Privacy Policy
Last updated: 9 October 2026
1. Introduction
This Privacy Policy explains how Alphastrive Company Limited, operating as PaySphere, collects, uses, and protects your information when you use our website and mobile app. A step-by-step walk-through of each product step (what you do, what we collect, who we send it to) is at paysphere.ng/legal/how-paysphere-works. That page is an explanation. This policy is the binding privacy notice.
2. Information We Collect
We collect: your name, email, and phone; the result of your BVN check and the name returned (we do not store your full BVN; at most a masked display value); bank account details; trade, bill, eSIM, gadget, and wallet history; gift card photos; gadget delivery address and unboxing video; crypto receive addresses and conversion records; device and usage data; login IP, city or country, and browser; photos for support chat and identity (selfie processed by Dojah); push token; crash reports; and, if you allow it, precise GPS for fraud checks.
3. How We Use Your Information
We use your information to run your account, verify identity, price and review gift card trades, move NGN (wallet, Flutterwave checkout, withdrawals, bills), convert inbound crypto to NGN, provision eSIMs, source and deliver gadgets, prevent fraud, meet legal duties, and send you account messages. We do not sell your personal data.
4. Data Sharing
We share data only where needed to run the service: Flutterwave (checkout, bills, bank payouts); Dojah (BVN and facial liveness); Bitnob (crypto receive addresses and conversion; virtual cards only if we enable that product); Sotel (eSIM provisioning); Resend (transactional email); Cloudflare Turnstile (bot checks); Vercel (hosting and request logs); Supabase (accounts and database, EU-West); Sentry (errors, with masking configured); Upstash (rate limits, IP only); Expo (mobile push and updates); Telegram (internal staff alerts); Google (optional sign-in); and CBN, NFIU, NDPC or other authorities when the law requires it. Processors must protect the data in line with applicable law.
5. Lawful Bases for Processing
We process data on these bases: contract (to run the account, trades, wallet, bills, eSIM, gadgets, and crypto conversion you ask for); legal obligation (identity checks and records we must keep); legitimate interests (fraud and security, including IP-based login location); and consent (marketing, optional GPS, and the facial liveness check you start when you tap Verify). You can refuse KYC and stay on limited use. You can withdraw optional consent by turning off location, by not using marketing, or by deleting your account.
6. Biometric Data
Facial biometric data from the liveness check is processed by Dojah and is treated as sensitive personal data under the Nigeria Data Protection Act 2023. We only start that check when you open Verify Identity. We do not use your face for marketing.
7. Cross-Border Data Transfers
Some of our service providers process data outside Nigeria. We ensure appropriate safeguards are in place including standard contractual clauses.
8. Data Retention
We retain your data for as long as your account is active, and for up to 7 years after account closure, in line with CBN record-keeping requirements for financial platforms.
9. Data Security
We use industry-standard safeguards, including encryption and access controls, to protect your data. No method of storage or transmission over the internet is completely secure, but we work to protect your information to the best of our ability.
10. Your Rights
You have the right to access the personal data we hold about you, request corrections, request deletion, request a portable copy, object to certain processing, and withdraw consent you previously gave, subject to the retention rules above. Contact [email protected]. You can delete your account in the app (Profile, then Delete Account) or at https://www.paysphere.ng/delete-account.
11. Data Protection Officer
For data protection enquiries, contact our Data Protection Officer at [email protected] with the subject line "Data Protection Enquiry".
12. Data Breach Notification
We will notify affected users and the NDPC within 72 hours of becoming aware of a data breach as required by NDPA 2023.
13. Regulatory Authority
The Nigeria Data Protection Commission (NDPC) is the supervisory authority for data protection in Nigeria. You may lodge a complaint at ndpc.gov.ng.
14. Cookies
We use cookies and similar technologies to keep you signed in, remember your preferences, and understand how the platform is used. You can control cookies through your browser settings.
15. Changes to This Policy
We may update this Privacy Policy from time to time. Continued use of PaySphere after changes are posted constitutes your acceptance of the revised policy.
16. How each product step uses data
Signup, KYC, gift card sell, wallet, bills, crypto receive, eSIM, gadgets, referrals, and support are described step by step at paysphere.ng/legal/how-paysphere-works, including who receives the data at each step.
17. Cryptocurrency Data
Cryptocurrency receive addresses: We generate and store a receive address linked to your account for the purpose of crediting converted NGN to your wallet. This address is unique to you and stored securely. Transaction data: We record the amount, currency, network, timestamp, and conversion rate for each crypto-to-NGN conversion as part of your transaction history. We do not store private keys, seed phrases, or any cryptocurrency wallet credentials, and we do not hold cryptocurrency on your behalf. Blockchain transactions are public by nature. While PaySphere keeps your on-platform identity private, the receive address and transaction details are visible on the respective blockchain.
18. Contact
Questions about this Privacy Policy or your data can be sent to [email protected].