Privacy Policy

1. Information We Collect

• Personal and account information: Your full name, phone number, email address and the unique user identifier assigned to your account.
• Authentication and app-lock information: Firebase Authentication processes your email address and password to create and secure your account. OPrime does not receive or store your readable Firebase password. If you enable the optional quick PIN, OPrime stores a salted cryptographic hash of the PIN, not the readable PIN. A protected copy of the PIN hash and salt may also be kept in your device's secure storage to support local app locking.
• Virtual account, wallet and reward information: Dedicated virtual bank-account details generated for wallet funding; wallet balances and balance history; credits, debits, refunds and reversals; cashback and reward-wallet records; purchase history; transaction references; and receipts.
• Payment information: OPrime does not store your full debit-card number, CVV, online-banking password or bank login credentials. When you choose a card or bank-payment option, those credentials are entered into and processed directly by the applicable payment provider. OPrime receives transaction status, reference and settlement information needed to fund your wallet and reconcile the payment.
• Utility and beneficiary information: Recipient phone numbers for airtime or data purchases, electricity meter numbers, cable-TV smartcard or decoder numbers, education-service identifiers and saved beneficiary details that you provide to fulfil an order.
• Optional photos and contacts: A profile photo or dispute evidence that you choose to upload, and the individual contact details that you deliberately select with the device contact picker for a transaction. OPrime does not need to upload your entire address book.
• Biometric data we do not collect: If you enable biometric unlock, Face ID, Touch ID or fingerprint verification is performed locally by your device's operating system. The app receives only a successful or unsuccessful authentication result. OPrime does not receive, store or transmit your fingerprint, facial scan or biometric template.
• Device and notification information: Firebase installation and push-notification tokens and limited device information needed to deliver notifications, protect accounts and operate the service. OPrime does not currently use an advertising SDK, Firebase Analytics or Firebase Crashlytics in the mobile app.
• Customer-support and approximate-location information: If you use live chat, Tawk.to may process your name, email address, OPrime user identifier, messages, IP address and device/browser information. An IP address may reveal an approximate location, such as a city or region; OPrime does not collect precise GPS location.

2. How and Why We Use Information

• Creating, authenticating, securing and managing your OPrime account.
• Providing wallet funding, airtime, data, electricity, cable-TV, education and other services that you request.
• Maintaining transaction history, calculating cashback, processing refunds and reconciling payments.
• Generating dedicated virtual bank accounts and confirming wallet-funding transactions.
• Sending service messages, welcome emails, security notices, push notifications and transaction alerts.
• Responding to support requests and resolving failed, disputed or reversed transactions.
• Preventing fraud, abuse and unauthorised access and complying with accounting, tax, regulatory and legal obligations.

We process this information as necessary to provide the service you request, comply with legal obligations, protect OPrime and its users, and, where required, based on your consent. You may withdraw consent for optional processing, but this does not affect processing already performed lawfully.

3. Service Providers and Data Disclosures

• Cloud infrastructure providers: Providers such as Google Firebase process account authentication, cloud database and file storage, server functions and push notifications on OPrime's behalf.
• Payment, banking and virtual-account providers: Payment providers such as Paystack and Monnify, participating banks and other configured funding providers may receive account and transaction details needed to initiate, verify, settle or reconcile a payment. Only providers needed for the transaction you choose are used.
• VTU, telecommunications, utility and education providers: Service aggregators and operators may receive the recipient number, selected product, meter number, smartcard/decoder number or education-service identifier required to fulfil your order.
• Customer-support providers: Tawk.to processes support messages and the contact and technical information described above when you use live chat.
• Legal and safety disclosures: We may disclose the minimum necessary information where required by law, a valid regulatory or court request, or to investigate fraud, security incidents or abuse.

These organisations process information under their own privacy terms or under service-provider obligations. OPrime does not sell personal information and does not share it for third-party advertising.

4. Data Retention

• Account and profile data: Retained while your account is active. Following a verified permanent-deletion request, data not subject to a legal or operational retention requirement is deleted within 7 business days.
• Financial, transaction, tax and accounting records: Retained for at least 6 years after the end of the relevant financial or assessment year, as required by applicable Nigerian tax and accounting rules. A record may be retained longer where a law, regulator, court order or unresolved legal claim requires it.
• Dispute, fraud-prevention and security records: Retained for up to 6 years after the relevant transaction, incident or dispute is closed, or longer only where needed for an active investigation, legal claim or regulatory obligation.
• Customer-support messages: Retained for up to 24 months after the support matter is closed, unless the message forms part of a transaction dispute, fraud investigation or legal record subject to the longer period above.
• Push-notification tokens and optional profile media: Retained while needed for the active account and deleted or invalidated when the account is permanently deleted, subject to short-lived provider backups and technical deletion cycles.

When a retention period expires, the information is deleted or irreversibly de-identified. We retain only the minimum information necessary for the applicable purpose.

5. Security and International Processing

• We use access controls, encrypted network connections, restricted administrative access and security monitoring designed to protect personal information.
• No internet or storage system can be guaranteed completely secure. Please protect your password, PIN and device and contact us immediately if you suspect unauthorised activity.
• Some service providers may process or store personal information outside Nigeria. When personal information is transferred internationally, we take reasonable steps to ensure the transfer is permitted under applicable data-protection law and protected by appropriate contractual, organisational and technical safeguards.

6. Account Deletion and Your Rights

• Subject to applicable law, you may request access, correction, restriction, objection, portability or deletion of your personal information and may withdraw consent for optional processing.
• You may deactivate/delete your account in the OPrime app by opening Profile, selecting "Deactivate/Delete Account", choosing a reason and confirming the request. Alternatively, you may request permanent deletion through our public Account Deletion page, or email support@oprime.app with the subject "Permanently delete my OPrime account" and include your registered phone number or email address so we can verify the request.
• Permanent deletion removes your Firebase Authentication account, profile, saved beneficiaries, profile media, notification tokens and other data not required to be retained. Temporary deactivation is reversible and is not permanent deletion.
• Where a provider holds personal information on OPrime's behalf, OPrime will instruct that provider to delete or de-identify the information covered by a valid request, subject to the provider's legal retention duties and technical deletion cycle. Independent payment, banking, telecom and utility providers may retain their own transaction records under their legal obligations.
• Records retained after account deletion are access-restricted, used only for the applicable legal, accounting, dispute or security purpose, and deleted or de-identified when the retention period in Section 4 expires.

7. Children and Policy Changes

• OPrime is intended for adults and is not directed to children under 18. Contact us if you believe a child has provided personal information so that we can investigate and take appropriate action.
• We may update this policy when our services, providers or legal obligations change. We will publish the revised policy with an updated effective date and provide additional notice where a material change requires it.