Privacy Policy

At BillSpot, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and website (collectively, the "Platform"). Our Platform provides services including:

• Airtime Purchases: Buy airtime for yourself or others across all major networks
• Data Subscriptions: Purchase internet data plans at competitive rates
• Bill Payments: Pay electricity, water, TV subscriptions, and other utility bills
• Airtime-to-Cash Conversion: Convert your excess airtime to cash instantly
• Wallet Management: Securely store funds and manage your transactions
• Money Transfers: Send money to friends, family, and businesses
• Virtual Cards: Create and manage virtual payment cards for eligible users
• Multi-Currency Wallet: Hold and use balances in supported currencies (e.g., NGN, USD, EUR, GBP)
• Foreign Exchange (FX): Convert and settle transactions across supported currencies
• USD / Foreign Currency Account Features: Receive account details and use eligible collection, transfer, or settlement rails where available

Please read this Privacy Policy carefully. By accessing or using our Platform, you acknowledge that you have read, understood, and agree to be bound by all the terms of this Privacy Policy. If you do not agree, please discontinue use of our Platform immediately.

1. Information We Collect

1.1. Information You Provide

• Account Information: When you register, we collect your name, email address, phone number, and password.
• Identity Verification: For KYC, we may collect your BVN, government-issued ID images, extracted document details, and proof of address. See Identity verification below.
• Transaction Data: We collect information related to your airtime purchases, bill payments, airtime-to-cash conversions, and other transactions you conduct on our Platform.
• Payment Information: We collect details about your payment methods, including bank account information, card details, and transaction history.
• Virtual Card Data: Information required to issue and manage virtual cards, including cardholder details, masked card identifiers, card reference tokens, card status, funding activity, merchant descriptors, authorization outcomes, and decline reason codes.
• Multi-Currency and FX Data: Selected wallet currency, quote/reference identifiers, rate shown at confirmation, estimated and final debit amounts, fee components, timestamps, and conversion outcomes.
• USD / Foreign Currency Account Data: Account-detail issuance metadata, linked payout destination details, transfer instructions, and related transaction records for supported foreign-currency rails.
• Communications: We store records of your interactions with our customer support team.

1.2. Information We Automatically Collect

• Usage Data: We collect information about how you interact with our Platform, including pages visited, features accessed, time spent, and actions taken.
• Device Information: We collect data about your device, including IP address, device type, operating system, browser type, mobile network information, and device identifiers.
• Location Data: With your permission, we may collect precise location data to provide location-based services and fraud prevention.
• Cookies and Similar Technologies: We use cookies, web beacons, and similar tracking technologies to collect information about your browsing behavior and preferences.

Identity verification

BillSpot uses a three-step identity process. Higher steps unlock higher limits. We do not use face liveness, selfie checks, handwritten notes, or video calls for KYC.

What we collect

• Tier 1 (BVN): Your Bank Verification Number and related name or status details from our verification partner.
• Tier 2 (ID document): Photos of the front and, where needed, back of a government-issued ID. We may store details read from the document (for example name, document number, expiry). Automated checks may include document quality, OCR, name matching against your profile, and a document-number check with our identity partner (Dojah) for national ID, passport, driver's licence, or voter's card. If the automated check is unclear, a BillSpot admin may review your upload.
• Tier 3 (proof of address): A proof of address document you upload (for example a utility bill or bank statement), plus address fields you enter or that we extract from the document.

Files are stored on BillSpot private identity storage. Sensitive fields and files are encrypted at rest (AES-256).

Why we use it

We use this data to verify who you are, meet regulatory and fraud rules for payment services, set feature and withdraw limits, and support admin review when needed. We do not sell identity data or use it for advertising.

Partners who process identity data

We may send extracted ID numbers and related name details to service providers that help us verify documents and screen for compliance (for example Dojah for Nigeria ID number checks and AML screening, and Google Gemini for document OCR or image checks when enabled). They process data under our instructions and their privacy terms. We may also share identity details with banking or card partners (for example Graph or Allawee) when needed to open or run accounts and cards you request. Ask privacy@billspot.co for a current list of processors.

