Privacy Policy

Zaplynk AI Technologies (“Zaplynk”, “we”, “our”, or “us”) is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains what information we collect about you, how we use it, who we share it with, and what rights you have over it when you use the Zaplynk platform and related services (the “Services”).

This policy is written in compliance with the Nigeria Data Protection Act 2023 (NDPA) and the regulations issued by the Nigeria Data Protection Commission (NDPC). By using our Services, you acknowledge that you have read and understood this Privacy Policy.

2.1 Information You Provide

• Identity data: first name, last name, date of birth
• Contact data: email address, Nigerian phone number
• Authentication data: hashed password, transaction PIN (stored encrypted, never as plain text)
• KYC data: BVN, government-issued ID type and number, facial scan, proof of address
• Financial data: wallet funding history, transaction records, beneficiary details you save
• Communication data: messages sent via our AI chat assistant or support channels
• Referral data: referral code you provided or the code you share with others

2.2 Information We Collect Automatically

• Device data: device type, operating system version, unique device identifiers
• Usage data: features accessed, session duration, pages or screens viewed, tap and click events
• Network data: IP address, approximate location derived from IP, network operator
• Log data: server access logs, error reports, crash diagnostics
• Cookie and tracking data: session cookies, persistent identifiers for security and analytics purposes

2.3 Information From Third Parties

• BVN verification data received from licensed BVN verification providers
• Identity verification results from licensed KYC infrastructure providers
• Payment confirmation and virtual account data from our licensed payment processing partner
• Fraud signals and risk scores from fraud detection services we use

We use the information we collect for the following purposes:

• To create, verify, and manage your Zaplynk account and digital wallet
• To process your transactions and deliver the services you purchase (airtime, data, cable TV, electricity, exam PINs)
• To send transaction receipts, OTP codes, and service notifications via email and SMS
• To perform KYC verification and meet regulatory obligations under Nigerian law
• To detect, investigate, and prevent fraud, money laundering, and security incidents
• To personalise AI assistant responses and improve transaction speed and accuracy
• To analyse platform usage and improve our Services, features, and user experience
• To respond to your support requests, complaints, and enquiries
• To comply with legal obligations including CBN guidelines, EFCC requirements, and court orders
• To send you optional product updates and promotions (only with your prior consent)

Under the NDPA 2023, we process your personal data on the following legal grounds:

• Contract performance: processing necessary to provide the Services you have requested and to fulfil our agreement with you
• Legal obligation: processing required to comply with applicable Nigerian financial, tax, anti-money laundering, and counter-terrorism financing laws
• Legitimate interests: fraud detection, security monitoring, product improvement, and abuse prevention — provided these interests do not override your fundamental rights
• Consent: marketing communications and optional product updates, which you may withdraw at any time

We do not sell your personal data. We may share it only in the following limited circumstances:

5.1 Service Providers

We engage carefully selected third-party service providers to help us operate the platform. These include payment processors, KYC verification providers, SMS and email delivery services, cloud infrastructure providers, and fraud detection services. All providers are contractually bound to handle your data securely and to use it solely for the purposes we specify.

5.2 Legal and Regulatory Authorities

We may disclose your data to the Central Bank of Nigeria (CBN), the Nigeria Data Protection Commission (NDPC), the Economic and Financial Crimes Commission (EFCC), or any other competent regulatory authority when required to do so by law, court order, or lawful regulatory request.

5.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of our business, your personal data may be transferred as part of that transaction. We will notify you of any such change and of any new privacy terms that may apply before the transfer takes effect.

5.4 Emergency Situations

We may disclose your data where we reasonably believe disclosure is necessary to prevent imminent harm to your life, safety, or property, or to the life, safety, or property of another person.

We implement industry-standard technical and organisational security measures to protect your personal data, including:

• AES-256 encryption at rest for all sensitive data including BVN, KYC documents, and transaction history
• TLS 1.3 encryption in transit for all data exchanged between your device and our servers
• Bcrypt hashing for passwords; no passwords are ever stored in recoverable form
• 4-digit transaction PINs encrypted using one-way hashing algorithms
• Multi-factor authentication (OTP via SMS and email) for account access and high-value actions
• Continuous server-side monitoring for anomalous access, unusual transaction patterns, and potential breaches
• Strict internal access controls: only personnel with a legitimate operational need may access user data
• Regular security audits and penetration testing by qualified independent security assessors

Despite our best efforts, no security system is entirely impenetrable. If you suspect your account has been compromised, please contact us immediately at security@contact.zaplynk.app.

