Legal
Privacy policy
What we collect, why we need it and how we protect it. Written to be read, not skimmed past.
Who we are
Kupadi is a product of Kudiflux Technologies ("Kudiflux", "we", "us"), a company registered in Nigeria. This policy explains what personal data we collect when you use the Kupadi app and this website, why we collect it, and the choices you have. We process personal data in line with the Nigeria Data Protection Act 2023 and the rules of the Nigeria Data Protection Commission.
What we collect
- Account details: your full name, email address, phone number, Kupadi tag and password (stored only as a secure hash).
- Identity verification: your BVN or NIN, date of birth, a selfie, a government ID document, your address and proof of address.
- Financial data: the deposit addresses we issue to you, your balances and transaction history, the bank account number, bank name and verified account name you withdraw to, and the crypto addresses you send to.
- Device and security data: device identifiers, IP address, app version, sign in history and whether you have set a PIN or turned on two factor authentication. We never store your PIN in a readable form.
- Support conversations: what you tell us when you contact support.
How we use your data
- To open and run your account and show you accurate balances.
- To verify your identity and meet our anti money laundering obligations.
- To process deposits, swaps, conversions, transfers and withdrawals.
- To protect your account, detect fraud and verify new devices.
- To send security alerts, transaction notices and replies to your requests.
- To improve the app, using aggregated data wherever we can.
- To comply with the law and respond to lawful requests.
Our legal bases
We only process your personal data when the law allows it. In practice that means:
- Contract: we need the data to provide the service you signed up for.
- Legal obligation: anti money laundering, tax and financial regulations require us to verify customers and keep records.
- Legitimate interests: keeping Kupadi secure and preventing fraud, balanced against your rights.
- Consent: for optional messages such as product news. You can withdraw consent at any time.
How long we keep it
We keep your account and transaction records while your account is open and for at least five years after it closes, because anti money laundering law requires it. After that we delete or anonymise your data unless a legal claim or investigation needs it.
How we protect it
Data is encrypted in transit and at rest, and only staff who need it can see it. Your account is protected by your transaction PIN on every withdrawal, optional two factor authentication and email verification of new devices.
Kupadi will never ask for your PIN, password or one time codes. If anyone does, it is not us.
Your rights
Under the Nigeria Data Protection Act you can ask us to:
- give you a copy of your personal data;
- correct data that is wrong or incomplete;
- delete your data, where we are not required to keep it;
- restrict or object to how we use it;
- send your data to you or another provider in a portable format;
- stop using data you gave us by consent.
Email privacy@kupadi.com and we will reply within 30 days. You can also complain to the Nigeria Data Protection Commission.
Children
Kupadi is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has opened an account, contact us and we will close it.
Changes to this policy
We will update this page when our practices change and tell you in the app or by email before any important change takes effect.
Contact us
Questions about your data go to privacy@kupadi.com. For anything else, visit Support.