Privacy Policy

1. Who We Are

AutoPay Platform Ltd ("AutoPay", "we", "us", "our") is a financial technology company incorporated in Nigeria, operating at auto-pay.com.ng. We provide automated recurring payment scheduling services for individuals and businesses.

For questions about this policy, contact us at privacy@auto-pay.com.ng.

2. Information We Collect

Information you provide directly

• Account details: Full name, email address, and password when you create an account.
• Identity verification: BVN (Bank Verification Number) — stored as a one-way cryptographic hash. We never store your raw BVN.
• Beneficiary details: Names, bank names, and account numbers of people and businesses you schedule payments to. Account numbers are encrypted at rest.
• Payment schedule information: Payment type, amount, frequency, and dates you configure.

Information collected automatically

• Device information: Browser type, operating system, and device identifiers for security and fraud prevention.
• Usage data: Pages visited, features used, and session timestamps — used only to improve the product.
• Log data: IP addresses and request logs retained for 90 days for security monitoring.

Information from third parties

• Bank account data: Account balance and transaction information obtained via Mono or Okra (open banking) with your explicit authorisation. We access only what is necessary to verify balances before scheduled payments.
• Payment confirmations: Transaction references and status updates from Paystack after a payment executes.

3. How We Use Your Information

• To create and manage your account
• To execute your scheduled payments on your behalf on the dates you specify
• To send pre-payment reminders and low-balance alerts
• To detect and prevent fraud, unauthorised access, and abuse
• To comply with legal obligations under Nigerian law, including CBN regulations and the Nigeria Data Protection Act 2023 (NDPA)
• To improve and develop the AutoPay product based on anonymised usage patterns

We do not use your data for advertising, profiling, or sale to third parties. Ever.

4. Legal Basis for Processing

Under the Nigeria Data Protection Act 2023 (NDPA), which replaced the Nigeria Data Protection Regulation (NDPR) and became fully effective on 19 September 2025, we process your personal data on the following lawful bases:

• Contractual necessity: Processing required to provide the AutoPay service you have signed up for
• Legitimate interests: Fraud prevention, security monitoring, and product improvement
• Legal obligation: Compliance with CBN regulations and anti-money laundering requirements
• Consent: Marketing communications (where you have opted in)

5. How We Share Your Information

We share your data with the following categories of third parties, and no others:

• Paystack Co. Ltd: Our primary payment processor, licensed by the CBN. They receive your payment instructions and authorisation codes to execute debits. Subject to their own privacy policy at paystack.com/privacy.
• Mono Technologies: Open banking provider used to link your bank accounts and verify balances. Subject to their privacy policy at mono.co/privacy.
• AWS (Amazon Web Services): Our cloud infrastructure provider. All data is stored in encrypted form. AWS has no access to the content of your data.
• Legal authorities: Where required by law, court order, or regulatory obligation.

We do not sell, rent, or trade your personal data to any party for any purpose.

6. Data Security

• Encryption at rest: Bank access tokens and account numbers are encrypted using AES-256-GCM. Encryption keys are stored separately in AWS Secrets Manager.
• Encryption in transit: All data transferred between your device and our servers uses TLS 1.3.
• Access controls: Your payment data is accessible only to the systems that need it to execute your schedules. No AutoPay employee can view your bank credentials or account numbers in plain text.
• PCI-DSS: We never handle raw card data. All card interactions are handled exclusively by Paystack's certified infrastructure, making AutoPay PCI-DSS SAQ-A compliant.

7. Data Retention

We retain your personal data for as long as your account is active. After you close your account:

• Payment history and audit logs are retained for 7 years to comply with Nigerian financial regulations
• Account credentials and personal profile data are deleted within 30 days
• Bank access tokens are revoked and deleted immediately upon account closure
• Anonymised, aggregated usage data (which cannot identify you) may be retained indefinitely for product improvement

8. Your Rights Under the NDPA

Under the Nigeria Data Protection Act 2023 (NDPA), enforced by the Nigeria Data Protection Commission (NDPC), you have the following rights:

• Right of access: Request a copy of all personal data we hold about you
• Right to rectification: Request correction of inaccurate personal data
• Right to erasure: Request deletion of your personal data (subject to our legal retention obligations)
• Right to data portability: Request your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests
• Right to restrict processing: Request that we limit how we use your personal data while a dispute is resolved
• Right to withdraw consent: Withdraw consent for marketing communications at any time

To exercise any of these rights, email privacy@auto-pay.com.ng. We will respond within 30 days.

9. Cookies

We use a small number of strictly necessary cookies to keep you logged in and protect against cross-site request forgery. We do not use advertising or tracking cookies. See our Cookie Policy for full details.

10. Changes to This Policy

We may update this policy from time to time. When we make material changes, we will notify you by email (at the address on your account) at least 14 days before the changes take effect. The "Last updated" date at the top of this page always reflects the most recent version.

11. Contact Us