Privacy Policy

Version 2026-10-31 · Effective 31 October 2026

Ashcrest Technologies, a company in Nigeria, owns and operates Peppy Wallet and is the data controller for the personal data described here. This policy explains what we collect, why, who we share it with and your rights under the Nigeria Data Protection Act 2023 (NDPA).

1. Data we collect

• Account details: your email address, password (stored only as a secure hash), name, country of residence and phone number when you give it.
• Security data: your transaction PIN (stored only as a keyed hash), any authenticator settings and recovery codes you set up before (encrypted or hashed), sign-in sessions, and security events such as PIN blocks and sign-ins.
• Wallet and transaction data: balances, receiving addresses, transfers, conversions, Save & lock records, payment requests, saved bank accounts, fees and statements.
• Bank and identity checks: to set up a naira receiving account we send your name, email, phone, BVN and linked bank account to our banking partners for validation. We do not store your BVN. We keep the result of the check and the receiving account details.
• Support: messages you send through Help & support and our replies.
• Technical data: IP address, device and browser details and request logs, used for security, fraud prevention and rate limiting.
• Public blockchain data: transfers to and from your addresses are recorded on public blockchains, which anyone can see. We cannot remove them.

The Peppy app uses your camera only when you choose to scan a QR code, and Face ID, Touch ID or your device passcode only to unlock the app on your device. Biometric data never leaves your device.

2. Why we use it

• To provide the wallet: hold balances, process transfers and conversions, and show your history. (Contract.)
• To keep accounts secure and prevent fraud, misuse and money laundering. (Legitimate interests and legal obligation.)
• To meet legal, tax, accounting and regulatory requirements and respond to lawful requests. (Legal obligation.)
• To send service messages such as email verification, security alerts and transaction notices. (Contract.)
• To answer support requests and improve the service. (Legitimate interests.)

We do not sell your personal data and do not use it for third-party advertising.

3. Who we share it with

We share only what each party needs to do its job:

• Payment and banking partners, to issue receiving accounts, validate identity and bank details, and process naira deposits and transfers.
• Blockchain data providers, to read balances and broadcast transfers. They see your public addresses and transfers, not your name.
• Market data providers, to fetch prices. No personal data is sent.
• Email delivery providers, to send you account and security messages.
• Hosting and backup providers, who store our systems and encrypted backups.
• Authorities, when the law requires it, or to protect the rights and safety of our customers and Peppy.

Some providers may process data outside Nigeria. Where they do, we rely on the safeguards the NDPA requires.

4. How long we keep it

We keep account, transaction and identity-check records while your account is open and for at least five years after it closes, or longer where the law requires, so we can meet financial record-keeping and anti-fraud obligations. Security logs are kept for a shorter period unless needed for an investigation. Encrypted backups are replaced on a rolling schedule.

5. How we protect it

We encrypt sensitive data, keep the keys to your crypto addresses in an isolated signing service, require your PIN for money leaving your account, and limit staff access to what their role needs, behind a separate authenticator. No system is perfectly secure; tell us at once if you suspect misuse of your account.

6. Your rights

Under the NDPA you can ask to:

• access the personal data we hold about you and get a copy;
• correct inaccurate or incomplete data;
• delete data we no longer need, unless the law requires us to keep it;
• restrict or object to some uses, and withdraw consent where we rely on it;
• receive your data in a portable format. Your statement export in Activity covers your transaction history.

You can also complain to the Nigeria Data Protection Commission. We would appreciate the chance to resolve your concern first.

7. Children

Peppy Wallet is not for anyone under 18, and we do not knowingly collect their data.

8. Changes

We may update this policy. The version and date at the top will change, and we will tell you in the app about material changes.

9. Contact

To use your rights or ask about your data, contact us through Help & support in the app (Settings, then Help & support) and mention "privacy" in your message.