Billy

Your data, explained

Privacy Policy

What Billy processes, why we process it, and the choices and rights available to you.

Effective 2 September 2026Version 2026-09-02

1. Who is responsible for your data?

Billy Internet Solutions (BN 9037366) is the controller of personal data processed through Billy's website, web application, Android application, iOS application, support channels, and related operations. Contact us at support@billyapp.org.

This Policy is designed around the Nigeria Data Protection Act 2023 and other applicable privacy requirements. It applies to Billy's processing; third-party providers may also act as independent controllers for their own regulated services and will provide their own notices where required.

2. Data we collect

Account and contactName, email address, phone number, profile preferences, account identifiers, and support messages.
Identity and complianceDate of birth, identity type and number, verification result, risk signals, and evidence required for protected services. Where possible, Billy stores a provider result or reference rather than unnecessary raw identity media.
TransactionsAmounts, currencies, quotes, fees, wallet and ledger records, beneficiaries, bill references, order details, receipts, refunds, and provider references.
Service contentGift-card submission evidence, virtual-card order information, supported blockchain addresses, foreign-number order details, and social-service target links or handles.
Device and securityDevice or session identifiers, IP address, browser/app version, login events, security settings, and fraud or diagnostic logs. Biometric templates remain under your device operating system; Billy receives only the success or failure result.
Website dataEssential technical requests and security logs. See the Cookie Notice.

Do not submit another person's information unless you have authority and a lawful reason to do so. Do not place passwords, PINs, private keys, or one-time codes in support messages.

3. Why and how we use data

  • Contract: create and secure your account, execute requested services, show status and receipts, provide support, and process refunds.
  • Legal obligation: identity checks, transaction records, lawful requests, accounting, sanctions or anti-fraud controls, and regulatory compliance.
  • Legitimate interests: keep Billy secure, prevent abuse, reconcile provider outcomes, improve reliability, and understand service performance, balanced against your rights.
  • Consent: optional communications or device permissions where consent is the appropriate basis. You may withdraw consent without affecting earlier lawful processing.

We do not sell personal data. We do not use biometric templates, contacts, precise location, microphone access, or advertising identifiers unless a future feature clearly requests and justifies that access.

4. Who may receive data

We disclose only what is reasonably needed to:

  • hosting, authentication, storage, email, monitoring, and customer-support processors;
  • payment, wallet funding, identity verification, bill payment, gift-card, prepaid-card, crypto, foreign-number, and social-service providers for the service you request;
  • banks, payment networks, blockchain networks, telecommunications or platform operators involved in delivery;
  • professional advisers, auditors, insurers, or a successor in a lawful business transaction; and
  • courts, regulators, law enforcement, or other parties where disclosure is legally required or necessary to protect rights and safety.

Some providers or technical infrastructure may process data outside Nigeria. Where required, we use lawful transfer safeguards and assess the protection available in the receiving location.

5. Retention and security

We keep personal data only for as long as needed for the purposes described here. Account and routine support data is deleted or anonymized after the applicable operational period. Financial, identity, fraud, dispute, and accounting records may be retained longer where law, a regulator, or a legitimate claims period requires it. Backups expire on controlled schedules.

We use access controls, encryption in transit, server-side provider secrets, row-level database policies, monitoring, and restricted staff access. No system is perfectly secure; contact us immediately if you believe your account or data has been compromised.

6. Your choices and rights

Subject to applicable law and necessary identity verification, you may request to:

  • be informed about and access your personal data;
  • correct inaccurate or incomplete data;
  • object to or restrict certain processing;
  • withdraw consent;
  • receive portable data where applicable;
  • request deletion of your account and eligible data;
  • request human review of a significant automated decision; and
  • complain to the Nigeria Data Protection Commission.

Use Delete your Billy account for deletion requests, or email us for another privacy request. We may need to verify that the request came from the account holder. We will explain any data we must retain and why.

7. Children, changes, and contact

Billy is for adults aged 18 and over and is not directed to children. If we learn that a child's data was provided without lawful authority, we will take appropriate steps to remove it.

We may update this Policy when Billy, the law, or our providers change. Material changes will be communicated appropriately, and the effective date and version above will be updated.

Privacy contact

Email support@billyapp.org with the subject “Billy privacy request”.