Last updated September 17, 2026
Exora Technologies (“Exora”, “we”, “us”, or “our”)
Product: Exora mobile application and related services
Effective Date: 17 September 2026
Version: 2.0
Governing law: Laws of the Federal Republic of Nigeria
This Privacy Policy explains how Exora Technologies collects, uses, stores, shares, and protects personal data when you use the Exora mobile application (Android and iOS), related websites (including https://exora.finance), APIs, and other services we operate (together, the “Services”).
Exora provides a custodial in-app wallet and related financial technology services for users in Nigeria, including:
We process personal data in accordance with:
By creating an account, completing Know Your Customer (KYC) verification, or otherwise using the Services, you acknowledge that you have read this Privacy Policy. Where the law requires consent for a specific processing activity, we will obtain that consent separately.
This Policy is intended to meet transparency and accountability expectations under the NDPA for data controllers and to support disclosures required for app-store listings and in-app legal documents.
The data controller responsible for your personal data is:
| Item | Details |
|---|---|
| Organisation | Exora Technologies |
| Principal place of business | Lagos, Nigeria |
| Product / website | https://exora.finance |
| General support | support@exora.finance |
| Privacy / data-protection requests | privacy@exora.finance |
| Data Protection Officer (DPO) | dpo@exora.finance |
| Online legal page | https://exora.finance/legal/privacy |
If our CAC-registered legal name, RC number, or physical office address differs from the branding details above, the particulars published in our in-app Legal Documents or on our official website at the time of your request will control. You may request our full registered company particulars from the DPO.
This Policy applies to personal data relating to:
This Policy does not apply to third-party websites, payment rails, blockchain networks, or apps that we do not control, even if linked from the Services.
Depending on how you use the Services, we may process the following categories of personal data.
To meet AML/CFT, fraud-prevention, and tiered access requirements, we may collect and process:
Under the NDPA, biometric data and certain financial identifiers may constitute sensitive personal data. We process such data only for lawful purposes (primarily legal obligation and performance of a contract / compliance with financial-services duties), with heightened security controls. We do not use KYC images for marketing.
If you grant the Contacts permission, the app may read contacts on your device solely to help you select a Nigerian mobile number for airtime, data, or similar bill flows. Contact lists are processed on-device for selection; we do not upload your full address book. Only the number (and related transaction metadata) you choose to use is transmitted to our servers as needed to complete the payment.
Camera access is used for KYC document capture, face verification, and features that require photographing documents. Images are transmitted securely to our servers (and, where applicable, identity-verification processors) for those purposes.
We do not require access to your precise GPS location, microphone content (except where a platform permission is declared for camera/media capture tooling), SMS inbox contents, or social-media friend graphs. If a platform permission appears broader than needed, we use it only for the purposes described in this Policy.
We obtain personal data from:
We process personal data only when a lawful basis under the NDPA applies. The primary bases we rely on are:
| Lawful basis | When we typically rely on it |
|---|---|
| Performance of a contract | To create and operate your account, wallet, trades, transfers, and bill payments |
| Legal obligation | KYC/AML/CFT checks, sanctions screening where applicable, record-keeping, responding to lawful requests from competent authorities, and tax or regulatory reporting when required |
| Legitimate interest | Securing the platform, preventing fraud and abuse, improving reliability, and defending legal claims — balanced against your rights |
| Consent | Where required (for example certain optional device permissions, non-essential marketing communications, or optional features). You may withdraw consent without affecting processing that relies on another lawful basis |
| Purpose | Examples | Typical lawful basis |
|---|---|---|
| Account registration and authentication | Sign-up, login, email/phone verification, 2FA, biometric re-login, new-device checks | Contract; legitimate interest (security) |
| KYC / identity verification | NIN, passport, driver’s licence, BVN, face capture, tier limits | Legal obligation; contract |
| Wallet and payments | NGN VA deposits, bank withdrawals, buy/sell, crypto deposit/withdrawal, bill pay | Contract; legal obligation |
| Fraud, AML, and security | Monitoring, device signals, suspension, incident response | Legal obligation; legitimate interest |
| Customer support | Tickets, dispute handling, service notices | Contract; legitimate interest |
| Service improvement and diagnostics | Crash reports, performance metrics (de-identified where practicable) | Legitimate interest; consent where required |
| Marketing (optional) | Product updates or promotions where permitted | Consent or soft opt-in where allowed by law |
| Legal compliance and claims | Regulatory inquiries, court orders, enforcing Terms | Legal obligation; legitimate interest |
We use personal data to:
We do not sell your personal data.
We share personal data only as needed for the purposes above, with appropriate contractual and security safeguards.
We may share data with carefully selected processors who act on our instructions, including:
We may share data with affiliates, auditors, lawyers, and insurers under confidentiality obligations where reasonably necessary.
We may disclose personal data when we reasonably believe disclosure is required by Nigerian law, regulation, court order, or a competent authority (including the NDPC, CBN, NFIU, EFCC, or other lawful agencies), or to protect vital interests and public safety.
If we undergo a merger, acquisition, reorganisation, or sale of assets, personal data may be transferred as part of that transaction, subject to continued confidentiality and NDPA obligations. We will notify users where legally required.
We may share information when you instruct us to (for example sending value to a bank account or wallet you designate).
