WEYSURE
Open account
Legal

Privacy Policy

This policy explains what data WEYSURE collects, how it is used and who it is shared with, across the web app and the API. It covers account, identity, transaction, developer and technical data, security, retention and your choices. Questions or requests go to [email protected].

Last updated

1. Scope

This Privacy Policy applies to WEYSURE web and API services, including user escrow flows and developer API integrations. It explains what data we collect, how we use it, who we share it with, how long we keep it, and the rights you have under the Nigeria Data Protection Act 2023 (NDPA).

2. Information We Collect

  • Account data: name, email, phone number, date of birth, password hash, role, verification tier, and account status.
  • Identity data: when you verify your identity, the name and date of birth on your BVN record, a masked ID number, a one-way fingerprint of the ID number, and the results of the identity, selfie and liveness checks. We do not keep your full BVN, your selfie, or the identity provider's raw data.
  • Payout data: the bank accounts you add for withdrawals and the account name the bank returns for them.
  • Transaction data: escrow records, wallet transactions, top-ups, refunds, withdrawals, payment holds, dispute records, references, and related metadata.
  • Invitation data: if a WEYSURE user invites you to a deal, the email address they gave us. We use it only to send the invitation and to match it when you join, and we delete it 30 days after an invitation closes without being accepted.
  • Developer data: API keys (stored as hashes), webhook endpoints, usage logs, and webhook delivery logs.
  • Technical data: IP address, user-agent, request metadata, and security audit events.
  • Device and network signals: a random device identifier stored in a cookie, and one-way keyed hashes of that identifier and of your IP address, recorded when you sign in and when you create, accept or confirm a deal. See section 7.

3. How We Use Information

  • Provide escrow, wallet, top-up, refund, withdrawal, dispute, and developer API functionality.
  • Authenticate users and API clients, enforce permissions, and apply verification tiers and limits.
  • Verify your identity and phone number, and pay out only to bank accounts in your own name.
  • Detect and prevent fraud, including stolen-card payments and linked accounts trading with each other, and place temporary holds on payments that need a check.
  • Send operational emails and text messages such as verification codes, password reset, payment, payout, hold and dispute notices.
  • Support platform operations, troubleshooting, and security monitoring.
  • Meet our legal, regulatory, accounting and audit obligations.

4. Legal Bases for Processing

Under the NDPA we rely on the following lawful bases:

  • Contract: to open and run your account, hold and release escrow funds, process payments, refunds and withdrawals, and handle disputes.
  • Legal obligation: for identity verification, transaction records, and disclosures required by law or by regulators.
  • Legitimate interests: to protect users and WEYSURE from fraud and abuse (including the device and network signals in section 7) and to keep the service secure. We limit this processing to what the purpose needs.
  • Consent: where we ask for it. You can withdraw consent at any time without affecting processing that already happened.

5. How We Share Information

We share data only as needed to operate the platform and comply with law, including with:

  • Paystack (payments): card and bank payments, payment verification, bank account name checks, payouts, refunds to the original card or bank account, and webhook reconciliation. Where we offer you a dedicated WEYSURE account number, your BVN is sent to Paystack once to open it; we do not store it.
  • Dojah (identity verification): your BVN, selfie and liveness check are collected and checked by Dojah, which returns the result to us.
  • Termii (text messages): your phone number and the message content, to send verification codes and notices by SMS.
  • Resend (email): your email address and the message content, to send and receive account and transaction emails.
  • Infrastructure providers: providers that host our servers and databases, protect and deliver our network traffic, and store uploaded files privately.
  • Legal/compliance recipients: where disclosure is required by law, regulation, or lawful request.

Other users see you by your first name and last initial, never your email or phone number.

We do not sell personal information.

6. Identity Verification

Identity verification is required to raise your limits and for some account operations. It is done through Dojah using your BVN, a selfie and a liveness check. We keep the masked ID, a one-way fingerprint that stops one ID being used on more than one account, the name and date of birth on the record, and the check results. A verification can be pending, under review, approved, or rejected; reviews are carried out by authorised WEYSURE staff. We retain identity records for compliance, fraud prevention, and audit purposes.

7. Device and Network Signals for Fraud Prevention

To stop stolen cards being turned into cash and to detect accounts that trade with themselves, we compare a few signals across accounts:

  • What we record: a random device identifier set in a cookie (it contains nothing about you), and one-way keyed hashes of that identifier and of your IP address. We record them when you sign in and when you create, accept or confirm a deal. We do not store your raw IP address for this purpose, and we do not use these signals for advertising or tracking across other websites.
  • What we compare: whether a buyer and seller share a device, payout bank account, phone number or network, whether accounts trade back and forth, how new a seller is, and how quickly a seller receives deals from first-time buyers.
  • What can happen: a payment you earned may be held for 24 to 72 hours before you can withdraw or spend it. A hold is temporary, is reviewed by WEYSURE staff who can release or extend it, and does not close your account. You can ask for a hold to be reviewed by contacting support.
  • How long we keep them: the hashed signals are deleted automatically after 90 days. Records of holds themselves are kept with your transaction records.

8. Cookies

We use only cookies that the service needs to work: sign-in cookies that keep you logged in securely, and the device cookie described in section 7, which lasts up to one year and cannot be read by the web page. We do not use advertising cookies. If you block or clear cookies you may have to sign in again, and fraud checks may treat your device as new.

9. Developer API and Webhook Data

  • API keys are generated per environment and stored using hashed representations.
  • Public API usage is logged with endpoint, method, status code, response time, and request metadata.
  • Webhook configuration and delivery attempts are stored for debugging, reliability, and audit trails.
  • Developer test and production environments are logically separated in reporting and API access controls.

10. Security Controls

  • Passwords are stored as hashes; SMS codes are stored scrambled and expire quickly.
  • Signed tokens are used for user/admin sessions, with expiration and auth checks.
  • Uploaded files are private and open only through links that expire.
  • Rate limits are applied to selected sensitive endpoints.
  • Security and account events can be logged for auditing and incident investigation.

No platform can guarantee absolute security, but we implement layered technical and operational controls. If a breach is likely to put your rights at risk, we will notify you and the regulator as the law requires.

11. Data Retention

We retain account, transaction, identity, compliance, and operational records for as long as needed for service delivery, legal obligations, fraud prevention, and dispute or audit handling. Hashed device and network signals are deleted after 90 days. Other retention periods vary by data type and regulatory requirements.

12. Your Rights and Requests

Under the NDPA you can ask us to:

  • give you a copy of the personal data we hold about you;
  • correct data that is wrong or incomplete (you can update some details yourself in account settings);
  • delete your data, or restrict or object to how we use it;
  • move your data to another service in a common format;
  • have a person review a decision made automatically about you, such as a payment hold, and hear your side.

Send requests to [email protected]. Some records cannot be deleted immediately where retention is required for legal, accounting, security, or fraud-prevention reasons; we will tell you when that applies. If you are not satisfied with our response, you can complain to the Nigeria Data Protection Commission.

13. Cross-Border Processing

Our servers and some of our providers are outside Nigeria, so your data may be processed in other jurisdictions. Where we transfer data outside Nigeria we rely on the safeguards the NDPA allows, such as contractual protections with our providers.

14. Policy Changes

We may update this Privacy Policy as our product, integrations, or legal obligations evolve. Updated versions will be published on this page with a revised effective date.

15. Contact

For privacy questions or requests, contact: [email protected]