Privacy Policy

1. Who we are

ZemFi is operated by ZemFi Technologies Ltd (“ZemFi”, “we”, “us”). We are the controller of the personal information described in this policy.

Payments, balances, stablecoin custody and identity verification are provided by a licensed payments partner (“our payments partner”). Our payments partner processes the information needed for those services under its own obligations as a regulated provider.

2. What we collect

Account information

• Your name, email address, phone number and country.
• Your password, which we store only as a one-way hash.
• Whether you use a personal or business account. For business accounts: the legal and trading name, registration number, business address and website.

Identity verification

To meet anti-money-laundering and know-your-customer rules, we collect verification information and pass it directly to our payments partner. Depending on your verification level, this may include:

• Your Bank Verification Number (BVN), date of birth, occupation and residential address.
• Whether you are a politically exposed person.
• A liveness selfie. Our payments partner compares it with the photo held on official identity records, so it is biometric information.
• Your National Identification Number (NIN), a photo of a government ID (front and back), its type and number, and a recent utility bill.
• For the highest verification level only, we compare your utility bill with the residential address you declared, to confirm where you live.

We keep a record of your verification status, but your ID numbers, ID documents and selfie are held by our payments partner rather than in ZemFi’s own database.

Transactions and recipients

• Details of each transaction: type, amount, currency, fees, status, destination country, blockchain network and transaction hash.
• Recipients you save: account holder name, bank account number, bank code and country, or a wallet address and network.
• Bank accounts you withdraw to, which are stored with our payments partner.

Security and device information

• Sign-in sessions, including the IP address, the device name your phone reports, and when the session was last used.
• Your phone’s platform (iOS or Android), app version and push notification token.
• If you turn on two-factor authentication, the secret that links your authenticator app. We store it encrypted.

Support

Messages you send us through in-app support or by email, including any transaction reference you include.

3. How we use it

• To provide the service: creating your account, buying, selling and sending stablecoins, paying bank accounts abroad, and giving you accounts to receive money. This is necessary to perform our contract with you.
• To meet legal obligations: verifying your identity, screening and monitoring transactions for fraud, money laundering and sanctions, and keeping records the law requires.
• To keep your account secure: managing sessions, two-factor authentication, and alerting you to sign-ins and security changes.
• To communicate with you: transaction updates, verification results, security alerts and replies to support requests, by email and push notification. You can turn off push notifications in your phone’s settings.

4. Who we share it with

We share personal information only where needed to run the service or where the law requires it:

• Our payments partner: identity verification, custody of balances, payments and payouts. When you sign up, we send our payments partner your name, email, phone number and country, along with the verification information described above.
• Banks and payment providers: when you send money, our payments partner and its licensed payment providers in the destination country receive the recipient details needed to deliver it. Identity records may be checked against official databases, such as Nigeria’s NIBSS for BVN verification.
• Blockchain networks: stablecoin transfers are recorded on public blockchains. Wallet addresses and amounts are visible to anyone and can’t be deleted.
• Service providers: companies that deliver our emails, push notifications and app updates on our behalf.
• Authorities: regulators, law enforcement or courts, when the law requires it.

Some of these providers may process information outside your country. Where they do, we rely on appropriate safeguards as required by applicable data protection law.

5. Device permissions

The app asks for these permissions only when a feature needs them. You can change them at any time in your phone’s settings:

• Camera and photos: to capture ID documents and your verification selfie, and to scan wallet QR codes.
• Face ID or fingerprint: to unlock the app. This is handled entirely by your phone. ZemFi never receives or stores your face or fingerprint data.
• Notifications: to send transaction and security alerts.

The app does not ask for or use your location.

6. How long we keep it

We keep your account information for as long as your account is open.

Anti-money-laundering law requires us and our payments partner to keep certain records for five years after your account is closed or a transaction is completed. These records are your BVN, NIN, identity documents, and your transaction, payout and ledger history, including the bank accounts used for payouts.

Records of actions our staff take on accounts are kept for audit purposes.

7. Security

We protect your information with encryption in transit, hashed passwords, encrypted two-factor secrets, optional biometric app lock and two-factor checks on sensitive actions, and access controls for staff. No system is completely secure, so please keep your password and authenticator private and tell us straight away if you think your account has been compromised.

8. Your rights

Depending on where you live (for example, under Nigeria’s Data Protection Act 2023), you may have the right to:

• access the personal information we hold about you;
• correct information that is wrong or incomplete;
• ask us to delete it, subject to the records we must keep by law;
• receive a copy in a portable format;
• object to or restrict certain processing, and withdraw consent where we rely on it;
• complain to your data protection authority, such as the Nigeria Data Protection Commission.

To use any of these rights, contact us using the details below. We may need to verify your identity first.

9. Deleting your account

You can delete your account in the app under Settings → Delete account, or by emailing support@zemfi.ng from the address on your account if you no longer have the app. Your balance must be empty and no transfers can be pending. Deletion removes your name, email, phone number, address, password, two-factor secret, saved recipients and payout bank accounts. The records described in How long we keep it are kept for the period the law requires and then deleted. Step-by-step instructions are on our account deletion page.

10. Children

ZemFi is not for anyone under 18, and we don’t knowingly collect information from children.

11. Changes to this policy

We may update this policy as the service changes. When we make significant changes, we’ll tell you in the app or by email before they take effect. The date at the top shows when it was last updated.

12. Contact us