Privacy Policy

1. Scope

This policy explains how ZebaPay, operated by MB Digital Services in Nigeria, handles personal data when you use our website, console and API. We process data in line with the Nigeria Data Protection Act (NDPA) and the guidance of the Nigeria Data Protection Commission.

2. Data we collect

Account data: name, email address, optional phone number, password hash, and your business details where applicable.

Verification data: date of birth, address, business registration details, and identity verification results. For BVN and NIN we submit the number to a licensed verification provider and store only the last four digits together with the verification result. We never store the full number.

Transaction data: collections, payouts, ledger entries, fees, narration, timestamps, virtual account numbers and settlement account details.

Security data: hashed transaction PIN, device unlock registration, API key hashes, IP address, browser and device information, and audit logs of sensitive actions.

Documents you upload for verification, stored in a private bucket and accessible only through short-lived signed links to authorised reviewers.

3. Why we process it

To create and operate your account and issue collection accounts.

To verify identity and meet anti-money-laundering, know-your-customer and other legal obligations.

To record balances accurately, calculate fees and pay settlement.

To detect and prevent fraud, abuse and unauthorised access.

To provide customer support and send service notifications such as confirmation codes and transaction alerts.

4. Legal bases

We rely on: performance of our contract with you; compliance with legal and regulatory obligations; our legitimate interest in securing the platform and preventing fraud; and your consent where we ask for it, which you may withdraw at any time.

5. Who we share data with

Licensed banking and payment partners who issue account numbers and execute transfers, to the extent needed to complete your transactions.

Licensed identity verification providers, for the verification check only.

Infrastructure providers who host our systems and deliver our email, under confidentiality obligations.

Regulators, banks and law enforcement where we are legally required to disclose.

We do not sell personal data and we do not share it for third-party advertising.

6. International transfers

Some infrastructure and email providers process data outside Nigeria. Where that happens we rely on providers offering an adequate level of protection and contractual safeguards.

7. How long we keep data

Transaction and verification records are retained for at least seven years after account closure, as required by Nigerian financial record-keeping rules. Security and audit logs are retained for as long as needed for fraud prevention and dispute resolution. Other data is deleted or anonymised when no longer needed.

8. How we protect data

Data is encrypted in transit. Passwords, transaction PINs, API keys and email confirmation codes are stored only as hashes. Money movement runs through controlled server-side functions with double-entry accounting, so a balance is never partially written.

Verification documents sit in a private bucket. Provider credentials are write-only and never returned to a browser. Sensitive administrative actions are recorded in an audit trail.

Access is limited to staff who need it for their role.

9. Your rights

You may request access to your data, correction of inaccurate data, deletion where no legal retention duty applies, a copy of your data in a portable format, restriction of certain processing, and withdrawal of consent.

To exercise a right, email support@zebapay.com. We respond within 30 days. You may also complain to the Nigeria Data Protection Commission.

10. Cookies and local storage

We use cookies and browser storage for sign-in sessions, your theme choice, device unlock and basic security. These are necessary for the service to work. We do not use advertising trackers.

11. Children

ZebaPay is not for anyone under 18. We do not knowingly collect data from children, and we delete such data if we discover it.

12. Changes and contact

We will notify material changes to this policy in the console or by email. Data protection enquiries: admin@zebapay.com. General support: support@zebapay.com.