1The short version
We collect what we need to run payments and redemptions, we don't sell your data, and we never see or store your card number. You can ask to see, fix or delete your data at any time.
This policy explains how BQFlow handles personal data under the Nigeria Data Protection Act 2023 (NDPA). It sits alongside our Terms of Service.
2What we collect
- Account details: your name, email address, phone number, optional username, and your campus and role. Your password is stored only as a hash, never in plain text.
- Google sign-in: if you use it, we receive your name, email address and profile details from Google. We don't see your Google password.
- Transactions: payment references, amounts and statuses, wallet movements, credits, orders and redemptions, with timestamps and which staff member redeemed.
- Merchants: business name and details, menu and prices, and the bank account details needed to pay out withdrawals.
- Technical data: IP address, device and browser information, and session cookies, used to keep you signed in, limit abuse and fix errors.
We do not collect or store card numbers.
3How we use it
- To create and secure your account, including one-time codes sent to your email and phone.
- To process payments, issue credits and show your receipts, orders and spending history.
- To let merchants identify you at the counter and confirm collection.
- To pay merchants and process withdrawals and refunds.
- To send service messages such as codes, receipts and order updates.
- To detect fraud, resolve disputes and meet legal obligations.
Our legal bases under the NDPA are: performing our contract with you, our legitimate interests in security and fraud prevention, compliance with legal obligations, and your consent where we ask for it.
5How long we keep it
We keep account data while your account is open. Transaction and redemption records are kept for as long as needed to resolve disputes and meet financial record-keeping and legal requirements, even if you close your account. One-time codes expire within minutes and are stored hashed.
6Security
- Traffic is encrypted with HTTPS.
- Passwords are hashed; QR tokens are encrypted; payment webhooks are signature-verified.
- Sign-in, one-time-code and reset endpoints are rate limited.
- Admin actions are audit logged.
No system is perfectly secure. If a breach affects your data we will act and notify you and the regulator as the law requires.
7Your rights
Under the NDPA you can ask to access your data, correct it, delete it, restrict or object to certain uses, and receive a copy. You can withdraw consent where we rely on it. We may keep records we're legally required to keep. To make a request, email privacy@bqflow.app. If you're unhappy with our response you may complain to the Nigeria Data Protection Commission.
9Young people
BQFlow is built for university students. If you are under 18, use it only with a parent or guardian's knowledge. If you believe a child has given us data without permission, contact us and we'll look into it.
10Changes and contact
We'll update the date above when this policy changes, and tell you in the app or by email if the change is material. Questions: privacy@bqflow.app.
Also read our Terms of Service.