Record of Processing Activities
Last updated: 10 October 2026 · Alphastrive Company Limited (RC 7467693)
About This Record
This is the Record of Processing Activities (ROPA) for Alphastrive Company Limited (RC 7467693), operating as PaySphere. The Nigeria Data Protection Act 2023 (NDPA) requires us to maintain a record of all the ways we process personal data. This document is that record. It describes each processing activity, who the data is about, what data is involved, why we process it, and how long we keep it.
Data Controller
Alphastrive Company Limited, Lagos, Nigeria (RC 7467693). Contact: [email protected]. Data Protection Officer: Abiodun Tolulope — [email protected].
Processing Activities
#01
Account Creation and Authentication
Data subjectsApp users and website visitors who sign up
Personal dataFull name, email address, phone number, date of birth, password hash, device info, IP address, login location (city/country)
PurposeCreate and manage user accounts; verify identity at login
Legal basisContract (to deliver the service the user signed up for)
RecipientsSupabase (authentication and database); Vercel (hosting); Google (optional — only if the user chooses Google sign-in)
Retention7 years after account closure (CBN requirement)
International transfersSupabase: EU-West. Vercel: global edge with EU data terms.
#02
KYC / Identity Verification
Data subjectsUsers completing identity verification
Personal dataBVN check result and the name it returned (raw BVN not stored; only masked display value); selfie photo for liveness check
PurposeVerify user identity as required by CBN AML/KYC regulations; prevent fraud and account takeover
Legal basisLegal obligation (CBN KYC regulations); Consent (facial liveness — user initiates)
RecipientsDojah (BVN lookup and facial liveness processor); Supabase (stores verification result, not raw BVN)
Retention7 years after account closure
International transfersDojah: Nigeria-based processor.
#03
Gift Card Trades
Data subjectsUsers submitting gift cards for NGN payment
Personal dataGift card photos, card denomination and type, trade amount and NGN rate, trade status, wallet credit record
PurposeProcess and price gift card trades; credit NGN to the user's wallet; detect fraudulent cards
Legal basisContract (the trade the user submitted)
RecipientsSupabase (trade records); Telegram (internal staff review alerts — no card images sent)
Retention7 years after account closure
International transfersSupabase: EU-West.
#04
Wallet and Withdrawals
Data subjectsUsers with an NGN wallet balance
Personal dataWallet balance, transaction history (credits and debits), withdrawal amount, bank account details, Flutterwave transaction reference
PurposeHold NGN balances, credit trades and conversions, process bank withdrawals
Legal basisContract (wallet service the user opted into)
RecipientsFlutterwave (bank payout processing); Supabase (wallet and transaction records)
Retention7 years after account closure
International transfersFlutterwave: Nigeria-based processor with cross-border operations. Data processing terms apply.
#05
Bill Payments
Data subjectsUsers paying bills (airtime, data, electricity, cable)
Personal dataMeter/phone number, service provider, payment amount, transaction reference, timestamp
PurposeProcess utility and airtime payments on behalf of the user
Legal basisContract (payment the user initiated)
RecipientsFlutterwave (bills API); Supabase (transaction records)
Retention7 years after account closure
International transfersFlutterwave: Nigeria-based.
#06
Cryptocurrency Receive and Conversion
Data subjectsUsers who activate a crypto receive address
Personal dataCrypto receive address (linked to the user's account); inbound transaction amount, currency, network, timestamp, and NGN conversion rate; ICCID (not applicable here)
PurposeGenerate a receive address; convert inbound crypto to NGN; credit the user's wallet
Legal basisContract (crypto receive feature the user activated)
RecipientsBitnob (address generation and conversion); Supabase (address and conversion records)
Retention7 years after account closure; blockchain transactions are public and cannot be deleted
International transfersBitnob: Nigeria-based processor.
#07
eSIM Purchases
Data subjectsUsers who buy an eSIM data plan
Personal dataSelected country, plan name, price paid, ICCID, activation code, purchase timestamp
PurposeProvision a digital SIM plan for international data access
Legal basisContract (eSIM purchase the user made)
RecipientsSotel (eSIM provisioning); Supabase (purchase records)
Retention7 years after account closure
International transfersSotel: international eSIM provider.
#08
Gadget Orders
Data subjectsUsers who order a gadget
Personal dataDelivery name and address, phone number for delivery, order items and price, payment record, unboxing video (if requested for dispute)
PurposeFulfil gadget orders and manage delivery and disputes
Legal basisContract (order the user placed)
RecipientsSupabase (order records); fulfilment partners as needed for delivery
Retention7 years after account closure
International transfersSupabase: EU-West.
#09
Fraud Detection and Security
Data subjectsAll users
Personal dataIP address, login location (city/country from IP), device fingerprint, login timestamps, failed login count, rate-limit hits
PurposeDetect and block suspicious activity, account takeover attempts, and fraudulent transactions
Legal basisLegitimate interests (protecting the platform and other users from fraud)
RecipientsUpstash (rate-limit state, IP only — TTL: 60 seconds to 24 hours); Supabase (login audit logs)
RetentionRate-limit records: expire after the rate window. Login logs: 7 years.
International transfersUpstash: EU region.
#10
Error Monitoring and Crash Reporting
Data subjectsAll users (anonymised)
Personal dataError messages, stack traces, request path, masked user ID; Sentry is configured to mask PII in session replays
PurposeDetect and fix bugs; maintain platform reliability
Legal basisLegitimate interests (maintaining a working product)
RecipientsSentry (error and performance monitoring)
Retention90 days in Sentry
International transfersSentry: US-based, EU data processing addendum available.
#11
Transactional Email
Data subjectsAll users
Personal dataEmail address, email subject, timestamp
PurposeSend account notifications, trade receipts, and security alerts
Legal basisContract (account communications)
RecipientsResend (transactional email delivery)
RetentionEmail send logs: 30 days in Resend.
International transfersResend: US-based with EU data processing terms.
#12
Mobile Push Notifications and App Updates
Data subjectsMobile app users
Personal dataExpo push token, app version, device platform
PurposeSend push notifications; deliver over-the-air app updates
Legal basisContract (notification delivery for the service)
RecipientsExpo (push delivery and OTA updates)
RetentionPush tokens: retained while the user's account is open.
International transfersExpo: US-based.
#13
Support and Complaints
Data subjectsUsers who contact support
Personal dataEmail or in-app messages, photos shared in support threads, account ID, trade or transaction details discussed
PurposeResolve user issues, disputes, and complaints
Legal basisContract (support as part of the service)
RecipientsSupabase (support message storage); Telegram (internal staff alerts for urgent cases)
Retention7 years after account closure
International transfersSupabase: EU-West.
#14
Regulatory Reporting
Data subjectsUsers involved in flagged transactions
Personal dataTransaction records, identity data, account history — only what is required by the authority
PurposeComply with CBN AML requirements and NFIU suspicious transaction reporting obligations
Legal basisLegal obligation
RecipientsCBN, NFIU, NDPC, or other Nigerian regulatory authorities as legally required
Retention7 years minimum (CBN requirement)
International transfersWithin Nigeria only.