Privacy Policy

Qardd is operated by [Registered company name] (RC [RC number]), [Registered office address, Nigeria] (“Qardd”, “we”, “us”). We are the data controller for the personal data described in this policy.

You can contact us about privacy at privacy@qarddbank.com, including our Data Protection Officer.

• Account details: your name, phone number, email address, password (stored only as a secure hash) and profile photo.
• Identity information: your NIN or BVN, date of birth and, where requested, identity documents and a selfie, so we can verify who you are.
• Bank details: the bank accounts you add for payouts, and the account name your bank confirms.
• Financial activity: contributions, loan applications, the income and commitment details you give in an application, repayments, savings, withdrawals and payment references.
• Community activity: the communities you join, your roles, votes, messages, attachments, disputes and support tickets.
• Device and usage data: device identifiers, push-notification tokens, app version, IP address, log-in history and crash reports.

We do not collect or store your card number or PIN. Card payments are entered directly on our payment partner's secure page.

Qardd is built so that financial information is visible only to the people who need it:

• Members see your name, photo and role in communities you share.
• The details of a loan application are visible only to the people your community's policy allows to review it.
• Your vote stays hidden from other reviewers until they have cast their own.
• Your NIN, BVN, identity documents and full bank account number are never shown to other members.

We never sell your personal data. We share it only with service providers who help us run Qardd, under contracts that protect it:

• Payment providers (such as OPay) to collect payments and send payouts.
• Identity verification providers to check NIN or BVN details.
• Messaging providers to deliver SMS, email and push notifications.
• Cloud hosting and storage providers that host our servers and files.
• Error monitoring to help us find and fix crashes. We remove passwords, tokens and similar values first.
• AI services: if you use AI logo design, the community name, description and style notes you enter are sent to our AI provider to create the designs. Nothing else is shared.

We may also disclose data where the law requires it, for example to a regulator or a court, or to protect people from fraud or harm.

Some of our providers process data outside Nigeria. When they do, we rely on the transfer safeguards in Part VIII of the Nigeria Data Protection Act 2023, such as adequacy decisions or contractual protections, and we transfer only what is necessary.

We keep personal data only as long as we need it:

• Account and community data: while your account is open.
• Financial records such as payments, loans and ledger entries: for the period the law requires, even after you close your account.
• Unused AI logo designs: deleted automatically after a short period.
• Crash reports and security logs: only as long as needed to investigate and fix problems.

When you close your account, we anonymise your personal details and keep only the financial records the law requires.

Under the Nigeria Data Protection Act 2023 you have the right to:

• access the personal data we hold about you and get a copy of it;
• have inaccurate data corrected;
• have your data erased, subject to records we must keep by law;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent where we rely on it; and
• complain to the Nigeria Data Protection Commission (NDPC).

To use any of these rights, contact us from the app or email privacy@qarddbank.com. We respond within the time the law allows and track every request until it's complete.

• All traffic is encrypted in transit, and stored files are kept in private, encrypted storage, available only through short-lived links.
• Passwords are hashed, sessions can be signed out everywhere, and staff use two-factor authentication.
• Staff access follows least privilege, sensitive actions need a second approver, and all access is recorded in a tamper-evident audit log.
• We test our systems regularly and act quickly if anything goes wrong, including notifying you and the NDPC when the law requires it.

We use only what we need to keep you signed in securely: an essential, httpOnly cookie that holds your session, and a small flag in your browser's storage that remembers you're signed in. We don't use advertising or tracking cookies.

Qardd is for adults aged 18 and over. We don't knowingly collect data from children. If you believe a child has signed up, contact us and we will remove the account.

If we make important changes, we'll tell you in the app or by email before they take effect. The date at the top shows when this policy last changed.

Questions about privacy: privacy@qarddbank.com. Anything else: support@qarddbank.com. Post: [Registered company name], [Registered office address, Nigeria].