Privacy Policy

1. Who is responsible for your data

Moneque is a service of Swapova Ltd, a company registered in Nigeria with the Corporate Affairs Commission under RC 7098405, at 20 Harrison Sholaja Street, Oshodi-Isolo, Lagos, Nigeria. Swapova Ltd is the data controller for everything described in this policy, which means it decides what is collected and why, and it is who you hold to account for it.

For anything about your data, including a request to see it or delete it, write to support@moneque.app. A person reads that address.

2. What we collect

Only what the service needs to work, which is:

• Account details: your name, email address and phone number. Your email is how you sign in, and your password never reaches our own servers.
• Your Bank Verification Number, which section 5 deals with on its own because it deserves it.
• Identity documents: at our second verification tier, which is what a dollar card requires, a photo of a government-issued document and a selfie. These are collected and checked by our verification partner, Didit, and we receive the outcome and the name printed on the document.
• Money movements: what came in, what went out, to whom, and when. This is your record as much as ours.
• People and numbers you save: the Moneque users, bank accounts, meter numbers and phone numbers you pay, and the names the banks and billers return for them.
• Device details: a notification token so we can tell you when money arrives, and basic device and app information used for fraud checks and crash reports.

3. What we do with it

• Hold your balance, move it when you ask, and show you every entry.
• Verify who you are, which the law requires of us before you can hold or move money.
• Confirm who you are about to pay, by asking their bank or their biller for the name on the account.
• Detect and prevent fraud, and meet the reporting obligations Nigerian law places on us.
• Notify you when money arrives or leaves. These are the only messages we send, and you can switch them off in the app.
• Fix things that break, using crash reports that do not contain your transaction history.

4. Who else sees it

Moneque is the application. The parts of this that require a licence are carried out by licensed partners, and each of them receives only what its own part requires.

• Squad, which is HabariPay Limited, a Guaranty Trust Holding Company subsidiary, issues the naira account you fund and pays out to Nigerian banks. It receives your name and account identifier, and for a payout the destination account number, the bank and the amount.
• Swervpay verifies your BVN against the Nigerian registry and issues USD virtual cards. It receives the BVN and the customer record a card needs.
• VTpass delivers airtime, data, electricity and television payments. It receives the number being paid, which is a meter, a decoder or a phone, and the amount.
• Quidax would provide crypto liquidity and custody once that feature exists. It would receive your verified legal name, an address on a domain we control derived from our own customer number, and the transactions themselves. It would receive no BVN, no identity document, no phone number and no home address.
• Didit verifies identity documents. It receives your document and selfie; we receive the result.
• Google Firebase handles sign-in, notifications and crash reporting.
• Cloudflare carries all traffic to our systems, and Neon holds the database our ledger and records live in.
• Google Maps can show our office on the contact page. It does not load until you press to show it, so Google receives nothing unless you ask for the map; when you do, it receives your IP address, the page you are on and the browser details any website can see.
• We do not sell your data, and we do not share it for anyone else's advertising.

5. Your BVN

A Bank Verification Number is the most sensitive thing we ask for, so it gets its own section rather than a line in a list.

We ask for it because our banking partner revalidates it against the registry every time it issues an account in your name, and will not issue one without it. It is sent to our verification partner to be checked, and it is held encrypted.

It is never displayed back to you beyond the last four digits, never written to a log, and never returned by any interface we expose. It is not sent to our crypto partner. It is not used for anything except opening and maintaining your account.

6. How long we keep it

Records of money moving are kept for the period Nigerian law requires of a business that handles it, which is longer than your account lasts. They are your receipts as well as our records, and they are the entries your balance was the sum of.

Everything kept only for convenience, meaning saved people, saved numbers and notification tokens, is removed when you close your account. You can close it from the app, under Profile.

7. Keeping it safe

Traffic between the app and our systems is encrypted. Your password never reaches our servers, because sign-in is handled by Firebase. Your PIN is stored as a hash and nobody at Moneque can read it back, which is why we will never ask you for it. Screens showing money or identity are marked so they do not appear in the phone's app switcher or in screenshots on Android.

Your balance is derived from a double-entry ledger rather than stored as a number that can be edited. Entries are append-only, every movement carries a key that prevents it being applied twice, and a correction is a new opposing entry rather than a change to an old one. This is as much a protection for you as an accounting choice: it means there is no way for your history to quietly disagree with your balance.

8. Your rights

Under the Nigeria Data Protection Act you can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete what we are not required to keep, and object to how we are using it. Message us and we will answer.

Correcting a verified name goes through the same document check as the original, because otherwise it would be a way around verification.

9. Cookies and this website

We run no analytics and no advertising tags on this website. Nothing here records which pages you read or follows you to another site, and we set no cookies of our own. The app does not use cookies at all.

One thing on this site belongs to another company, and it does not load unless you ask for it. The map on the contact page is Google's, and until you press to show it the page holds a photograph of the street the office is on and talks to nobody. Press it and Google receives your IP address and can set the cookies it sets for anyone using its maps.

So the whole site loads without a single third party in it, and the one that exists is opt in. Your browser's own cookie and script controls will block it as well, and we do not ask you to turn anything back on.

There was a live chat widget here, from tawk.to, and this policy described it. It has been removed from the site and the description has gone with it. If we add anything else that loads from another company, it will be named in this section and in the list in section 4.

10. Changes

If we change this policy we will post the new version here with a new date. If a change materially affects what we do with your data, we will tell you in the app before it takes effect rather than leaving you to notice.