Legal

Privacy Policy

Zero-Knowledge Proof Architecture

Effective Date: 12 March, 2026  |  Last Updated: 25 March, 2026

This Privacy Policy explains how RoviPay, operated by Aldenfort Ltd ("RoviPay", "we", "us", or "our"), collects, uses, stores, and protects your personal information when you use our web application at rovipay.ng or our mobile application (collectively, "the Platform").

By creating an account or using any part of the RoviPay Platform, you confirm that you have read and understood this Privacy Policy and agree to the collection and use of your information as described here.

This Policy is governed primarily by the Nigeria Data Protection Act (NDPA) 2023 and the Nigeria Data Protection Regulation (NDPR) 2019. Where applicable, we also comply with the UK GDPR and EU GDPR for users accessing our Platform from the United Kingdom, Germany, and other European jurisdictions.

Who We Are

RoviPay is a Nigerian fintech platform offering USD virtual card services and bill payment services (airtime, mobile data, electricity, cable TV subscriptions, and betting wallet funding) to Nigerian users and Nigerian diaspora users abroad.

Company Name

Aldenfort Ltd

RC Number

RC 8976948

Registered Address

Abuja, Nigeria

Platform

rovipay.ng (web) and RoviPay mobile app (iOS and Android)

Data Controller

Aldenfort Ltd

Contact Email

privacy@rovipay.ng

Data Collection

2.1 Information you provide directly

  • check_circleFull name
  • check_circlePhone number
  • check_circleEmail address
  • check_circleBank Verification Number (BVN) — submitted for identity verification purposes only
  • check_circleNational Identification Number (NIN) — submitted for identity verification purposes only
  • check_circleProfile photograph (if provided)
  • check_circleTransaction PIN

2.2 Information collected automatically

  • check_circleDevice information (device type, operating system, unique device identifiers)
  • check_circleIP address and approximate location derived from IP
  • check_circleApp usage data (pages visited, features used, session duration)
  • check_circleTransaction data (amounts, timestamps, service type, transaction status)
  • check_circleLog data (error reports, crash data, API call logs)

2.3 Information from third-party services

  • check_circleIdentity verification results from YouVerify (pass/fail status and reference ID)
  • check_circlePayment confirmation data from Flutterwave (transaction reference, amount, status)
  • check_circleCard transaction data from Maplerad (transaction reference, merchant name, amount, status)
  • check_circleBill payment confirmation data from VTU.ng (transaction reference, service type, status)

How We Use Your Information

Purpose Legal Basis
To verify your identity before granting platform access (KYC) Legal obligation (CBN KYC requirements, NDPA)
To create and manage your RoviPay wallet and account Performance of contract
To process wallet funding, card transactions, and bill payments Performance of contract
To issue and manage your USD virtual card via Maplerad Performance of contract
To send transaction notifications and account alerts via SMS and push notification Performance of contract
To prevent fraud, money laundering, and unauthorized account access Legal obligation (AML/CFT regulations)
To respond to your support requests and resolve disputes Legitimate interest
To improve the Platform through usage analytics Legitimate interest
To comply with legal obligations, court orders, or regulatory requests Legal obligation
To send product updates and offers (only with your consent) Consent — you may opt out at any time

Third-Party Sharing

We do not sell your personal data. We do not share your information with advertisers or marketing third parties. We share your information only in the following limited circumstances:

4.1 Service providers

  • YouVerify — for BVN/NIN identity verification during onboarding.
  • Maplerad — for USD virtual card issuance and management.
  • Flutterwave — for processing wallet funding via bank transfer and card payments.
  • VTU.ng — for processing bill payments (airtime, data, electricity, cable TV, betting wallet funding).
  • Termii or Africa's Talking — for delivering OTP and transaction SMS notifications.

4.2 Regulatory and legal disclosures

We may disclose your information to regulatory authorities, law enforcement agencies, or courts where we are legally required to do so — including in response to requests from the Central Bank of Nigeria (CBN), the Nigerian Financial Intelligence Unit (NFIU), or equivalent authorities in other jurisdictions.

4.3 Business transfers

In the event of a merger, acquisition, or sale of all or part of Aldenfort Ltd's business, your personal data may be transferred to the acquiring entity. We will notify you via email or prominent in-app notice before your data is transferred.

Data Retention

We retain your personal data for as long as your account is active and for a minimum of 5 years after account closure, in compliance with Nigerian AML/CFT regulations and CBN guidelines for financial record-keeping.

Transaction records are retained for a minimum of 5 years from the date of each transaction.

Identity verification records are retained for a minimum of 5 years after the last transaction on your account.

If you request account deletion, we will delete or anonymize all data that we are not legally required to retain, and we will inform you of what data must be retained and for how long.

Security Protocols

lock

HTTPS/TLS encryption for data in transit

shield

Hashed storage of transaction PINs

admin_panel_settings

Need-to-know access controls

verified_user

Webhook signature verification

No system is 100% secure. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of the breach, as required by the NDPA 2023.

Your Rights

gavel

Right to access

You can request a copy of the personal data we hold about you.

gavel

Right to rectification

You can ask us to correct inaccurate or incomplete data.

gavel

Right to erasure

You can request deletion of your data, subject to our legal retention obligations.

gavel

Right to restrict processing

You can ask us to limit how we use your data in certain circumstances.

gavel

Right to data portability

You can request your data in a structured, machine-readable format.

gavel

Right to object

You can object to processing based on legitimate interests, including direct marketing.

gavel

Right to withdraw consent

Where processing is based on consent, you can withdraw it at any time.

To exercise any of these rights, contact us at privacy@rovipay.ng. We will respond within 30 days.

Cookies & Tracking

Our web application (rovipay.ng) uses cookies and similar tracking technologies to maintain your session, remember your preferences, and analyze how users navigate and use the Platform.

You can control cookie settings through your browser. Disabling certain cookies may affect the functionality of the Platform. Our mobile app does not use browser cookies but may use equivalent device-based identifiers for session management and analytics.

Children's Privacy

RoviPay is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from minors. If we become aware that a user is under 18, we will immediately suspend their account and delete their data. Contact privacy@rovipay.ng if you believe a minor has created an account.

International Data Transfers

Your personal data is primarily stored and processed in Nigeria. Some of our third-party service providers (including Maplerad and Flutterwave) may process data outside Nigeria. Where data is transferred internationally, we ensure that appropriate safeguards are in place.

For users in the UK and EU: transfers of your data outside the UK/EEA are conducted under appropriate transfer mechanisms in compliance with UK GDPR and EU GDPR requirements.

Policy Changes

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or phone and display a prominent notice within the Platform for at least 14 days before the changes take effect. Your continued use of the Platform after the effective date constitutes your acceptance of the changes.

Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact our Data Protection Officer:

Data Protection Officer

Lanre Adebayo

Company

Aldenfort Ltd

Address

House 8, Gwazo Close, Area 11, Abuja, Nigeria

Phone

+234 812 456 6929