Privacy Policy — Dropp policy draft

1. Operator and legal status

Dropp is operated by IMOLEOLUWA DISCIPLESHIP HUB, a sole proprietorship registered with the Corporate Affairs Commission of Nigeria under the Companies and Allied Matters Act 2020, Business Name Registration No. 9776404 (registered 15 August 2026; nature of business: IT services). Tax Identification Number: 2623063880394. Principal place of business: Road 6, Kulodi, Ibadan, Oyo State, Nigeria. Registered contact email: idahubng@gmail.com.

Dropp provides wallet, payment-link and commerce tools. Dropp integrates with Flutterwave for collections, virtual-account services and bank cash-outs. Flutterwave, a payment service provider licensed by the Central Bank of Nigeria, holds customer funds and has confirmed that it permits Dropp's use of its collection, virtual-account and transfer services. Dropp itself is a technology platform: it does not hold a CBN banking, mobile-money or payment-service licence and does not take deposits.

2. Information and purposes

Dropp processes account names, phone numbers, email addresses, profile details, transaction amounts and references, bank details, verification information, support requests and security/device records to operate accounts, process instructions, prevent fraud and resolve disputes. Camera access supports QR scanning; it is requested by the browser. Notification permissions support optional Web Push.

Business verification may involve company registration details and director information. Personal verification uses BVN information and provider consent/OTP steps. Do not send identity documents or BVN in WhatsApp chat. Dropp stores the verification result, your name as returned and a masked reference; full BVN values and card details are handled by Flutterwave and are not stored by Dropp.

3. Lawful bases

Contract necessity may apply to account and payment processing. Legal obligation applies only where an identified law actually requires the processing. Legitimate interests require a documented assessment, safeguards and an objection route. Consent applies to optional processing where legally required and must be freely given, specific and withdrawable. Acceptance of Terms is not blanket consent for marketing or every data use.

How each activity is handled: accounts, payments, cash-outs and WhatsApp commands — contract necessity; identity checks and transaction records — legal obligation (CBN anti-money-laundering rules); fraud and security monitoring — legitimate interests; product emails, push notifications and promotions — consent, withdrawable at any time; AI copywriting — contract necessity, using only the product details you enter. No NDPC compliance certification is asserted.

4. Providers and international transfers

The app uses Lovable Cloud hosting and account/data services, Flutterwave payments and verification, LGS company validation, Brevo email, and supported AI services. WhatsApp features use WhatsApp/Meta and a messaging gateway when connected. Each receives information relevant to its role; payment providers may have independent legal responsibilities.

The final notice must identify the contracting entities, controller/processor roles, processing countries, subprocessors and lawful international-transfer safeguards. Overseas processing must meet the Nigeria Data Protection Act requirements; use of a named provider alone does not establish those safeguards. Dropp does not sell personal information under this draft; this statement requires operational confirmation before adoption.

5. WhatsApp messages and PINs

Sending a message to the bot permits processing of that message to respond to the command, not unrelated marketing. Messages, phone identifiers, provider message IDs and delivery events may be retained for operation, recovery, fraud investigation and support. Raw stored webhook payloads may include PIN replies even where the app message history is masked. Transaction PIN verification uses a one-way hash; that does not erase copies of the original chat message.

WhatsApp confirmation sessions expire after 3 minutes. Message history and raw webhook records are kept for up to 12 months for support and fraud review, with access limited to authorised staff. Users should not treat WhatsApp as a place to submit bank credentials or identity documents.

6. Retention and security

Retention schedule: account and profile data — while your account is open, then deleted or anonymised within 90 days of closure unless needed below; transactions, wallet ledger, cash-outs and identity-check results — 5 years after the transaction or end of the relationship, as required by CBN AML/CFT regulations; WhatsApp messages and webhook records — up to 12 months; support tickets — 2 years after closure; security and access logs — up to 12 months; abandoned sign-ups and unfinished verifications — 90 days; backups roll over on the provider's schedule. Records under an open dispute or legal hold are kept until it is resolved.

Access controls, encryption where applicable, audit records and incident response must be maintained and verified. No system is risk-free. Breach assessment and notifications must follow applicable law, including required NDPC and affected-person notifications; this draft does not claim those processes have been audited.

7. Your rights and children

Subject to applicable law, you may request access, correction, erasure, restriction or portability; object to relevant processing; and withdraw consent where consent is the basis. Identity checks may be necessary to protect your account. Some records may remain for valid legal or dispute purposes. Requests can start through Profile → Support pending confirmation of a designated privacy contact.

You may complain to the Nigeria Data Protection Commission at https://ndpc.gov.ng/. The final notice must confirm its current complaint channel and applicable response procedures. Children's account access and age verification require separate assessment; this draft does not authorise paid games or financial services for minors.

Official references

Current NDPC registration guidance and applicable gaming authorisations still require legal verification. A policy does not obtain a licence or cure an unauthorised service.