• Dojah privacy / product terms: see https://dojah.io
• Gemini API terms: https://ai.google.dev/gemini-api/terms
• Google Privacy Policy: https://policies.google.com/privacy

How long we keep it

While your account is active, we keep identity and related compliance records as needed to run the service and meet legal duties. After you delete your account, we keep identity verification materials and compliance screening or alert records for five (5) years from the deletion date, then permanently delete them, unless a longer period is required by law. We do not keep this data forever.

Your rights

You may ask for access, correction, or deletion where the law allows. Some records must be kept for legal reasons. Contact privacy@billspot.co. See also Your Rights and Choices, Account and Data Deletion, and Contact Us below.

2. How We Use Your Information

We use your information for the following purposes:

1. Provide and Maintain Our Services
   • Process transactions (airtime purchases, bill payments, wallet management, airtime-to-cash conversions)
   • Authenticate your identity and secure your account
   • Provide customer support and respond to your inquiries
   • Send transaction confirmations and service-related notifications
2. Improve and Personalize Your Experience
   • Analyze usage patterns to enhance our Platform's features and functionality
   • Develop new products, services, and features
   • Personalize your experience based on your preferences and transaction history
3. Marketing and Communications
   • Send promotional offers, newsletters, and updates about our services (with your consent)
   • Conduct surveys and collect feedback about our services
4. Security and Compliance
   • Detect and prevent fraud, unauthorized transactions, and other harmful activities
   • Verify your identity as required by financial regulations
   • Comply with legal obligations, including anti-money laundering regulations
   • Resolve disputes and enforce our terms and policies
   • Provision, operate, and secure virtual card and multi-currency wallet features
   • Generate and validate FX quotes, calculate fees/spreads, and settle transactions in selected currencies
   • Conduct fraud/risk monitoring for card, wallet, and FX transactions, including anomaly detection and misuse prevention
   • Perform sanctions screening, AML/CFT checks, and enhanced due diligence where required
   • Manage transaction reversals, card disputes/chargebacks, investigations, and audit trails

3. Information Sharing and Disclosure

3.1. Service Providers

We share your information with trusted third-party service providers who help us operate, improve, and secure our Platform, including:

• Payment processors and financial institutions
• Telecommunications providers for airtime and data purchases
• Utility companies and bill payment processors
• Cloud hosting and storage providers
• Analytics and data processing services
• Customer support services
• Card issuers, card networks, and card-processing partners
• Foreign-exchange, treasury, and liquidity providers
• Banking and payment-rail partners supporting multi-currency account details, collection, and settlement

These service providers are contractually obligated to use your information only for the specific services they provide to us and are prohibited from using your information for their own purposes.

We require these providers to process personal information only for authorized purposes under contractual safeguards and applicable law, including security and confidentiality obligations.

BillSpot may use third-party infrastructure providers, including Graph (and similar regulated partners), to support account issuance, transaction orchestration, compliance checks, and settlement for eligible financial features.

3.2. Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency). We may also disclose your information to:

• Comply with legal obligations
• Protect and defend our rights or property
• Prevent or investigate possible wrongdoing in connection with our Platform
• Protect the personal safety of users of our Platform or the public

3.3. Business Transfers

If BillSpot is involved in a merger, acquisition, or sale of all or a portion of its assets, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our Platform of any change in ownership or uses of your information.

3.4. Financial Crime and Regulatory Sharing

BillSpot may share relevant information with banks, payment processors, card issuers/networks, regulators, and competent authorities where necessary to comply with legal obligations, including anti-money laundering, counter-terrorist financing, sanctions, fraud prevention, and transaction monitoring requirements.

Such disclosures are limited to what is necessary for compliance, risk management, dispute handling, and lawful enforcement requests.

4. Data Security

We take steps to protect your information from unauthorized access, disclosure, alteration, and destruction, including:

• End-to-end encryption for all data transmissions
• Secure Socket Layer (SSL) technology
• Multi-factor authentication for account access
• Regular security audits and penetration testing
• Strict access controls and monitoring systems

No method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security of your data.

