Privacy policy
This policy explains what personal information the iTopit app and website collect, why, and what your rights are. iTopit is operated by Galaphone Nigeria Limited ("Galaphone", "we", "us"), Block 1, Choice Plaza, Alkali Road, Kaduna, Nigeria. We are the data controller for the information described here, and we process it in line with the Nigeria Data Protection Act 2023.
What we collect
- Your Google account details: your name and email address, shared by Google when you choose "Continue with Google". We do not receive your Google password.
- Purchase details: the phone numbers you top up, the network, the amount, the date and time, and the result of each purchase.
- Wallet records: money added to your iTopit wallet, purchases paid from it, and any refunds.
- Payment details: card and bank payments are handled by our payment provider, Paystack. Your card number is entered with Paystack and is never stored by iTopit. We receive confirmation of the payment, its amount and a reference.
- Your transaction PIN: stored only in a scrambled (hashed) form that cannot be turned back into your PIN.
- Support messages: anything you tell us when you contact support.
- Basic technical information: such as app version and error reports, used to keep the service working.
We do not collect your contacts, photos, location or messages, and we do not show advertising.
Why we use it
- To create and secure your account and sign you in.
- To deliver the airtime and data you buy, and to keep your wallet balance and receipts accurate.
- To refund you when a purchase fails, and to handle complaints.
- To prevent fraud and misuse, and to meet our legal and accounting obligations.
- To tell you about changes to the service. We will only send marketing messages if you agree to them.
We rely on the need to perform our agreement with you, our legal obligations, and our legitimate interest in keeping the service safe.
Who we share it with
- Topupbox (operated by Zeedlabs), which delivers airtime and data to the networks. They receive the phone number, network and amount for each purchase.
- Paystack, which processes card and bank transfer payments.
- Google, for sign-in.
- Our hosting provider, which runs the servers that store iTopit's records.
- Authorities, when the law requires it.
We do not sell your personal information. Some of these providers may store information outside Nigeria; where they do, we rely on the safeguards the Nigeria Data Protection Act requires.
How long we keep it
We keep your account information while your account is open. Transaction and wallet records are kept for [six] years after the transaction, because financial and tax rules require it, even if you delete your account. Other information is deleted or anonymised when it is no longer needed.
Your rights
You can ask to see the personal information we hold about you, correct it, delete it, or object to how we use it. You can also complain to the Nigeria Data Protection Commission. To delete your account, follow the steps on our account deletion page.
Security
Information is sent over encrypted connections, purchases require your PIN, and access to records is limited to staff who need it. No system is perfectly secure, so please keep your PIN private and tell us straight away if you think your account has been misused.
Children
iTopit is not intended for children under 13, and we do not knowingly collect their information.
Changes and contact
We will post any changes to this policy here and update the date above. For questions or requests, email support@itopitapp.com or call [support phone number].