We retain your personal data for the periods set out below:

• Active account data: retained for the lifetime of your account plus 5 years after closure, as required by Nigerian financial regulations
• Transaction records: retained for a minimum of 7 years in compliance with CBN record-keeping guidelines
• KYC documents: retained for the duration of your account relationship plus 5 years after closure
• AI chat logs: retained for 90 days, after which they are anonymised or permanently deleted
• Support correspondence: retained for 3 years from the date of resolution
• Marketing consent records: retained for 5 years from the date of consent or withdrawal

Where data is no longer required for the purposes for which it was collected, and no legal obligation requires its continued retention, we securely delete or anonymise it.

Under the Nigeria Data Protection Act 2023, you have the following rights in relation to your personal data:

• Right of access: request a copy of the personal data we hold about you
• Right to rectification: request correction of inaccurate or incomplete personal data
• Right to erasure: request deletion of your personal data where we have no lawful basis for continuing to process it
• Right to restriction: request that we restrict the processing of your data in certain circumstances
• Right to data portability: receive your data in a structured, commonly used, machine-readable format
• Right to object: object to processing based on legitimate interests, including automated profiling
• Right to withdraw consent: withdraw consent to marketing at any time without affecting the lawfulness of prior processing
• Right to lodge a complaint: file a complaint with the Nigeria Data Protection Commission (NDPC) at ndpb.gov.ng

To exercise any of these rights, contact our Data Protection Officer at dpo@contact.zaplynk.app. We will respond within 30 days of receiving your verified request.

Zaplynk uses artificial intelligence and automated processing to interpret natural language commands, execute transactions, detect fraud, personalise your experience, and improve service accuracy. These systems process the text, voice input, and transaction patterns associated with your account.

9.1 AI Chat Assistant

Your chat and voice messages are processed by an AI language model to identify your intent and execute your transaction requests. Chat messages are retained for 90 days and may be reviewed by our team to improve accuracy and quality, with identifying information removed before review where technically feasible.

9.2 Fraud Detection

Automated systems continuously monitor transactions for patterns associated with fraud, money laundering, and account compromise. These systems may automatically restrict or flag transactions pending manual review by our team. You may contact support if you believe a transaction was incorrectly restricted.

9.3 Your Rights Regarding Automation

Where a significant decision affecting you is made solely by automated means (without meaningful human review), you have the right to request human review of that decision. Contact us at support@contact.zaplynk.app to request a manual review of any automated decision.

We use cookies and similar tracking technologies on our web platform to maintain your session, remember your preferences, and analyse usage patterns. The types of cookies we use are:

• Strictly necessary cookies: required for authentication, session management, and security — these cannot be disabled
• Analytics cookies: help us understand how users interact with the platform so we can improve it — you may opt out via your browser settings
• Preference cookies: remember your language and display settings — optional but improve your experience

We do not use advertising or cross-site tracking cookies. You can manage or delete cookies through your browser or device settings at any time, though disabling strictly necessary cookies may prevent you from logging in or using the platform.

Our Services integrate with third-party platforms to deliver certain features. When you interact with these integrations (such as payment processing or identity verification), those providers’ own privacy policies also apply to the data they receive. We encourage you to review the privacy policies of any third-party services you interact with through Zaplynk.

We are not responsible for the privacy practices of third-party services operating independently of our platform. We select our service providers carefully and require contractual data protection commitments from all of them.

Our Services are intended for users who are 18 years of age or older. We do not knowingly collect, process, or store personal data from anyone under the age of 18. If you are a parent or guardian and believe that your child has provided us with personal data without your consent, please contact us immediately at support@contact.zaplynk.app. We will take prompt steps to delete any such data from our systems.

Your personal data is primarily stored and processed within the Federal Republic of Nigeria. In limited circumstances, some data may be processed by our service providers in other jurisdictions — for example, for cloud infrastructure services or AI processing.

Where data is transferred outside Nigeria, we ensure that appropriate safeguards are in place as required by the NDPA 2023, including contractual clauses that require the recipient to protect your data to the same standard as applicable Nigerian data protection law. We will not transfer your data to a jurisdiction that does not provide an adequate level of protection without your consent or an appropriate legal mechanism.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will notify you by email to your registered address and by a prominent notice on the platform at least 14 days before the changes take effect.

The effective date at the top of this document will always reflect when the policy was last updated. We encourage you to review this policy periodically. Your continued use of our Services after the effective date of any changes constitutes your acceptance of the updated policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or how we handle your personal data, please contact us using the details below:

• Data Protection Officer: dpo@contact.zaplynk.app
• General support: support@contact.zaplynk.app
• Security incidents: security@contact.zaplynk.app
• Legal enquiries: legal@contact.zaplynk.app
• Platform: zaplynk.app

We aim to respond to all data subject requests within 30 days. If your request is complex, we may extend this period by a further 30 days and will notify you of the extension and the reason for it.

You also have the right to lodge a complaint directly with the Nigeria Data Protection Commission (NDPC) if you are not satisfied with our response. The NDPC can be reached at ndpb.gov.ng.