Version: 3.0 Effective date: 26 October 2026 Last reviewed against the live service: 26 October 2026 Applies to: droppcash.app, the DroppCash Android app, DroppCash USSD, the DroppCash API, and the DroppCash help centre
This policy replaces the DroppCash Data Privacy Notice dated 5 September 2022.
DroppCash is operated by DroppCash Technology Limited, a company registered in Nigeria with registration number RC 8569798, whose registered office is at 9 Oriwu Street, Lekki Phase 1, Lagos, Nigeria.
We are the data controller for the personal data described in this policy. For some data — for example the customer details a merchant puts on an invoice — we act on the merchant's instructions and the merchant's own privacy notice also applies. We explain where that happens.
Contact us
We handle personal data under the Nigeria Data Protection Act 2023 (NDPA) and the directives of the Nigeria Data Protection Commission (NDPC). Where you use DroppCash from outside Nigeria, the additional information in section 15 may apply.
This policy is written around what DroppCash actually does. These are the services we provide today:
| Service | What it does | Personal data it involves |
|---|---|---|
| Account and wallets | Opens your account and holds a balance for you in each currency you use, including fiat and crypto | Name, email, phone, country, address, password, wallet balances, currency |
| Transfer money | Sends money from your wallet to another DroppCash user by their email address | Recipient email, amount, currency, transaction reference, fee |
| Make payment | Pays a DroppCash merchant by their email address | Merchant email, amount, currency, payment history |
| Send invoice | Creates an itemised invoice and emails your customer a payment link | Customer name, email, address, line items and amounts, invoice status |
| Create escrow | Holds a buyer's money until the buyer releases it to the seller, with a dispute process | Buyer and seller emails, deal description, amount, release/refund decision, dispute messages and screenshots |
| Cash in / cash out | Deposits or withdraws cash through a DroppCash agent, tops up by bank or card, or withdraws to a bank account | Agent email, bank account details, card confirmation, amounts, cash records |
| Exchange currency | Converts between your own wallets at the rate shown on screen | Source and target currency, rate, amount, fee, exchange history |
| Merchant API | Lets a merchant accept payments, escrows and invoices on their own website or app | API access key, test/live mode, webhook and redirect URLs, order reference, buyer email |
| Agent network | Lets approved agents take in and pay out cash for users | Business name and address, NIN, NIN slip or ID photo, contact details, cash float and reconciliation records |
| USSD | Lets you use some services from any phone by dialling the DroppCash code | Phone number, 6-digit link code, USSD PIN, lockout state |
| Personal QR code | Lets someone scan your code to pay you instead of typing your email | Your account identifier |
| Help centre and support | Answers questions and handles tickets, complaints and live chat | Name, email, ticket content, chat transcript, attachments |
| Website, app and blog | Publishes information about DroppCash and our services | IP address, device and browser data, cookies, language preference |
If we launch a new service, we will update this policy before we collect new kinds of personal data for it.
To create a personal account we ask for your name, email address, country, phone number, address and a password. A password is stored only as a one-way hash; we never see it in plain text.
To create a merchant account we also ask for your business name, and the same contact details. To create an agent account we ask for your business name and address, your National Identification Number (NIN), a photo of your NIN slip or ID card, and your contact details.
You may add a profile photo, city and postal code.
Nigerian financial rules require us to know who our users are. Before you can use some or all services, we ask for identity information. Depending on your account type and country, this can include:
The exact fields shown to you in the app are the ones that apply to your account at that time. We may repeat checks, or ask for more information, as your activity changes.
