Privacy Policy

LAST UPDATED: SEPTEMBER 12, 2026

1. Information we collect

We collect the following categories of personal information, limited to what is necessary to open, verify, and operate your account:

• •Identity data: full name, date of birth, gender, residential address, and the verification status of your Bank Verification Number (BVN) and National Identification Number (NIN). We do not store your raw BVN or NIN number on our own servers. These numbers are passed to the licensed payments partner that verifies you and settles your payouts, named in section 3, and only the verification result, the document type used and an irreversible hash of the identity number are retained by us.
• •Biometric and document data captured during identity verification: a liveness selfie and, where you verify with a passport or driver's licence, photographs of that document. They are captured in the app by SmileID, named in section 3, which checks that you are present and that you match your identity record or document. Only when that check passes are the selfie and document photographs passed to the licensed payments partner that verifies you, and they are NOT retained by us: our servers hold them in memory for the length of the request and then discard them. Nothing reaches a storage bucket, a database column or a log on our side.
• •Device and fraud data from the SmileID check when you open your account: a device fingerprint, GPS location and fraud risk signals. Resetting a password, a transaction PIN or two factor authentication uses a code sent to your email and collects no biometric data.
• •Contact data: email address and mobile phone number. Registration currently requires a valid Nigerian mobile number.
• •Financial and transaction data: transaction history, bank account details used for payouts, cryptocurrency deposit addresses, and exchange records. Where you save a payout account for reuse, we store the account details on our servers and return only a masked account number to your device; the full number is never sent back to the app.
• •Account security data: a securely hashed transaction PIN (never stored or transmitted in plain text), and your multi-factor authentication enrollment status.
• •Device and technical data: IP address recorded at each sign-in (for account security and to show you your recent sign-in activity), app version, operating system, platform, and a push notification device token.
• •On-device security signals: our mobile app checks, on your device, for indicators such as a rooted or jailbroken device, debugging tools, code tampering, or installation from an unofficial app store. The results of these checks are not transmitted to our servers, except that installation from an unofficial source will prevent the app from being used at all.
• •Usage and diagnostic data: in-app event data (such as when you start identity verification, complete a transaction, or view a screen) and crash and error reports, collected through our analytics and crash reporting provider.
• •Rewards and referral data: your points balance, redemption history, and referral relationships with other users.
• •Business records you create: the clients you add, including any name, email address and note you enter about them; the invoices and quotes you raise; recurring invoice schedules; the expenses you log, including any receipt image you attach; and any withholding tax certificate you upload against an invoice. Receipt images and certificates are stored in a private area scoped to your account.
• •Notifications: the messages we have shown you in the app, and whether you have read them, kept so you can read them again.

WHERE YOU ENTER INFORMATION ABOUT SOMEBODY ELSE, such as a client's name and email address, you are responsible for having a lawful basis to do so. We hold it only to render your invoices and your records, we do not contact your clients, and we do not use their details for anything else.

We do not collect or store payment card numbers. We never store your transaction PIN or account password in a form that we, or anyone else, can read.

2. How we use your information

Your personal information is used to:

• •Verify your identity, assign your account verification tier, and comply with Know Your Customer (KYC) obligations under Nigerian law.
• •Screen you and your transactions against anti-money laundering (AML), sanctions, and politically exposed persons (PEP) watchlists.
• •Process your cryptocurrency sales through our exchange partner, Busha, and execute Naira payouts to your nominated bank account.
• •Operate optional features you choose to use, such as saved payout accounts and our rewards and referral program.
• •Produce the business records you ask us for: invoices and quotes, the page a client opens to pay one, your expense log, your income statement and your proof of income document.
• •Send you transaction notifications, account security alerts, and service updates.
• •Detect and prevent fraud, unauthorized access, and abuse of our platform.
• •Maintain and improve the security, stability, and performance of our app, including through crash reporting and aggregate usage analytics.
• •Prepare and file regulatory reports, including currency transaction reports and suspicious activity reports, as required by applicable Nigerian law.

