NG SUB

1. Introduction

This Privacy Policy explains how NG SUB ("NG SUB", "we", "us", "our") collects, uses, stores and protects information when you use the NG SUB reseller dashboard, the NG SUB mobile application, and the NG SUB API (together, the "Service"). It describes only what the Service actually does.

2. Developer information

NG SUB is developed and operated by Sakaafah Communication Services ("Developer", "Sakaafah"), based in Nigeria. For privacy questions, data requests, or account deletion, contact ngsubv2@gmail.com.

3. Scope of this Privacy Policy

NG SUB is a digital VTU (virtual top-up) and subscription reseller platform for the Nigerian market. Through one wallet, a reseller can dispatch airtime, data bundles, cable TV subscriptions, electricity tokens, examination result-checker PINs, bulk SMS, and gift cards/eSIMs to their own customers, fund that wallet via card payment or bank transfer, and manage their reseller account, API keys and sub-resellers. This Policy applies to the web dashboard, the mobile app, and the underlying API. It does not apply to third-party sites reached through links in the Service.

4. Information we collect

We only collect information that supports account, transaction and security functions already built into the Service:

• Account information you provide: name, business name, email address, password (stored as a one-way hash), and optionally your phone number.
• Government identifiers (NIN and/or BVN), only if you submit them for identity verification (Section 7).
• A profile photo, only if you upload one, or one supplied by Google when you sign in with Google.
• Transaction and wallet information generated when you use the Service (Sections 8–9).
• Device/session information generated automatically when you use the Service (Section 10).
• Support messages and evidence you submit to us (for example, an Airtime-to-Cash evidence photo).

We do not request or process precise or approximate device location, and we do not access your phone's contacts or camera.

5. How we use information

• To create and secure your reseller account, authenticate you, and keep your session safe.
• To process and fulfil the VTU/subscription orders you place, and to maintain your wallet balance and transaction history accurately.
• To fund your wallet (card payment or bank transfer) and to pay out withdrawals to your own linked bank account.
• To meet identity-verification requirements tied to receiving a virtual bank account and to withdrawals.
• To detect fraud, abuse, and account compromise, and to maintain an audit trail of sensitive actions.
• To respond to support requests and to operate the Arewa AI assistant (Section 12).
• To send you account, security and transaction notifications you are entitled to receive.

We do not use your personal information for third-party advertising, and we do not sell personal information.

6. Legal and operational basis

We process account, KYC and transaction information because it is necessary to perform our contract with you as a reseller and because it is required by Nigerian financial-sector rules tied to issuing a virtual bank account and handling withdrawals. Security and fraud-prevention information is processed on the basis of our legitimate interest in keeping the Service and your funds safe.

7. Account information

Creating an account (by email/password, or by signing in with Google) requires:

• Required: name, business name, email address, and (for email/password sign-up) a password and a one-time email verification code.
• Optional: phone number, a referral code, and your National Identification Number (NIN) or Bank Verification Number (BVN).
• From Google (only with "Sign in with Google"): name, email address and profile picture, as returned by Google.

NIN/BVN is required before your first withdrawal and certain reward/promotional features, and is also used by our wallet-funding provider to issue your dedicated virtual bank account, consistent with Central Bank of Nigeria identity-verification rules. Your NIN/BVN is encrypted at rest; only the last 4 digits are ever shown back to you or to NG SUB staff. We do not collect a photograph of your ID document.

A transaction PIN (separate from your password) authorises individual purchases; it is never visible to NG SUB staff or the Arewa AI assistant.

8. Transaction and payment information

Your wallet balance and every balance movement is recorded in an append-only ledger so your balance history can always be reconstructed accurately.

• Card payments for wallet funding are processed directly by Paystack. NG SUB never receives or stores your full card number, CVV, or expiry date. NG SUB only stores the card's brand and last 4 digits, to recognise a saved card for optional auto-top-up.
• Bank transfer funding is handled through a dedicated virtual bank account issued to you by Payvessel, which also processes withdrawal payouts to your own bank account.
• Inbound payment webhooks from Paystack and Payvessel are logged for reconciliation and fraud investigation, with sensitive fields redacted before storage.

9. VTU/service transaction information

For every order you place, we store the recipient identifier required by that product (phone number, meter number, smartcard/decoder number, or exam-PIN delivery number), the product/plan, the amount charged, our cost, which upstream provider fulfilled it, the order's status, and any provider response message. This is also shared with whichever upstream dispatch provider actually fulfils the order (Section 13).

If you use the optional Airtime-to-Cash feature, the sender's phone number, the claimed face value, and (only if you choose) an evidence photo from your device's photo library are stored with that claim. If you link your WhatsApp number to our WhatsApp ordering bot (powered by Termii), we store the linked number and its verification status.

