiated or processed through third-party providers, including Flutterwave or another provider shown at checkout. Amaripay may receive transaction references, status, amount, currency, payer or recipient identifiers, and limited provider responses needed to reconcile the transaction and maintain records. Payment-card credentials are generally entered on the provider’s payment interface and are not intended to be stored by Amaripay.
Payment providers may process information under their own privacy notices and terms. A transaction may be delayed, reversed, refunded, placed under review, or otherwise affected by the provider, a bank, a card scheme, a regulator, a dispute, fraud controls, or applicable law.
8. When we share information
We may disclose information to service providers and professional advisers that process it for Amaripay under contractual or confidentiality safeguards; identity-verification providers such as Prembly when you initiate or require verification; payment and settlement providers such as Flutterwave; authentication, hosting, database, communications, analytics, error-monitoring, notification, and infrastructure providers; users or counterparties where disclosure is necessary for a requested transaction or communication; administrators and reviewers responsible for platform safety, KYC, listings, disputes, or account support; regulators, courts, law-enforcement agencies, tax authorities, or other public bodies where required or permitted by law; actual or potential investors, acquirers, financing parties, or professional advisers subject to confidentiality and appropriate safeguards; and other parties where necessary to protect life, safety, property, rights, security, or the integrity of the Services.
We do not sell personal information for money. We do not disclose BVN, NIN, identity documents, or biometric information publicly. We disclose the minimum information reasonably needed for the relevant purpose, subject to applicable law and the transaction context.
9. International and cross-border processing
Amaripay and its providers may process information in Nigeria or other countries where our infrastructure or service providers operate. Where information leaves Nigeria or another applicable jurisdiction, Amaripay will use the safeguards required by applicable data-protection law, which may include contractual protections, adequacy mechanisms, consent, regulatory approvals, or other recognised transfer safeguards.
You may contact us for information about the relevant categories of recipients and transfer safeguards, subject to security, confidentiality, and legal restrictions.
10. Cookies, device storage, and similar technologies
Our websites and web application may use cookies, local storage, pixels, SDKs, or similar technologies to keep you signed in, remember preferences, protect sessions, understand technical performance, prevent abuse, and measure service usage. Necessary technologies may operate because they are required for the Service. Optional analytics, preference, or marketing technologies will be used only as permitted by applicable law and, where required, after your choice.
You can control cookies through your browser or device settings. Disabling necessary storage may prevent some features from working. The mobile application may store authentication, security, preference, or transaction-state information in device storage or secure device storage so that the app can function and resume safely.
11. Security
Amaripay uses administrative, technical, and organisational safeguards appropriate to the sensitivity and risk of the information, including access controls, authentication, encryption or secure transmission where appropriate, logging, provider controls, least-privilege practices, verification checks, fraud monitoring, and incident-response procedures. No internet service, device, provider, or transmission is completely secure. You must protect your device, passwords, authentication methods, recovery codes, and email account, and report suspected unauthorised access promptly.
If Amaripay identifies a personal-data incident, we will assess it and notify affected people or regulators when required by applicable law.
12. Retention
We keep personal information only for as long as it is reasonably necessary for the purposes described in this Policy, unless a longer period is required or permitted by law. Retention depends on the type of information, the reason it was collected, the risk of disputes or fraud, the need to preserve evidence, accounting and tax requirements, regulatory obligations, and limitation periods.
| Record type | Typical approach |
| Account and profile data | Retained while the account is active and for a limited period after closure as needed for security, dispute handling, fraud prevention, and legal obligations |
| KYC and identity-verification records | Retained for the applicable compliance, fraud, dispute, and legal period; access is restricted |
| Payment, transaction, settlement, and dispute records | Retained for accounting, reconciliation, fraud prevention, chargeback, dispute, and legal or regulatory needs |
| Security, authentication, and audit logs | Retained for security monitoring, incident investigation, fraud prevention, and legal needs |
| Corporate contact enquiries | Retained for responding, follow-up, recordkeeping, and legal or security needs, then deleted or anonymised when no longer required |
When you request account deletion, Amaripay will deactivate the account as soon as reasonably practicable and will delete or anonymise eligible information when the applicable retention period ends. Amaripay may retain information for approximately 90 days after deactivation where needed for fraud prevention, disputes, security, audit, or legal and regulatory review, and may retain particular records longer where required by law, a provider rule, a court, or a legitimate compliance obligation. Deletion from active systems may not immediately remove information from secure backups, which are managed for recovery and overwritten or deleted according to their lifecycle.
13. Your rights and choices
Subject to applicable law and reasonable verification of your identity, you may have rights to request access to your personal information; correction of inaccurate or incomplete information; deletion or anonymisation; restriction or objection to certain processing; withdrawal of consent; portability where applicable; information about processing and recipients; and review of certain automated decisions. You may also manage notification preferences through the app where the relevant control is available.
Some requests may be refused or limited where necessary to protect another person’s rights, preserve evidence, prevent fraud, meet legal obligations, maintain a secure service, or comply with a provider or regulator. We will explain the reason where the law permits us to do so. To make a request, email hello@amaripayglobal.com with the subject Privacy request and describe the information or action you need. We may request additional information to verify that the request comes from the relevant person.
If you believe your rights have not been respected, contact us first so that we can investigate. You may also contact the Nigeria Data Protection Commission or another competent supervisory authority where applicable.
14. Children
The Services are not directed to children and are not intended for a person who cannot lawfully enter into the relevant account, payment, property, or other transaction. We do not knowingly collect children’s personal information for independent use. If you believe a child has submitted information, contact us so that we can assess and remove it where appropriate.
15. Third-party services and links
The Services may use or link to Firebase, Flutterwave, Prembly, email providers, hosting providers, notification providers, app stores, social sign-in providers, and other services. Their processing is governed by their own terms and notices. Amaripay is responsible for the processing it controls, but cannot guarantee the availability, security, or practices of an independent third party.
16. Changes to this Policy
We may update this Policy when the Services, law, providers, or data practices change. We will publish the updated version with a new effective date and, where required, provide additional notice or obtain consent. If a change materially affects your rights, we will use a reasonable communication method. Your continued use after an effective update means you acknowledge the updated notice to the extent permitted by law.
17. Contact and complaints
For privacy questions, data-rights requests, security concerns, or complaints, contact:
Amaripay Privacy Team Email: hello@amaripayglobal.com Subject: Privacy request or Privacy complaint
Before publication, the operator should replace the generic brand contact above with the registered legal entity name, registered office address, dedicated privacy/DPO email, and any officially designated complaint channel.
References and compliance sources
This draft was informed by the following public sources and should be checked against the law applicable to Amaripay’s final operating model:
1.Nigeria Data Protection Commission, Nigeria Data Protection Act, 2023
2.Nigeria Data Protection Commission
3.Central Bank of Nigeria, Payment Service Providers
4.Federal Competition and Consumer Protection Commission
Publication note: This document should be presented before account creation and linked from the app’s Profile, sign-in/sign-up, KYC, payment, support, and account-deletion flows. The version accepted by a user should be timestamped and retained as evidence of notice and acceptance where appropriate.
Draft — review with qualified Nigerian counsel and a privacy professional before relying on it.
Assumptions requiring confirmation before publication
The operator should confirm the exact registered company name and address, whether Amaripay is itself licensed or acts through licensed partners for payment or other regulated services, the final provider list, the dedicated DPO/privacy contact, the actual analytics and crash-reporting tools, the final retention schedule, the countries where providers process data, and the mechanism for NDPC complaints and data-subject requests. These confirmations should be incorporated into the final version rather than left implicit.