3. Sharing your information

We share your data only with service providers who process it on our behalf, and only to the extent necessary for the purposes described above:

• •Busha: identity verification when you open your account, execution of cryptocurrency exchange transactions, Naira bank payouts, and payment of rewards redemptions to your bank account. For verification Busha receives your name, date of birth, address, identity number, selfie and, where you use one, your document photograph, both as captured in the SmileID check described below, and its decision on whether to verify you is final. For a payout it receives your name, bank account number, bank code, and the amount.
• •SmileID: anti-money laundering, sanctions, and politically exposed persons screening, performed by us as a server side check from your name and date of birth.
• •SmileID: identity checks with a liveness selfie. When you open your account, SmileID receives your selfie and either your National Identification Number, which it checks against the national register, or photographs of your passport or driver's licence, which it checks are genuine and show your face. Only when that check passes are the selfie and photographs passed to Busha.
• •Termii: delivery of the one time passcode used to verify your mobile number. Termii receives your mobile number for this purpose.
• •Mailtrap: delivery of transactional and security notices by email. Mailtrap receives your email address and the content of those notices.
• •Google Firebase: crash reporting, in-app analytics, and delivery of push notifications. Firebase processes device identifiers, app usage events, and crash diagnostic data on our behalf.
• •Regulatory and law enforcement authorities: where required by applicable Nigerian law, including the Central Bank of Nigeria and the Nigerian Financial Intelligence Unit, and any other authority with lawful jurisdiction over our operations.

Each of these providers is contractually restricted to using your data only for the purpose we have engaged them for. We do not sell your personal data to third parties for marketing purposes.

ONE DISCLOSURE IS YOURS TO MAKE, NOT OURS. When you share an invoice link, anybody holding that link can open a page showing your name as the person who issued it, the amount, what it is for, the dates, whether it has been paid, and the address to pay it. That is the point of the link, and you choose who receives it. It shows nothing else about you: no email address, no phone number, no tax number, no bank details, and no other invoice. You can revoke a link at any time, after which it stops working.

4. Data retention

We retain identity verification records, including the results of your KYC checks, for five years following the relevant verification, consistent with Nigerian anti-money laundering law. Notifications you have read are removed after 90 days, and unread ones are kept until you read them. Where our systems store an encrypted copy of your raw identity verification response, that copy is automatically and permanently redacted once this five-year period has elapsed. Transaction records and AML screening logs are retained for the same period. Other account data is retained for as long as your account remains active, and for a reasonable period afterward as needed to resolve disputes, enforce our agreements, and meet our legal and regulatory obligations.

5. Your rights (NDPR)

Under the Nigeria Data Protection Regulation (NDPR) and the Nigeria Data Protection Act, you have the right to:

• •Access the personal data we hold about you.
• •Request correction of inaccurate or incomplete data.
• •Request deletion of your data, subject to the regulatory retention requirements described in section 4 above.
• •Withdraw consent where our processing is based on your consent.

You can close your account yourself, from Profile in the app. Closing signs you out immediately and permanently prevents sign in with that account. It is not the same as erasure: as described in section 4, Nigerian anti money laundering law requires us to retain your identity verification and transaction records for a set period after the relationship ends, so we keep those and nothing else. Your push notification token, device binding, and marketing and reminder preferences are cleared at closure. You cannot close an account that still holds a balance, has a transaction in progress, or is subject to an open compliance review; withdraw your balance and let any transaction finish first.

To exercise any of the other rights above, please contact us at privacy@fendomoney.com. We will process your request manually and respond within the timeframe required by applicable law.

6. Security

We apply technical and organizational measures designed to protect your data, including encryption of sensitive identity data at rest, encryption of data in transit, and secure hashing of your transaction PIN. Money-moving actions on your account always require a second proof of identity beyond your password: either a multi-factor authentication check, or your transaction PIN. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Cookies and browser storage

Our web-based interfaces use only the browser storage technologies, which may include cookies and/or local storage, that are strictly necessary for authentication and session management. We do not use these technologies for advertising, and we do not use third-party advertising or tracking cookies.

8. Automated device security checks

Our mobile app runs automated, on-device checks to detect conditions that could compromise the security of your account, such as a rooted or jailbroken device, active debugging tools, code tampering, or an app copy installed from a source other than the official App Store or Google Play Store. These checks are performed locally on your device. If our app detects that it was not installed from an official app store, it will not permit further use of the app until reinstalled from an official source.

9. Changes to this policy

We may update this Privacy Policy to reflect changes in law or our services. Material changes will be communicated via email or in-app notification at least 14 days before they take effect. Continued use of the platform after that date constitutes acceptance.

10. Contact

Data protection questions and requests: privacy@fendomoney.com

Fendo Technologies Limited, Abuja, Nigeria.