| If you… | we collect… |
|---|---|
| Transfer money | the recipient's email address, the wallet and amount you choose, the fee, the transaction reference, and your transfer history |
| Pay a merchant | the merchant's email address, the amount, currency, fee and payment history |
| Send an invoice | your customer's name, email and address if you add it, the items and amounts, the currency, the status of the invoice, and whether you allow escrow |
| Create or receive an escrow | the other party's email address, your description of the deal, the amount and currency, who pays the fee, the release or refund decision, and every dispute message and screenshot either side submits |
| Cash in or cash out | the agent's email address, the amount, and the cash-out record |
| Withdraw to a bank | the account name and number you enter, the bank, the amount, the fee and the payout status. These payout details are stored with the withdrawal record |
| Top up by card or bank | a confirmation from the payment partner, the amount and currency, and limited card details such as the last four digits. We do not store your full card number or CVV — our payment partners handle those |
| Exchange currency | the wallets involved, the rate shown to you, the amount, the fee and the exchange history |
| Use the API | your access key (stored against your merchant account), whether the key is in test or live mode, the webhook, success and cancel URLs you configure, your order reference, the buyer's email address and the payment details |
| Use USSD | your phone number, the 6-digit link code used to connect the phone, your USSD PIN, failed PIN attempts and any temporary lock |
| Open a dispute | the messages you write, any PNG or JPG screenshot you upload (up to 5 MB), and the outcome |
| Contact support | your name, email, the content of your ticket or chat, and any attachment you send |
About other people's data. When you send money, invoice a customer, add a seller to an escrow or invite someone to DroppCash, you give us that person's email address and, for invoices, their name and address. You must have the right to share it. We use it to complete the transaction and to notify them. The person on the other side of a transfer or escrow will see your name or email, the amount and the description, because that is how the transaction works.
We automatically collect:
We do not ask for GPS location or access to your contacts.
| What we do | Why | Legal basis under the NDPA |
|---|---|---|
| Open and run your account and wallets | To provide the service you signed up for | Performance of a contract |
| Verify your identity and keep KYC records | We are legally required to know our customers | Legal obligation |
| Move money: transfers, merchant payments, invoices, escrow, cash in and out, exchange | To carry out the transaction you asked for | Performance of a contract; legal obligation |
| Keep the ledger, receipts and statements accurate | To run the service and resolve disputes | Performance of a contract; legal obligation |
| Screen for fraud, money laundering, terrorism financing, sanctions and prohibited activity | To meet AML/CFT law and protect users | Legal obligation; legitimate interests |
| Decide escrow disputes | To resolve the dispute between buyer and seller | Performance of a contract; legitimate interests |
| Keep the platform and your account secure | To prevent unauthorised access and abuse | Legitimate interests; legal obligation |
| Answer support tickets and complaints | To help you and fix problems | Performance of a contract; legitimate interests |
| Send receipts, security alerts and service notices | To run your account safely | Performance of a contract; legal obligation |
| Send marketing, where permitted | To tell you about features and offers | Consent, or legitimate interests for existing customers with an opt-out |
| Measure and improve the website and app | To understand what works | Consent where required; legitimate interests |
| Meet tax, accounting and regulatory reporting duties | The law requires it | Legal obligation |
| Establish, exercise or defend legal claims | To protect our rights and yours | Legitimate interests; legal obligation |
| Respond to a genuine emergency | To prevent serious harm | Vital interests |
Where we rely on legitimate interests, we weigh our need against your rights and expectations, and you can object at any time (section 11). Where we rely on consent, you can withdraw it at any time; withdrawing does not affect anything we already did with your consent.
We do not use your data for a new purpose that is incompatible with the ones above without telling you first.
DroppCash supports wallets in a range of fiat currencies and cryptocurrencies, including Bitcoin, Ethereum, USDT and others.
Some crypto transactions are recorded on a public blockchain. That has consequences you should know about:
This is inherent in using a public blockchain, not a choice DroppCash makes about your data.
We use cookies and similar technologies to keep you signed in, protect your account, remember your language and preferences, measure how the site is used, and — where permitted — measure our marketing.
| Type | What it does | Examples |
|---|---|---|
| Strictly necessary | Keeps you signed in, protects forms against cross-site request forgery, balances traffic | Laravel session cookie, XSRF token |
| Functional | Remembers your language (English, Spanish, French, Igbo, Yoruba, Hausa, Arabic) and display preferences | Preference cookies |
| Analytics | Shows us how people use the site so we can fix problems | Mixpanel, Google Analytics, where enabled |
| Marketing | Measures campaigns and shows relevant ads | Meta Pixel, Google advertising, where enabled |
| Support | Powers live chat and the help centre | Tawk.to, where enabled |
| Bot protection | Stops automated abuse of forms | Google reCAPTCHA, where enabled |
| Push and messaging | Delivers app notifications | Push messaging SDK, where enabled |
Non-essential cookies are only set where the law allows and, where consent is required, only after you agree through our cookie banner. You can change your choices at any time in the cookie settings or in your browser. Blocking strictly necessary cookies will stop you from signing in.
