Privacy Policy

1. Introduction

Gigly ("we," "us," or "our") is a VTU (Value-Top-Up) platform operated by GIGLY NIG LTD, located at 1,Beside General Hospital, Ankpa, Kogi State, Nigeria. We are committed to protecting your personal information and your right to privacy.

This Privacy Policy explains how we collect, use, share, and protect your information when you use our mobile application, website, and related services (collectively, the "Services"). By using Gigly, you agree to the collection and use of information as described in this policy.

2. Data We Collect

We collect the following categories of information:

• Contact Information: Phone number, email address, and full name provided during registration.
• Transaction Data: Purchase history, wallet funding records, amounts, dates, network providers, the phone numbers you buy for, and the numbers you save as beneficiaries. When you pay an electricity bill, the meter number and the name and address the electricity company returns for that meter are kept with the transaction.
• Device Information: A random identifier the app creates for your device, your IP address, and the technical connection details your device sends. We use these to recognise new devices and to protect your account.
• Notification Data: If you allow notifications, a push token that lets us send them to your device.
• Financial Data: Wallet balance, cashback balance, transaction references, and the bank account number assigned to you for wallet funding. We do not collect or store card details.
• Support Conversations: Messages, attachments and your phone number when you contact our support team, including on WhatsApp.
• Identity Verification: Information needed to verify your identity and prevent fraud.

3. How We Use Your Data

• Service Delivery: To process your VTU purchases, wallet funding, and bill payments.
• Account Management: To create, maintain, and secure your Gigly account.
• Fraud Prevention: To detect, investigate, and prevent fraudulent transactions and abuse.
• Customer Support: To respond to inquiries, resolve disputes, and process refund requests.
• Service Improvements: To improve our services using our own records of purchases and support requests. We do not use third-party analytics or advertising tools.
• Communications: To send transaction confirmations, OTPs, and service notifications.
• Legal Compliance: To comply with applicable Nigerian laws and regulations.

4. Data Sharing

We do not sell your personal data. We may share your data only in the following limited circumstances:

• Payment Processors: With Paystack, to provide your wallet funding account and process wallet funding.
• VTU Providers: With our airtime and data service providers, to fulfil your purchases.
• Bill Payment Providers: With the electricity, cable TV and exam PIN providers we use, to complete your bill payments.
• Network Operators: With MTN, Airtel, Glo, and 9mobile to complete service delivery.
• Notifications: Push notifications are delivered through Expo's push service and Google Firebase Cloud Messaging, which receive your push token and the notification text.
• Messaging: Our SMS and email providers receive your phone number or email address to deliver one-time codes and account messages.
• Legal Requirements: When required by Nigerian law, court order, or government authority.
• Service Providers: With trusted third-party service providers who assist in our operations, such as hosting, bound by confidentiality agreements.

5. Data Security

We implement industry-standard security measures to protect your data:

• Encryption: All data transmitted between your device and our servers is encrypted using TLS 1.2+.
• Secure Storage: Passwords and transaction PINs are stored as one-way hashes and cannot be read by anyone, including our staff. Stored data is protected by our hosting providers' encryption.
• Access Controls: Strict role-based access controls limit who can access your data within our team.
• Transaction PINs: Transactions require a separate PIN or biometric verification.
• Audit Logs: All account and administrative actions are logged for security review.

6. Your Rights

You have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Delete your account yourself in the app under Settings → Delete Account, or email support@gigly.ng to request deletion.
• Portability: Request your data in a machine-readable format.
• Objection: Object to certain uses of your data, including marketing.

To exercise these rights, contact us at support@gigly.ng.

7. Cookies

Our website does not use analytics or advertising cookies, and does not set cookies to track you. You can still control cookies through your browser settings.

8. Children's Privacy

Gigly is only for people aged 18 and over. We do not knowingly open accounts for anyone under 18. If you believe someone under 18 has an account, contact us at support@gigly.ng and we will close it.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes through the app or email. Continued use of Gigly after changes are posted constitutes acceptance of the revised policy. The effective date at the top of this page reflects the most recent revision.

10. Data Retention

We retain your data only as long as necessary for the purposes outlined in this policy or as required by Nigerian law. The following retention periods apply:

• OTP Records: Deleted automatically after 24 hours.
• Security Log: Routine login records are deleted after 90 days. All other security records, which include IP address and device information and may include phone numbers or your wallet funding account number, are deleted after 1 year.
• Staff Actions: Records of actions our staff take on accounts (for example wallet credits or debits) are kept for 6 years.
• Transaction Records: When your account is permanently erased, your transaction records are anonymised. We keep the amount, type, status, date and provider reference, and remove everything that identifies you, including the phone numbers and meter details involved. We keep these anonymised records for 6 years after your account is erased, for legal, tax and dispute purposes, and then delete them.
• Support Conversations: Deleted 2 years after the conversation is closed. When your account is permanently erased, your support conversations are anonymised.
• Session Tokens: Expired refresh tokens are deleted 7 days after expiry. WhatsApp bot sessions are removed after 1 hour of inactivity.
• Account Data: You can delete your account at any time in the app under Settings → Delete Account. Your account is deactivated immediately and your data is permanently erased after 60 days. During that period your phone number cannot be used to open a new Gigly account.
• Outstanding Refunds: If you delete your account while holding a wallet balance, we keep your phone number and the amount owed until that refund has been paid to you. This is the only personal detail kept beyond the 60-day period.

Automated cleanup jobs run nightly to enforce these retention periods. You may request early deletion of your personal data by contacting us at support@gigly.ng.

11. Contact Us

For privacy-related questions, requests, or concerns, please contact our Privacy Officer at: