Privacy Policy

01Who we are

UlakTech Digital Services ("UlakTech", "we", "us", "our") is a Nigerian digital-services company operating a virtual top-up wallet and bill payment platform. The controller of the personal data described in this policy is UlakTech Digital Services, reachable at support@ulaktech.com. Our public website is ulaktech.com.

We are regulated in Nigeria and follow the Nigeria Data Protection Act, 2023 (NDPA) and, where relevant to users outside Nigeria, principles from the General Data Protection Regulation (GDPR).

02Information we collect

The categories below cover everything we hold. Where a category is optional, we say so.

Account & contact

Name

Your first and last name. Displayed in your profile; used on receipts and support tickets.

Phone number

The phone you sign up with. Also usable as your username. For login, transaction alerts, and PIN reset.

Email address

Where we send OTPs, receipts, and account alerts. Login, verification codes, security notices.

Password & PIN

Your account password and 4-digit transaction PIN. Passwords are hashed with bcrypt before storage. We cannot read them.

Profile photo

Optional. The picture you upload for your account. Displayed only to you.

Identity verification (KYC)

BVN or NIN

Your Bank Verification Number or National Identity Number, plus the associated date of birth or phone number used to validate it. To confirm you are a real person before we raise wallet limits or enable airtime-to-cash. We query this against the official verification providers only — we do not resell it.

Wallet & transaction history

Wallet balance

Current and historical balance of your main wallet and earning (referral) wallet.

Virtual account numbers

Dedicated account numbers issued to you by our payment partners (Monnify, PaymentPoint, Payvessel, Kuda, and select bank rails). They are attached to your account so incoming transfers credit the right wallet.

Transaction records

Every purchase you make on the platform: date, amount, network / provider, phone or meter or IUC, status, and — where relevant — the plan or bundle bought. To show you a history, resolve disputes, meet accounting duties, and detect fraud.

Device & usage

App version & device

OS, device model, and app version, collected automatically on request. Debugging, delivering the right build, and detecting incompatible clients.

Push notification token

A Firebase Cloud Messaging token generated on your device. Send you transaction alerts and important account notices. You can revoke this by turning off notifications in your OS settings.

IP address & approximate location

Recorded on login and on sensitive actions. Fraud detection, blocking suspicious sign-ins, meeting audit obligations.

Biometric data

Fingerprint / Face unlock

If you opt in, we let your device unlock the app with a fingerprint or face. The biometric signature never leaves your device. We only store a local flag saying "biometric login enabled" — the biometric itself is managed by Android or iOS, not by us.

03How we use your information

Every use falls under one of the following purposes:

• Providing the service. Logging you in, showing your balance and history, processing top-ups and bill payments, sending you receipts.
• Verifying your identity. Running a one-time BVN or NIN check to raise limits and unlock airtime-to-cash.
• Security. Detecting unusual sign-ins, protecting against fraud and abuse, and complying with anti-money-laundering rules.
• Support. Responding to your questions and resolving disputed transactions.
• Communication. Sending you transaction alerts, security notices, and — only if you opt in — occasional service updates. We do not send marketing to users who have not opted in.
• Improving the service. Fixing crashes, understanding which features are used, and designing better flows. This uses aggregate data, not individual profiles.
• Legal compliance. Meeting the record-keeping, reporting, and disclosure duties set by Nigerian law and by our banking partners.

04Legal basis (NDPA / GDPR)

We rely on one of the following lawful bases for each processing activity:

• Performance of a contract — running your account and processing the top-ups and payments you request.
• Legal obligation — KYC checks, transaction record-keeping, tax and AML duties.
• Legitimate interest — fraud prevention, product improvement, and securing the platform, balanced against your interests.
• Consent — biometric login on your device, optional marketing emails, and any use of your data beyond the above. You can withdraw consent at any time.