10. Device and technical information

• We record the IP address, user-agent and a device label for each login session, so you can review and revoke your own active sessions and so we can detect suspicious logins.
• We keep a security-activity log of sensitive account events together with the IP address/device involved.
• We do not use advertising identifiers, and we do not have any analytics or crash-reporting SDK (e.g. Google Analytics, Firebase Analytics, Sentry) wired into the app.
• We do not currently collect push-notification device tokens — push notifications are not sent by the Service today.
• On the mobile app, Face ID/Touch ID/fingerprint confirmation is verified entirely by your device's own operating system; NG SUB never receives your biometric data.
• The mobile app keeps a small amount of information only on your device (such as language and app-lock preference) using standard local app storage, not uploaded to NG SUB.

11. Notifications

NG SUB sends account, security and transaction notifications through an in-app inbox, email, and in some cases SMS, tied to your existing contact details. We do not use notifications for third-party advertising. Short-lived secrets (such as a one-time code) carried in a notification are encrypted and expire automatically.

12. AI / Arewa AI data processing

Arewa AI is an in-dashboard assistant. Common questions are answered instantly on your own device without contacting any AI provider. Questions needing a fuller answer are sent, only after you are authenticated, to Google's Gemini API, together with your name, business name, wallet balance, virtual account details, tier, up to your 8 most recent transactions, your own markup settings, general non-personal platform statistics, and your typed message/recent conversation history.

Only your own account's data is included — Arewa AI is instructed to never disclose another reseller's information, and your password, transaction PIN, API key, NIN/BVN and session tokens are never sent to it. Your chat messages are not saved to NG SUB's database after your session ends.

13. Third-party service providers

The following providers process data on our behalf, strictly for the purpose described:

• Google — Sign in with Google and the Gemini API (Arewa AI).
• Paystack — card payment processing for wallet funding.
• Payvessel — virtual bank account issuance and withdrawal payouts.
• Termii — SMS delivery and WhatsApp Business messaging for the ordering bot.
• Clubkonnect, VTU.ng, LegitData — upstream dispatch of airtime, data, cable TV, electricity and exam-PIN orders.
• DTOne — gift card and eSIM fulfilment, available to a limited set of accounts.
• Our transactional email provider — account, security and receipt emails.
• Neon (database hosting), Railway (API hosting) and Cloudflare (web app hosting).

14. Data sharing

We share the minimum information each provider above needs to do its job. We do not sell personal information, and we do not share your information with advertisers or data brokers.

15. Data retention

We keep account and transaction records for as long as your account is active, and afterwards for as long as reasonably needed to resolve disputes, satisfy financial record-keeping obligations, and prevent fraud, after which they are deleted or anonymised. Security/audit logs and session records are retained for a limited period and pruned on an ongoing basis.

16. Data security

• Passwords are stored as salted one-way hashes, never in plain text.
• NIN/BVN and other sensitive credentials are encrypted at rest; only masked fragments are ever displayed.
• Session cookies are HTTP-only and transmitted securely in production.
• Wallet-balance changes are written as atomic, row-locked database transactions with a matching ledger entry.
• Sensitive account actions (such as large withdrawals) can require an additional, cryptographically verified step-up confirmation.

17. Account and data deletion

NG SUB does not yet have a self-service "delete my account" button in the app. To request deletion of your account and associated personal information, email ngsubv2@gmail.com from the email address on your account, with the subject "Account Deletion Request". We will verify your identity, settle or refund any pending wallet balance, and then delete or anonymise your personal profile information (name, contact details, NIN/BVN, profile photo). Transaction and ledger records may be retained for the period described in Section 15, where required for financial record-keeping, fraud-prevention or legal purposes, even after account deletion.

18. Your rights

• View and update most of your profile information directly from your account's Profile page.
• View and revoke your own active login sessions from your account's Security Center.
• Request a copy of the personal information we hold about you by emailing us.
• Request correction or deletion of your personal information, subject to Sections 15 and 17.
• Opt out of the public referral leaderboard from your Referrals settings, without affecting your referral earnings.

19. Children's privacy

NG SUB is a business tool for resellers and is not directed at children. Account registration requires submitting business and, where applicable, government identity information, and the Service is not intended for use by anyone under 18.

20. International data processing

NG SUB is built for the Nigerian market and its payment/VTU providers operate in Nigeria. Some infrastructure and AI providers we rely on operate global cloud platforms, which can mean information is processed on servers outside Nigeria as part of delivering that provider's service to us.

21. Cookies and web technologies

The web dashboard uses an essential, HTTP-only session cookie to keep you signed in and a CSRF-protection cookie. We do not use third-party advertising or cross-site tracking cookies.

22. Changes to this Privacy Policy

We may update this Privacy Policy as the Service changes. We will update the "Last Updated" date above when we do. Material changes will be communicated through the Service.

23. Contact information

For any question about this Privacy Policy, your data, or to request account/data deletion, contact:

Sakaafah Communication Services
NG SUB
Email: ngsubv2@gmail.com