The help centre at droppcash.app/help is a separate support system and may set its own cookies. Third-party providers set cookies under their own privacy notices, which we do not control.
Our Cookie Policy at droppcash.app/terms-and-policies/2-cookie-policy gives more detail.
We share personal data only where we need to, and only for the purposes in this policy.
Payment and financial partners. To move money we work with banks, card processors, payment gateways, mobile money operators, crypto liquidity providers and payout partners. When you pay by card, your card details go to the card processor, not to us. When you withdraw to a bank, we send the payout details to the bank or payout partner.
Identity and compliance providers. We use providers to verify documents, compare selfies, and screen against sanctions, PEP and adverse media lists.
Cloud, communications and support providers. We use providers for hosting, storage, email and SMS delivery, push notifications, live chat, analytics and customer support. They may only use your data to provide those services to us.
The other side of your transaction. If you send money, pay a merchant, invoice a customer, or use escrow, the other party sees what they need to complete and understand the transaction: your name or email, the amount, the currency, the reference and your description. In an escrow dispute, each side sees the other's messages and any screenshots submitted, and our support team reviews them.
Merchants using the API. If you pay through a merchant's checkout, we send that merchant the result of the payment — including your email address, the amount, the currency and their own order reference — so they can match it to your order and deliver. The merchant's privacy notice applies to what they do with it.
Agents. If you cash in or cash out, the agent sees the details needed to complete the transaction.
Regulators and authorities. We may disclose data to the Central Bank of Nigeria, the NDPC, the EFCC, the NFIU, tax authorities, courts and law enforcement where the law requires it or where a valid legal request is made. We may also disclose data to protect our rights, our users or the public. Where we are allowed to, we will tell you; where the law prohibits it — for example in a suspicious activity report — we will not.
Professional advisers and corporate transactions. Auditors, lawyers, insurers and consultants may see data under confidentiality obligations. If we merge with, acquire or sell a business or its assets, data may transfer as part of that deal, on the terms of this policy.
With your consent. We may share data with other parties where you ask us to.
We do not sell your personal data. We do not rent it, and we do not trade it for money.
DroppCash is based in Nigeria, but some of our providers and partners are elsewhere — including the United States, the United Kingdom, the European Economic Area and other countries where they or their sub-processors operate. Some of our payment, cloud, identity and analytics providers process data outside Nigeria.
When we transfer personal data out of Nigeria, we do so in line with the NDPA. We rely on one or more of the following:
We also apply technical and organisational safeguards, such as encryption and access controls, whatever the transfer route.
If you are in the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses, the UK Addendum or the UK International Data Transfer Agreement where required.
You can ask for more detail about the safeguards we use by emailing support@droppcash.app.
We use technical and organisational measures appropriate to a service that moves money, including:
Our payment partners handle your card details; we do not store your full card number or CVV.
No system is perfectly secure. If you think your account or data has been compromised, change your password, unlink the phone if you use USSD, and contact support@droppcash.app immediately.
We keep personal data only as long as we need it for the purposes in this policy, and for as long as the law requires.
| Data | How long we keep it |
|---|---|
| Account details, KYC records and identity documents | 5 years after your account closes or your last transaction, or longer where the law requires |
| Transaction, wallet, escrow, invoice and payout records | 5 years after the transaction or account closure |
| AML, sanctions, fraud and investigation records | 5 years after the investigation closes or the account closes |
| Escrow dispute messages and screenshots | 5 years after the dispute closes |
| Support tickets, chat transcripts and complaints | 3 years after the matter is resolved |
| Login records and security logs | 12 months, unless needed for an investigation |
| Marketing preferences and consent records | Until you opt out, plus a short suppression period so we do not contact you again |
| Cookies | From your session up to 24 months, depending on the cookie |
| Backups | Up to 90 days after deletion from the live system |
When we no longer need data, we delete it or anonymise it so it cannot identify you. We may keep aggregated or de-identified data for reporting.
Some records must survive account closure: AML law, tax law and open disputes require it. Section 13 explains how to close your account.
Under the NDPA you have the right to:
How to make a request. Email support@droppcash.app with "Privacy Request" in the subject line, and tell us what you want and which email or phone number your account uses. We may ask for proof of identity — for example a code sent to your registered email — so that we do not hand your data to someone else.