05Who we share information with

We do not sell your data. We share it only with the parties below, only with what they need, and only for the purpose stated:

Payment processors

Monnify, PaymentPoint, Payvessel, Kuda, and other bank rails. Receive money into your wallet and, on withdrawals, send it back out. They see your name and the transaction amount.

VTU & bill-payment providers

The upstream aggregators that deliver airtime, data, cable, exam pins, and electricity units. They receive the phone number, meter number, IUC or plan you selected — never your PIN, password or BVN.

Identity verification (KYC) providers

Nigerian licensed BVN/NIN verification services. Confirm that the BVN or NIN you provided matches your name and date of birth.

Cloud & infrastructure

Namecheap hosting, Firebase Cloud Messaging, and standard operational vendors. Store data, deliver push notifications, and keep the service running. They act on our written instructions as processors.

Legal & regulatory

Law enforcement, courts, or regulators, when compelled by valid legal process. We disclose the minimum required and, where allowed, notify you.

Successors

If UlakTech is ever acquired, merged, or reorganised. Only under the same protections stated in this policy.

06How long we keep your data

We keep information only as long as we have a reason to.

• Account information — for as long as your account exists. After you delete your account, we remove your profile within 30 days, except where we have a legal duty to keep it (see below).
• Transaction records — retained for 7 years after the transaction date, to meet Nigerian tax and anti-money-laundering record-keeping duties. These records are kept in a restricted archive; only authorised staff can access them.
• KYC verification results — retained for the life of the account plus the 7-year window above.
• Security logs — retained for 12 months, then deleted or aggregated.
• Support conversations — retained for 2 years.

07Your rights

Under the Nigeria Data Protection Act (and, where you are covered, the GDPR), you can:

• Access the personal data we hold about you.
• Correct anything that is wrong or out of date, directly in the app under Settings → Profile.
• Delete your account and the personal data attached to it, subject to the retention duties in the section above.
• Export a copy of your data in a portable format.
• Restrict or object to certain uses, for example marketing.
• Withdraw consent at any time, where consent is the basis we relied on.
• Complain to the Nigeria Data Protection Commission (NDPC) if you believe we have handled your data unlawfully.

To exercise any of these rights, email privacy@ulaktech.com. We respond within 30 days.

08Security

We protect your data with technical and organisational measures that include:

• All traffic to and from our servers is served over HTTPS/TLS.
• Passwords are hashed with bcrypt; we never store passwords in the clear.
• Webhooks from payment partners are verified with HMAC signatures (SHA-256 or SHA-512, depending on the provider) before we credit any wallet.
• Sensitive fields at rest are stored on encrypted disks in the hosting environment.
• Access to the production database is limited to a small number of engineers and audited.
• Automated fraud and rate-limit checks on login and transactions.

No system is perfectly secure. If we detect a personal-data breach that puts you at risk, we will notify you and the NDPC within the deadlines set by law.

09Children

UlakTech is not directed at children under 18. You must be at least 18 (or the age of majority in your jurisdiction) to open an account. If we learn that a person under 18 has created an account, we will delete it and any associated data.

10Cookies & similar technologies

Our website uses only strictly necessary cookies: a session cookie to keep you logged in and a small preferences cookie to remember your theme. We do not use advertising cookies or third-party trackers on the website. The mobile app uses local storage on your device for the same purpose (staying logged in, remembering biometric preference, caching recent transactions).

11International transfers

Some of our infrastructure providers — for example Firebase Cloud Messaging — process data outside Nigeria. Where that happens, we rely on the transfer safeguards those providers publish (standard contractual clauses or equivalent) and only transfer the minimum data needed for the service to work (for example, your push token).

12Changes to this policy

We may update this policy from time to time — for example, when we add a new feature or a new regulator asks us to disclose something specific. When we make a material change, we bump the Version at the top of this page and send you an email or an in-app notice at least 14 days before the change takes effect. Continuing to use UlakTech after that means you accept the updated policy.

13Contact us

The best way to reach us about anything in this policy is by email. If you'd like a physical address for a formal notice, we'll provide one on request.