KudiX

Privacy Policy

Last updated: August 18, 2026

KudiX ("KudiX", "we", "us", or "our") operates a Nigerian mobile-first wallet that lets users hold Naira (NGN) and stablecoin balances (USDT and USDC), convert between them, deposit and withdraw funds, and pay for utilities such as airtime, data, TV, and electricity. This Privacy Policy explains what personal data we collect when you use our website, mobile web app, and installable PWA (together, the "Service"), why we collect it, how we use it, who we share it with, and the rights you have over it.

By creating a KudiX account or using the Service, you agree to the processing of your information as described here.

1. Information we collect

We collect the following categories of information:

  • Account data: name, email address, password hash, phone number, referral code, and preferences.
  • Identity / KYC data: government-issued ID, BVN/NIN identifiers, date of birth, address, and selfie / liveness checks. KYC is performed through our regulated custody and payments partner (DAYA); we receive verification status and a limited profile, not raw document scans.
  • Financial and transaction data: wallet balances, deposit and withdrawal history, on-chain addresses and transaction hashes (Solana and other supported chains), bank details you provide for payouts, conversion history, fee and rate metadata, and utility-bill purchases.
  • Device and usage data: device identifier, IP address, browser and OS, pages viewed, timestamps, and interactions used for security, fraud prevention, and analytics.
  • Security data: transaction PIN (stored hashed and bound to your device), TOTP / two-factor secrets, login events, and audit logs of sensitive actions.
  • Support data: messages, attachments, and metadata you send us through the in-app support channel.

2. How we use your data

  • Create and operate your KudiX wallet and stablecoin accounts.
  • Execute deposits, withdrawals, NGN ↔ USDT/USDC conversions, and bill payments, and settle them on-chain or through our banking and biller partners.
  • Verify your identity, comply with KYC / AML / counter-terrorism financing obligations, and screen for sanctions and fraud.
  • Secure your account (login MFA, transaction PIN bound to device, rate limiting, anomaly detection, audit logs).
  • Send transactional emails and in-app notifications about deposits, withdrawals, conversions, refunds, bill purchases, referral bonuses, and system announcements.
  • Operate the referral and affiliate program, including calculating and crediting commissions.
  • Debug incidents, monitor performance, reconcile balances with our custodian, and improve the Service.
  • Comply with legal requests, court orders, and regulator inquiries.
  • Detect, investigate, and act on fraud, abuse, and settlement anomalies — including automated monitoring of trading and transaction patterns — and to apply holds, reversals, clawbacks, feature restrictions, or account bans where a review finds prohibited conduct.

3. Legal bases

We process personal data because it is necessary to (a) perform our contract with you (operating your wallet and executing your instructions), (b) comply with legal obligations (KYC/AML, tax, financial reporting), (c) protect our legitimate interests in preventing fraud and securing the Service, and (d) with your consent for optional marketing communications, which you can withdraw at any time.

4. Who we share data with

We do not sell your personal data. We share it only with service providers that make KudiX work, and only to the extent required:

  • DAYA — regulated custody, NGN payments, on/off-ramp, and KYC provider. Holds custodial balances and settles NGN and crypto transfers.
  • Bigisub — biller aggregator used to deliver airtime, data, TV, and electricity purchases.
  • Solana and other supported blockchains — for on-chain deposits, withdrawals, and settlements of USDT/USDC. Wallet addresses and transaction hashes recorded on a public blockchain are inherently public.
  • Infrastructure providers — Supabase / Lovable Cloud (database, authentication, storage), Cloudflare (edge hosting), Helius (Solana RPC), and Resend (transactional email).
  • Regulators, law enforcement, and courts — when we are legally required or when necessary to protect users, the Service, or third parties.
  • Professional advisers and successors — auditors, lawyers, or a successor entity in a merger, acquisition, or reorganization.

5. International transfers

Some providers process data outside Nigeria. Where we transfer data internationally, we rely on the provider's contractual safeguards and industry-standard security controls.

6. Data retention

We retain KYC and transaction records for the period required by Nigerian financial regulation (typically at least five years after the account is closed). Support and audit logs are kept for as long as needed for security and dispute resolution. Marketing preferences are kept until you unsubscribe.

7. Security

KudiX applies defense-in-depth: encrypted transport (TLS), hashed passwords and transaction PINs bound to your device, optional TOTP MFA, database Row-Level Security, HMAC-signed admin audit logs, rate limiting, and segregated custodial and treasury flows. No online service is perfectly secure — please use a strong password, enable MFA, and never share your PIN or recovery codes.

8. Your rights

Subject to Nigerian data-protection law and our regulatory obligations, you can request access to your data, correction of inaccurate data, deletion of data we no longer need to retain, or a copy of your data in a portable format. You can also object to certain processing and withdraw marketing consent. Contact us to exercise these rights.

9. Cookies and analytics

We use strictly necessary cookies and local storage to keep you signed in, remember preferences (theme, install prompt), and protect against abuse. We use privacy-respecting analytics to understand aggregate usage; we do not use advertising trackers.

10. Fraud monitoring, reviews, and automated decisions

To protect users and the platform, we monitor account and transaction activity for indicators of fraud or abuse — for example duplicate sells, ledger or token imbalances, burst or bot-like trading, rapid round-trip trades, abnormal profit patterns, linked or duplicate accounts, and device or IP anomalies. This processing is necessary for our legitimate interests in preventing fraud and for complying with AML obligations.

  • What we look at: trade, order, deposit, withdrawal, conversion and bill records; balances and ledger entries; device identifiers, IP addresses, and session and login events; KYC status; and support correspondence.
  • Automated screening: our systems score activity and may automatically place a temporary hold on withdrawals or trading, or restrict a feature, pending human review.
  • Human review: account closures, bans, and clawbacks are decided by a person, not by automation alone, and are recorded in a tamper-evident audit log.
  • Your rights here: you can ask for an explanation of a hold or decision, submit evidence, and appeal it by contacting support. See the corresponding sections of our Terms & Conditions for the review, appeal, and recovery process.
  • Sharing: where a review finds fraud or a legal obligation applies, we may share relevant records with our custody, banking, and biller partners, regulators, and law enforcement. Records of fraud investigations and enforcement actions are retained for the period required by financial regulation and to prevent repeat abuse.

11. Children

KudiX is not directed to anyone under 18. We do not knowingly collect data from children. If you believe a minor has an account, contact us and we will remove it.

12. Changes

We may update this Policy. Material changes will be announced in-app or by email. Continued use of the Service after an update means you accept the revised Policy.

13. Contact

For privacy questions or to exercise your rights, email privacy@kudix.app.