Some processors (including cloud, analytics, crash-reporting, or crypto partners) may process data outside Nigeria. Where we transfer personal data across borders, we will do so in line with the NDPA and NDPC requirements, including ensuring that:
You may contact the DPO for more information about safeguards applicable to specific transfers.
We retain personal data only for as long as needed for the purposes stated in this Policy, including:
| Category | Retention approach |
|---|---|
| Account data | For the life of the account and a reasonable period afterwards to close out obligations |
| KYC and transaction records | For the minimum periods required under AML/CFT and other financial-services record-keeping rules (often several years after the end of the business relationship or the date of the transaction), and longer where a dispute, investigation, or legal hold exists |
| Support records | For as long as needed to resolve issues and improve service quality |
| Security logs | For a period appropriate to detect and investigate incidents |
| Device / push tokens | Until you log out, uninstall, revoke permission, or the token expires; we periodically prune stale tokens |
When retention expires, we will delete, irreversibly anonymise, or securely archive data in accordance with our retention schedule and legal requirements.
Note: Blockchain transactions you initiate are public by nature and cannot be altered by Exora.
We implement technical and organisational measures appropriate to the sensitivity of the data, including:
No method of transmission or storage is perfectly secure. You are responsible for keeping your device, PIN/password, 2FA, and recovery codes confidential and for enabling available security features.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the NDPC and, where required, affected data subjects, in accordance with the NDPA and NDPC guidance.
Subject to the NDPA and any lawful exceptions (including AML record-keeping), you have the right to:
Email privacy@exora.finance or dpo@exora.finance from your registered email address, and include enough information for us to verify your identity.
We will respond within the timeframes required by the NDPA (generally within thirty (30) days, extendable where permitted for complex requests).
If you are dissatisfied with our response, you may complain to the NDPC (see Section 21).
The Services are intended for individuals who are at least eighteen (18) years old (or the age of legal capacity to enter financial contracts in Nigeria). We do not knowingly collect personal data from children.
If you believe a minor has provided personal data, contact us and we will take appropriate steps to delete the data and close the account, subject to legal retention duties.
Depending on your device and OS version, the app may request the following permissions. You can deny or revoke non-essential permissions in system settings; some features will then be unavailable.
| Permission / capability | Purpose |
|---|---|
| Camera | KYC document capture and face / liveness verification |
| Contacts (optional) | Select a beneficiary phone number for airtime/data — no full address-book upload |
| Biometrics / local authentication | Optional unlock and re-login; templates stay on device |
| Notifications | Transactional alerts, security notices, and service updates |
| Network / internet | Core app and API connectivity |
| Storage / media (as required by OS) | Save or share receipts, select images where the flow requires it |
We do not use these permissions for advertising profiling unrelated to the Services.
The mobile app primarily uses local storage, secure storage, and device identifiers rather than browser cookies. Our websites and legal pages may use strictly necessary cookies and similar technologies for security, session continuity, and basic analytics. Where non-essential cookies are used, we will provide notice and choices as required by applicable law.
We may send service/transactional messages without marketing consent because they are necessary to operate your account. Marketing or promotional messages will be sent only where permitted by law and, where required, with your consent.
You can opt out of marketing emails using the unsubscribe link or by contacting support. Opting out of marketing does not stop security or transactional notices.
We use automated systems to help detect fraud, enforce rate limits, apply KYC tier rules, and protect accounts (for example flagging unusual login locations or suspicious withdrawal patterns). These systems may affect access to features.
You may request an explanation or human review of a consequential automated decision by contacting support or the DPO.
The Services may contain links to third-party sites or embed third-party SDKs (for example Firebase). Their privacy practices are governed by their own policies. We encourage you to review those policies.
We remain responsible for personal data we instruct processors to handle on our behalf.
You may request account closure through the app support channels or by emailing support. Closure may be delayed while we complete pending transactions, investigations, or mandatory retention.
When you delete the app from your device, local caches are removed, but server-side account and ledger data remain until deleted or anonymised under this Policy.
If your account is suspended for security or compliance reasons, we may retain data as required to investigate and meet legal obligations, and we may revoke active sessions and biometric enrolments.
We may update this Policy from time to time to reflect changes in law, regulators’ guidance, or our Services. Material changes will be notified through the app, email, and/or by updating the version and effective date on https://exora.finance/legal/privacy.
Continued use after the effective date constitutes acknowledgment of the updated Policy, except where consent is specifically required.
This Privacy Policy is governed by the laws of the Federal Republic of Nigeria.
The supervisory authority for data protection complaints is the Nigeria Data Protection Commission (NDPC). You also retain any other remedies available under Nigerian law.
For NDPC contact and complaint channels, refer to official NDPC publications and https://ndpc.gov.ng (or the successor official website).
For privacy questions, data-subject requests, or to contact our DPO:
| Channel | Contact |
|---|---|
| Privacy | privacy@exora.finance |
| DPO | dpo@exora.finance |
| Support | support@exora.finance |
| Online | https://exora.finance/legal/privacy |
| Address | Exora Technologies, Lagos, Nigeria |
Last updated: 17 September 2026
This document is a privacy notice for users of the Exora Services. It is not legal advice. For regulated filings, Play Console Data safety answers, or CAC/registered particulars, confirm final company details with counsel before publication.