We respond within 30 days. If a request is complex we may extend that, and we will tell you why.
Requests are normally free. We may refuse or charge a reasonable fee where the law allows, for example if a request is clearly unfounded or repetitive.
What we cannot delete. We cannot delete records we must keep for AML/KYC, tax, regulatory or legal-claim purposes, and we cannot delete anything already written to a public blockchain (section 5). Where we must keep data, we will explain why and restrict its use as far as we can.
If you are unhappy with our answer, you can complain to the Nigeria Data Protection Commission at ndpc.gov.ng. For a service complaint about a payment, our complaints process in the Terms and Conditions applies, and you can escalate to the Consumer Protection Department of the Central Bank of Nigeria after using it.
We use automated tools to:
These checks can block, delay, hold or require extra verification for a transaction, a withdrawal or an account. Where an automated decision significantly affects you, you can ask for human review by emailing support@droppcash.app. We will explain the outcome and, where we can without helping someone commit fraud or breaching a legal duty, the main reasons.
We do not make solely automated decisions with legal effects about you except where the decision is necessary to enter into or perform our contract with you, is authorised by law, or is based on your explicit consent.
You can close your account at any time by contacting support, once you have withdrawn or spent your balance and any open escrow or dispute has been resolved. The Terms and Conditions set out the process.
When you close your account we delete or anonymise data that we no longer need. We keep the records listed in section 10 for the periods shown there.
If you want a copy of your data before you close, ask us first — after closure we can only give you what we are still allowed to hold.
Service messages. We send receipts, payment confirmations, security alerts, escrow updates and notices about changes to our terms or this policy. These are part of running your account and you cannot opt out of them while you have an account.
Marketing. We send marketing only where we have consent or another lawful basis. You can opt out at any time by:
We keep a suppression record so we do not contact you again after you opt out. Opting out of marketing does not stop service messages.
DroppCash is a Nigerian company and this policy is governed by Nigerian law. Because we serve users in many countries, the following also applies where relevant.
If you are in the European Economic Area or the United Kingdom, you have the rights in section 11, including the right to object and the right to data portability. Our legal bases are set out in section 4.
We transfer data outside the EEA and UK using the safeguards in section 8. You can complain to your local supervisory authority — in the UK, the Information Commissioner's Office at ico.org.uk — as well as to us.
If we are required to appoint an EU or UK representative, their details will be published here and in our contact section.
If you are a California resident, the California Consumer Privacy Act as amended by the CPRA gives you additional rights.
The categories of personal information we collect are described in section 3: identifiers and contact details, customer records, commercial information (transactions, invoices, wallets), internet and network activity, approximate geolocation derived from IP, sensitive personal information (identity documents, ID numbers, financial account details, precise geolocation only if you grant it), and inferences drawn from these.
We collect them from the sources in section 3.5, for the purposes in section 4, and share them with the recipients in section 7.
You have the right to know what we collect, use, disclose or share; to delete it, subject to legal exceptions such as AML and record-keeping; to correct it; to opt out of sale or sharing for cross-context behavioural advertising; to limit the use of sensitive personal information to permitted purposes; and not to be discriminated against for exercising your rights.
We do not sell personal information for money. Where advertising cookies are enabled, we treat that as "sharing" under California law, and you can opt out through the cookie settings or by emailing support@droppcash.app with "California Privacy Request" in the subject line.
You may use an authorised agent to make a request with your written permission. We will verify your identity before acting.
Local data protection law may give you additional rights or impose additional duties on us. We will honour those rights where they apply. If you are unsure which law protects you, email support@droppcash.app and we will explain.
DroppCash is for adults. You must be at least 18 years old to open an account. We do not knowingly collect personal data from anyone under 18. If we learn that an account belongs to someone under 18, we may freeze it and return the balance to the verified owner of the funds, and we will delete the data we are not required to keep. If you believe a child has given us personal data, email support@droppcash.app.
We may update this policy when our services, our technology or the law changes. We will publish the new version on this page and update the "Last reviewed" date.
Where a change is material, we will tell you by email, in the app, or by SMS before it takes effect. If you keep using DroppCash after the effective date, the updated policy applies. If you do not agree, you may close your account, subject to the records we must keep.