TRUEPEER PRIVACY POLICY

1. Data Collection and Usage

We collect the following personal information for identity verification and service delivery:

• Full name, email address, and phone number
• Government-issued identity numbers and documents, including Bank Verification Number (BVN), National Identification Number (NIN), international passport, or driver's licence, and proof-of-address documents
• A selfie or short facial scan captured during identity verification (see Section 2.2)
• Transaction and wallet activity history
• Device and usage information
• Customer support conversations, including messages and any files or images you choose to share with our support team (see Section 4)
• Notification tokens and in-app activity signals used to deliver alerts to your device

Purpose of Collection:

• To verify user identity (KYC compliance)
• To prevent fraud and meet Anti-Money Laundering (AML) obligations
• To provide customer support and improve service experience
• To send you service, security, and transaction notifications
• To comply with legal and regulatory requirements

2. Privacy & Data Protection

We comply with the Nigeria Data Protection Regulation (NDPR) and GDPR standards. All personal data is stored securely using encryption and restricted access. We do not share your personal data with third parties without your consent, except as required by law. Users may request to access, correct, or delete their data by contacting our support team.

2.1 TrueDepth Camera Data

TruePeer may use Apple's TrueDepth camera technology only for identity verification and user authentication where supported on compatible devices. This functionality is used solely to confirm the identity of the user during Know Your Customer (KYC) verification and to enhance account security.

Any depth information or facial mapping data generated through the TrueDepth camera is processed only for the requested verification session. TruePeer does not store, retain, sell, or share TrueDepth data with third parties for advertising, profiling, or marketing purposes.

TrueDepth data is used exclusively to perform the requested authentication or identity verification and is discarded immediately after processing unless otherwise required by applicable law.

2.2 Identity Verification and Biometric Data

To complete KYC verification, TruePeer works with licensed identity-verification providers (such as Smile Identity and Dojah). During verification you may be asked to provide your BVN or NIN, capture a live selfie or short facial scan (a "liveness check"), or photograph an identity document. This information is shared with the verification provider solely to confirm your identity against official records and to detect impersonation or fraud.

Biometric verification is always performed with your knowledge — you will see and complete the capture step yourself, and consent is requested before the check begins. Verification providers process this data under their own security and privacy obligations and do not use it for advertising or marketing.

The verification outcome (approved or rejected, and the tier it unlocks) is stored on your TruePeer profile. Verification records are retained as required by AML/KYC regulations.

3. Security Practices

To protect your information and assets, TruePeer uses end-to-end encryption, multi-layer wallet and account security, and continuous monitoring to detect suspicious activities. We recommend enabling Two-Factor Authentication (2FA) and never sharing your login credentials. TruePeer staff — including our customer support team — will never ask you for your password, transaction PIN, or wallet private keys, in chat or anywhere else.

4. Customer Support Conversations

When you contact us through the in-app support chat, the conversation — your messages, our replies, and any images or documents you attach — is stored on our systems. Authorised support staff can view your conversation together with basic account context (such as your profile, verification tier, and recent transactions) so they can resolve your issue without asking you to repeat yourself. Access is restricted by role-based permissions and logged.

Files shared in support chat are limited in size and type (images and PDF documents), and are stored with our cloud storage provider. Please do not share passwords, PINs, card numbers, or other credentials in chat — we will never ask for them.

Support conversations may be reviewed for quality, training, dispute resolution, and compliance purposes.

5. Notifications and Communications

We send notifications to keep you informed about your account: transaction alerts, security alerts, verification updates, and replies from our support team. Depending on your device and settings these may arrive as mobile push notifications, browser notifications, in-app alerts, or email.

To avoid disturbing you unnecessarily, we use limited in-app activity signals (for example, whether the support chat screen is currently open) to decide when a notification is actually needed, and we limit repeated alerts for the same conversation.

You can control push and browser notifications in your device or browser settings at any time. Note that we may still deliver essential security and service notices required to protect your account. Marketing communications, where sent, always include an opt-out.

6. Data Retention

We retain personal data only as long as necessary for legal, compliance, or operational purposes. Once retention periods expire, data will be securely deleted or anonymized. In particular:

• Support chat records: the text of support conversations is retained for up to five (5) years, as evidence for dispute resolution, complaint handling, and regulatory record-keeping.
• Support attachments: files and images shared in support chat are automatically deleted from storage approximately twelve (12) months after the conversation is resolved.
• In-app history: the app displays your recent support history (approximately the last six months of resolved conversations); older records remain retained per the periods above but are not shown in the app.
• KYC and transaction records: retained for the periods required by applicable AML/CFT and CBN regulations.

7. Third-Party Service Providers

We use a small number of vetted service providers to operate the platform. They process data only on our instructions and for the purposes described in this policy:

• Identity-verification providers (e.g. Smile Identity, Dojah) — KYC and liveness checks
• Cloud infrastructure and storage (e.g. Google Firebase) — file storage and app analytics
• Notification delivery providers (e.g. OneSignal) — push notifications
• Email delivery providers — service and security emails

8. User Rights

Users have the right to:

• Access their personal data
• Request correction or deletion of data
• Withdraw consent where processing is based on consent
• Lodge complaints with the Nigeria Data Protection Commission (NDPC) if dissatisfied with our response

Deletion requests are honoured except where we are legally required to retain specific records (for example, KYC and transaction records under AML regulations).

9. Compliance and Legal Obligations

TruePeer adheres to all applicable Nigerian laws, including:

• Central Bank of Nigeria (CBN) Guidelines for Virtual Asset Service Providers
• NDPR
• AML/CFT (Anti-Money Laundering/Combating Financing of Terrorism) regulations

10. Dispute Resolution

Any privacy-related dispute will first be resolved amicably with our support team. If unresolved, it will be settled in accordance with Nigerian law.

11. Contact Information