Privacy Policy

Welcome to Sufykhaan Digital Hub. Your privacy is critically important to us. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and website (collectively, the "Service").

App Name: Sufykhaan Digital Hub

1. Information We Collect

We may collect and process the following types of information:

1.1 Personal Information

• Full name — used to personalise your account and receipts
• Email address — for account verification, receipts, and important notifications
• Phone number — required for account creation and as the default destination for airtime purchases
• Password — stored in encrypted form (hashed using bcrypt) and never visible to anyone, including our staff
• Transaction PIN — stored encrypted and used to authorise payments

1.2 Transaction Data

• Meter numbers, IUC/smartcard numbers, and phone numbers you enter to complete purchases
• Transaction amounts, dates, references, and statuses
• Wallet funding and withdrawal records
• Receipts and token codes delivered for electricity payments

1.3 Device & Usage Information

• Device model, operating system version, and unique device identifiers
• IP address and approximate location (derived from IP)
• Pages visited, features used, and time spent within the app
• Crash logs and performance diagnostics

2. How We Use Your Information

We use the information we collect for the following purposes:

• To provide our services: process airtime top‑ups, data purchases, electricity bill payments, cable TV subscriptions, exam PINs, and wallet transactions.
• To communicate with you: send transaction receipts, delivery confirmations, service updates, and respond to your enquiries.
• To verify your identity: prevent fraudulent transactions and protect your account from unauthorised access.
• To improve our platform: analyse usage patterns, fix bugs, and develop new features based on aggregated, anonymised data.
• To comply with legal obligations: respond to lawful requests from regulatory bodies, enforce our Terms of Service, and protect our rights.

3. Third‑Party Services

We share only the minimum necessary data with trusted third‑party providers to deliver our services. These include:

3.1 VTU/Service Providers

To complete your airtime, data, electricity, and cable TV purchases, we transmit required details (e.g., meter number, IUC number, phone number, amount) to our upstream VTU partners (such as Maskawasub, SmartSpedTelecom, and others). These providers receive only the information necessary to fulfil your specific transaction and are bound by their own privacy policies.

3.2 Payment Processors

Wallet top‑ups are processed through PCI‑DSS compliant payment gateways (e.g., Paystack, Flutterwave, Monnify). Your card or bank details are handled directly by these processors and never touch our servers.

3.3 Analytics

We may use Firebase Analytics and similar tools to understand how users interact with our app. These services collect anonymous usage statistics and device information. No personally identifiable information is shared for analytics purposes.

3.4 Push Notifications

We use Firebase Cloud Messaging to send transaction alerts and service notifications. Your device token is shared with Firebase solely for message delivery.

We do not sell, rent, or trade your personal information to any third party for marketing purposes.

4. Data Security

We take the security of your data seriously and implement appropriate technical and organisational measures, including:

• Encryption: all data in transit is protected with HTTPS/TLS. Sensitive data at rest is encrypted using AES‑256.
• Password hashing: passwords are hashed using bcrypt with a unique salt — we never store plain‑text passwords.
• Access control: strict role‑based access ensures that only authorised personnel can view sensitive data, and only when necessary.
• Regular audits: we periodically review our security practices and update our systems to address emerging threats.

However, no method of electronic storage or transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

5. Data Retention

We retain your personal information for as long as your account remains active or as needed to provide you with our services. Transaction records are retained for a minimum of 5 years to comply with Nigerian financial regulations. If you request account deletion, we will remove or anonymise your personal data within 30 days, except where retention is required by law.

6. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Correction: ask us to correct any inaccurate or incomplete information.
• Deletion: request that we delete your account and associated personal data (subject to legal retention requirements).
• Restriction: ask us to restrict the processing of your data in certain circumstances.
• Portability: receive your data in a structured, machine‑readable format.
• Objection: object to processing based on legitimate interests or direct marketing.

To exercise any of these rights, please contact us at noreply@sufykhaandigitalhub.com.ng. We will respond within 30 days and may ask you to verify your identity before processing your request.

7. Children's Privacy

Our Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal data, we will take steps to delete such information immediately.

8. Cookies

We use session cookies to maintain your login state while using the web platform. These cookies are strictly necessary for the Service to function and expire when you close your browser. We do not use third‑party tracking cookies, advertising cookies, or any cookies that collect information for marketing purposes.

9. International Data Transfers

Your data is stored on servers located in Nigeria and, for certain third‑party services (e.g., Firebase), may be transferred to and processed in other countries. When we transfer data internationally, we ensure appropriate safeguards are in place to protect your privacy rights.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service features. We will notify you of significant changes by:

• Posting the updated policy on this page
• Displaying an in‑app notice when you next open the app
• Sending an email to the address associated with your account (for material changes)

The date at the top of this page indicates when the policy was last revised. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We take every privacy concern seriously and will do our best to resolve any issues promptly and fairly.