1. Who this policy covers
This policy applies to the Manbills website, mobile app and related support services. Manbills is responsible for the personal information it processes through these services. For privacy questions or requests, contact usemanbills@gmail.com.
Some features may be available only in testing or may not yet be enabled for live accounts. The information processed depends on the features you actually use. A website visit does not, by itself, involve identity verification or access to your financial accounts.
2. Information we collect
- Account and profile information: your name, email address, phone number, date of birth, address, account preferences and personal or business workspace details that you provide.
- Authentication and security information: protected credential records, verification results, sign-in sessions, device registrations and security events. If you choose Google sign-in, we receive the account information authorised for that sign-in, such as your email and basic profile.
- Identity verification information: where enabled and with the consent presented in the app, your BVN or NIN, captured selfie or camera frames, and identity matching or presence-check results. Face information is sensitive and is used for verification and account security.
- Financial and workspace information: wallet and transaction records, amounts, recipients, budgets, spending categories, expenses, notes and business team activity that you enter or generate when using an enabled feature.
- Device and technical information: IP address, app or browser version, operating system, request and error records, and installation identifiers and Firebase Cloud Messaging registration tokens when device registration is enabled.
- Communications: support enquiries, feedback, deletion requests and information you include in those messages.
Provide only information needed for the relevant feature. Do not send your PIN, password, one-time codes, full BVN/NIN or payment credentials in a support email.
3. Why we use your information
We use information to create and manage accounts, authenticate users, provide enabled money-management features, verify identity, protect accounts, prevent abuse, deliver requested notifications, respond to support requests and meet applicable legal obligations.
Our grounds for processing, where applicable, include providing the service you request, your consent, compliance with law and legitimate interests in operating and securing the service. We request consent for identity and face verification in the relevant flow. You may withdraw consent by contacting us; this does not undo processing already lawfully carried out and may prevent use of features that require verification.
4. Camera, notifications and local storage
The app requests camera access for an identity or recovery capture when you start that flow. You can deny or revoke access in your device settings, although verification may then be unavailable. We do not use verification captures for advertising.
Firebase Cloud Messaging, provided by Google, processes device registration information to deliver notifications where enabled. Notification payloads use event identifiers; financial details are retrieved through the authenticated app. You can manage notification permission in device settings.
The website and app may use storage needed for sessions, security and preferences. This policy does not grant consent to optional advertising or tracking technologies; where consent is required, it must be requested before those technologies are used.
5. Who receives information
We share information only as needed with service providers that support hosting, data storage, authentication, email, notifications, identity checks and enabled financial services. Relevant providers include Google for optional Google sign-in and Firebase messaging, Dojah for enabled BVN/NIN lookup and selfie matching, and email and infrastructure providers that deliver and host the service.
When you consent to an enabled Dojah check, the identifier and selfie needed for that check are sent to Dojah. Business workspace information may be visible to authorised team members according to their roles. Information needed for an enabled payment may be shared with the recipient or relevant financial service provider.
We may also disclose information where legally required or necessary to investigate fraud, protect users or enforce our terms. We do not sell personal information. Providers may process information outside Nigeria; applicable safeguards are required for such transfers.
6. Retention and security
We retain information for as long as needed for its stated purpose, an active service relationship, or a legitimate legal, security or dispute-resolution obligation. We use access controls and protective measures appropriate to the information, but no system can guarantee absolute security.
The current verification implementation encrypts submitted BVN/NIN values and expires them after 24 hours. Camera frames are discarded after analysis. A selected selfie is stored encrypted with a ten-minute expiry and removed on cancellation or replacement; related capture metadata and replay hashes expire after 24 hours. Cleanup runs periodically, and an interruption may delay physical removal until it resumes. These limits concern temporary verification storage, rather than every account record. Provider-held records and backup copies have separate retention arrangements.
Financial transaction and accounting records, evidence of consent, fraud or security investigation records, and records needed for legal claims may have to remain after account deletion. We restrict their use to the reason for retention. Backup copies may remain until the applicable backup cycle expires. When handling a deletion request, we will explain any exception, the information retained, and the applicable retention period or the criteria that determine it.
7. Your choices and account deletion
You may request access, correction, deletion or a copy of your personal information, object to or request restrictions on processing, and withdraw consent where processing relies on it, subject to applicable law. Contact usemanbills@gmail.com. We may verify that the request comes from the account holder before acting.
To request deletion of your Manbills account and associated personal data, use our account deletion page. You can submit a request without installing or signing in to the app. Uninstalling the app alone does not delete an account.
If you are dissatisfied with our response, you may raise a complaint with the Nigeria Data Protection Commission or the relevant data protection authority.
8. Children and policy updates
Manbills accounts are intended for people aged 18 or older. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.
We may update this policy as the service changes. We will update the effective date and provide additional notice where required for material changes.