Version 1.0-draft
Last updated: 7 September 2026. Version 1.0-draft.
This policy explains what ErasPay collects about you, why, who else sees it, and what you can tell us to do about it. It covers the ErasPay mobile app and the services behind it.
We are the data controller for the information described here. Where this policy says "we", it means ErasPay; where it says "you", it means the person whose account it is.
What you give us. Your email address or phone number and a password when you register. Your name, date of birth, address and country when you complete your profile. A transaction PIN, and any beneficiary or saved-recipient details you add.
Identity and verification data. To meet Nigerian anti-money-laundering requirements we collect government identity numbers (including BVN and NIN), images of identity documents, a selfie taken during onboarding, and proof of address. We cannot open or maintain a payments account without these; it is a legal requirement, not a product choice.
Transaction data. Every payment, transfer, bill payment, card transaction, gift-card order and currency conversion you make, including amounts, counterparties, references and the fees charged.
Device and technical data. Device model and operating system, an app install identifier, IP address, approximate location derived from that IP, and the times you sign in. We keep a record of each device your account has been used on so that you can review and revoke them.
Support data. Messages you send to support, including anything you choose to attach, and the replies you receive.
We do not collect precise GPS location, your contacts, or photos and files other than the ones you deliberately submit.
- To open, run and secure your account, and to authenticate you. - To carry out the payments and other transactions you instruct. - To verify your identity and meet our obligations under Nigerian anti-money-laundering, counter-terrorist-financing and know-your-customer law. - To detect, investigate and prevent fraud and unauthorised access, including automated checks on transactions and sign-ins. - To answer your support requests. Our support assistant may use an automated system to draft replies; you can ask for a human at any point. - To send service messages about your account, transactions and security. You cannot opt out of these while you hold an account, because they are how we tell you something has happened to your money. - To send optional product and marketing messages, which you can turn off in the app at any time without affecting your account. - To improve reliability and understand which features are used, using aggregated data that does not identify you.
We process your data because it is necessary to perform our contract with you (running your account and executing your instructions); to comply with legal obligations (identity verification, transaction reporting, record retention); for our legitimate interests in preventing fraud and securing the service; and with your consent where consent is what applies, such as optional marketing. Where we rely on consent you may withdraw it at any time.
We do not sell your personal data. We share it only as set out here.
Regulated service providers. We use third parties to deliver parts of the service, and each receives only what its part requires:
Each acts on our instructions under a written agreement. The current providers are listed in the app under Legal, alongside their own policies.
Regulators, law enforcement and courts. Where we are legally required to disclose, or where disclosure is necessary to establish, exercise or defend a legal claim.
Corporate transactions. If ErasPay is involved in a merger, acquisition or sale of assets, your data may transfer as part of it. You will be told before it becomes subject to a different policy.
Passwords and transaction PINs are hashed and are never stored in a form we or anyone else can read back. Sensitive stored values are encrypted. Access to production data is restricted to staff who need it, and every administrative action taken against an account is recorded in an audit log.
You can see and revoke your active sessions and trusted devices in the app, and turn on biometric or two-factor sign-in. No system is perfectly secure, so please tell us immediately if you think someone else has access to your account.
Under the Nigeria Data Protection Act 2023 you have the right to:
- access the personal data we hold about you, and receive a copy; - correct anything inaccurate or incomplete; - delete your data, subject to the retention rules below; - object to or restrict processing in certain circumstances; - port your data to another provider in a machine-readable format; - withdraw consent where we relied on it; - not be subject to a decision based solely on automated processing that significantly affects you - you can ask for human review.
Most of these can be exercised directly in the app under Profile then Privacy. For anything else, contact us using the details below. We respond within 30 days. You also have the right to complain to the Nigeria Data Protection Commission.
We keep your account data for as long as you hold an account. After you close it we retain identity-verification records, transaction records and related correspondence for at least seven years, because Nigerian financial regulation requires it. Closing your account therefore does not delete everything, and we cannot agree to delete records we are legally obliged to keep.
Data we are not required to retain is deleted or irreversibly anonymised once it is no longer needed. Support conversations are kept for two years. Device and sign-in history is kept for two years for fraud investigation.
ErasPay is not for anyone under 18. We do not knowingly collect data from children, and an account found to belong to one is closed. If you believe a child has given us their data, contact us and we will delete it.
Your data is primarily processed in Nigeria. Some providers process data outside it, including in the European Union and the United States. Where that happens we rely on the transfer mechanisms permitted by the Nigeria Data Protection Act 2023, and require contractual safeguards equivalent to the protection your data has here.
The mobile app does not use cookies. It stores a small amount of data on your device - your session, your theme preference and similar settings - which you can clear by signing out or uninstalling the app. Our websites use only the cookies necessary to make them work.
We will tell you in the app before a material change takes effect, and the version and date at the top of this document will change. Continuing to use ErasPay after that means you accept the updated policy. Previous versions are available on request.
For privacy questions, to exercise any right above, or to reach our Data Protection Officer, contact us through Support in the app, or by email at the address published on our website. We answer privacy requests within 30 days.
ErasPay is operated by ErasStack Ltd. · Legal · Status · support@erasstack.com