5. Your Rights and Choices

Depending on your location, you may have certain rights regarding your personal information:

• Access and Portability: You can request a copy of your personal information that we hold.
• Correction: You can request that we correct inaccurate or incomplete information about you.
• Deletion: You can request that we delete your personal information in certain circumstances.
• Restriction and Objection: You can request that we restrict or stop processing your personal information.
• Withdrawal of Consent: Where we rely on your consent to process your information, you can withdraw your consent at any time.

To exercise these rights, please contact us using the information provided in the "Contact Us" section. We will respond to your request within 30 days.

You can also manage certain privacy settings directly in your BillSpot account settings, including:

• Updating your profile information
• Managing notification preferences
• Enabling or disabling location services
• Changing your password and security settings

5.1. Account and Data Deletion

We provide multiple options for account management and data deletion to give you control over your information:

In-App Options:

• Deactivate Account: Temporarily disable your account. Available in: Settings, then Account, then Deactivate Account
  • Your account will be temporarily disabled
  • You can recover it by resetting your PIN and password
  • Data is retained during deactivation
• Delete Account: Permanently delete your account. Available in: Settings, then Account, then Delete Account
  • Your account is marked deleted (soft delete) so recovery may be possible for a limited time
  • Identity and compliance records are kept for five (5) years after deletion, then removed, unless law requires longer
  • To recover a deleted account or ask about permanent deletion, contact support

Request Permanent Data Deletion:

If you want to permanently delete all your data from our systems, please contact our support team:

• Email: privacy@billspot.co or support@billspot.co
• Subject: "Permanent Data Deletion Request"
• Include: Your registered email address or phone number
• Processing Time: We will process your request within 30 days

Alternative: Delete via App

You can also delete your account directly from the app:

1. Open BillSpot app
2. Go to Settings, then Account
3. Select "Delete Account"
4. Follow the on-screen instructions

6. Cookies and Tracking Technologies

We use cookies, web beacons, and similar tracking technologies to:

• Remember your preferences and settings
• Keep you logged in to your account
• Understand how you interact with our Platform
• Analyze the performance of our Platform
• Prevent fraud and enhance security
• Personalize content and marketing (with your consent)

You can manage your cookie preferences through your browser settings. Most browsers allow you to block or delete cookies. However, if you block certain cookies, you may not be able to use all features of our Platform.

7. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. The criteria used to determine our retention periods include:

• The length of time we have an ongoing relationship with you
• Legal obligations to which we are subject (such as financial record-keeping requirements)
• Whether retention is advisable in light of our legal position (such as for statutes of limitations, litigation, or regulatory investigations)
• Card and Wallet Transaction Records: Retained for the period required by applicable financial, tax, and regulatory obligations.
• Card Dispute/Chargeback Records: Retained for dispute resolution and legal/regulatory retention periods.
• FX Quote and Settlement Logs: Retained for reconciliation, fraud prevention, auditability, and compliance purposes.
• Compliance and Screening Records: Kept while your account is active as required for AML/CFT. After account deletion, purged after five (5) years unless law requires longer.
• Identity Verification Materials: Kept while your account is active. After account deletion, purged after five (5) years unless law requires longer.

When we no longer need your information, we securely delete or anonymize it. Exact periods can vary by data type and legal duty. BillSpot follows a retention schedule and removes data when it is no longer required.

8. Children's Privacy

Our Platform is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately. If we become aware that we have collected personal information from a child without verification of parental consent, we will take steps to remove that information from our servers.

9. International Data Transfers

Your information may be transferred to and processed in countries other than the country in which you reside. These countries may have data protection laws that are different from the laws of your country.

Some virtual card, FX, and multi-currency transaction processing may involve processors or infrastructure located outside your country of residence. Where transfers occur, BillSpot applies appropriate legal and technical safeguards in line with applicable data protection laws.

International transfers of your personal information are handled in line with applicable data protection laws, with appropriate safeguards in place.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. When we make changes, we will update the "Effective Date" at the top of this Privacy Policy.

We will notify you of any material changes through a notice on our Platform or by sending an email to the email address associated with your account. We encourage you to review this Privacy Policy periodically to stay informed about our information practices.

Your continued use of our Platform after any changes to this Privacy Policy constitutes your acceptance of the revised Privacy Policy.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

We will respond to your inquiry as soon as possible and within 30 days.