Data Protection Policy
Last updated: 10 October 2026
1. Who This Applies To
This policy is published by Alphastrive Company Limited (RC 7467693), operating as PaySphere. It covers every person who creates an account, uses the website at paysphere.ng, or uses the PaySphere mobile app. When we say "we", "us", or "our", we mean Alphastrive Company Limited.
2. Our Commitment
We collect and use your personal data to run a payment and gift card platform. We do not sell your data, and we do not use it for anything you would not reasonably expect. This policy sets out what we collect, why we collect it, who we share it with, how long we keep it, and what rights you have under the Nigeria Data Protection Act 2023 (NDPA).
3. Data Controller
Alphastrive Company Limited is the data controller for all personal data processed through PaySphere. Registered address: Lagos, Nigeria. RC 7467693. You can reach us at [email protected].
4. Data Protection Officer
Our Data Protection Officer is Abiodun Tolulope. You can contact them at [email protected] with the subject line "Data Protection". For general account queries, use [email protected].
5. What We Collect
We collect: your full name, email address, phone number, and date of birth (provided at signup and KYC); your Bank Verification Number (BVN) result — we run a check through Dojah but do not store your raw BVN, only the masked display value and the name it returned; your transaction history and wallet activity; your device type, browser, operating system, and IP address; your login location (city or country derived from IP); gift card photos and trade details; gadget delivery address; crypto receive addresses and conversion records; eSIM purchase and ICCID records; bank account details for withdrawals; a selfie photo for facial liveness (processed by Dojah); and, if you allow it in the app, your precise GPS location for fraud checks.
6. Why We Collect It
We use your data to: create and run your account; verify your identity as required by CBN regulations; price and review gift card trades; move money through Flutterwave for checkouts, withdrawals, and bills; convert inbound crypto to NGN via Bitnob; provision eSIM plans through Sotel; fulfil gadget orders; detect and prevent fraud; comply with NFIU anti-money-laundering reporting obligations; send you account notifications and transaction receipts; and respond to support queries. We do not use your data for advertising profiling.
7. Legal Basis for Processing
We process your data on four bases under NDPA 2023: (1) Contract — to deliver the account, wallet, trades, bills, crypto, eSIM, and gadget services you asked for. (2) Legal obligation — KYC, BVN verification, and the financial records we are required to keep. (3) Legitimate interests — fraud detection, login location monitoring, and platform security. (4) Consent — marketing communications, the facial liveness check, and precise GPS location. You can withdraw consent-based processing at any time by contacting us or using the in-app settings.
8. Who We Share Data With
We share data only with the processors needed to run the platform: Flutterwave (payment processing and bank payouts); Dojah (BVN verification and facial liveness); Bitnob (crypto receive addresses, conversion, and virtual cards when live); Sotel (eSIM provisioning); Supabase (accounts and database, hosted in EU-West); Vercel (hosting and edge request logs); Resend (transactional email); Cloudflare Turnstile (bot and abuse checks); Upstash (rate limiting, IP addresses only); Expo (mobile push notifications and OTA updates); Sentry (crash reporting, with PII masking); Telegram (internal operational alerts — staff only); and Google (optional sign-in if you choose it). We share with Nigerian financial authorities (CBN, NFIU, NDPC) when the law requires. All processors are contractually required to protect data in line with applicable law.
9. Cross-Border Transfers
Some of our processors store or process data outside Nigeria. Where this happens, we rely on standard contractual clauses or equivalent transfer mechanisms to make sure your data stays protected. Supabase stores data on EU-West servers. Vercel uses edge nodes globally but keeps request logs under EU data processing terms.
10. How Long We Keep Your Data
We keep your account data for as long as your account is open, and for up to 7 years after it is closed. This is in line with CBN record-keeping requirements for financial platforms. Crash logs in Sentry are deleted after 90 days. Rate-limit IP records in Upstash expire after the rate window closes (typically 60 seconds to 24 hours). You can delete your account through the app (Profile → Delete Account) or at paysphere.ng/delete-account.
11. Your Rights Under NDPA 2023
You have the right to: access the personal data we hold about you; request corrections to anything inaccurate; request deletion of your data, subject to our retention obligations; request a portable copy of your data in a structured format; object to processing based on legitimate interests; and withdraw consent you previously gave. To exercise any of these, email [email protected]. We will respond within 30 days. We may need to verify your identity before we act on a request.
12. Data Security
We use HTTPS on all connections, row-level security on the Supabase database, hashed transaction PINs, and access controls that limit which staff can see personal data. We run rate-limiting on every sensitive endpoint. No internet system is completely secure, but we work to apply industry-standard protections across the platform. Our full approach is documented in the Information Security Policy at paysphere.ng/legal/security-policy.
13. Data Breach Notification
If we discover a breach that puts your personal data at risk, we will notify the NDPC within 72 hours of becoming aware of it. We will also notify affected users without undue delay if the breach is likely to cause them harm. Notifications will go to the email address on your account.
14. Children
PaySphere is for people aged 18 and over, resident in Nigeria. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, contact us at [email protected] and we will close it.
15. Regulatory Authority
The Nigeria Data Protection Commission (NDPC) supervises data protection in Nigeria. If you are not satisfied with how we handle a complaint, you can contact the NDPC at ndpc.gov.ng.
16. Changes to This Policy
We may update this policy. If we make a material change, we will let you know by email or in-app notification before it takes effect. Continued use of PaySphere after the update means you accept the revised policy.
17. Contact
Data protection questions: [email protected] or [email protected] (DPO). Alphastrive Company Limited, Lagos, Nigeria. RC 7467693.