Privacy policy
Last updated 4 October 2026
The short version. We collect what we need to open and run your account and to meet the law. We share it only with the companies that help us run Nod and with authorities when the law requires. We don't sell your data, and we don't use it for advertising.
Who we are
Nod is a money app operated by Spendo Technology Limited (RC 7097309), Lagos, Nigeria ("Nod", "we", "us"). We are the data controller for the personal data described here. Your money is held at our partner bank, Rubies Microfinance Bank, licensed by the Central Bank of Nigeria, which is also responsible for the data it holds to provide your account.
This policy follows the Nigeria Data Protection Act 2023. SendCore Limited is registered with the Nigeria Data Protection Commission as a data controller (NDPC/DCP/13105). Questions or requests: [email protected].
What we collect
| What | Details |
|---|---|
| Identity | Your name and date of birth; the BVN or NIN you sign up with, and the phone number registered on it (our partner bank needs it to open your account); the other one, if you upgrade to Tier 2; the name you sign the indemnity with, if you upgrade to Tier 3. |
| Selfie check | A short selfie video or photo, used once to confirm you're a real person and match the photo on your BVN or NIN, and again if you sign in on a new phone or reset your PIN. |
| Contact details | Your phone number, and your email if you add one. |
| Profile photo | If you add one (it's optional). We shrink it to a small square and remove hidden details such as location and camera information before storing it. You can change or remove it at any time. |
| Address | Your home address (Tier 2), and a photo or PDF of a recent bill or statement as proof (Tier 3). |
| Account and transactions | Your Nod account number, balance, @username, and every transfer: amount, date, fees, the name, bank and account number of the person you pay or who pays you, and any note. Reports you make about a transfer. Payment requests you create from your QR code (amount, note, whether and by whom they were paid). |
| Business profiles | If you add a business: its name, what it does, its logo, and any address, phone, email and TIN you give it. For a registered business, its CAC number and what the CAC register says about it (registered name, type, status, date, address, and its directors and owners), which we use to check you're one of them. Its own transactions and takings. |
| Phone number changes | Your old and new numbers, and, if support changed it for you, how they confirmed it was you and which staff asked for and approved it. |
| Your phone | A random ID for your phone and its name (for example "iPhone 15"), a notification token so we can send you alerts, the app version, and IP addresses and times of sign-ins and other security events. |
| Messages to us | What you tell us when you contact support. |
What stays on your phone
- Face ID and fingerprint are checked by your phone. We never receive your face or fingerprint data. If you turn on Face ID or fingerprint to approve payments, your phone keeps a random payment key that only that phone can use; we store only a scrambled (hashed) copy, and switch it off whenever your PIN changes or you sign in on another phone.
- Scanning an account number or a Nod QR code with the camera, or reading one from a photo, screenshot or your clipboard, happens on your phone. We only receive the number you then choose to send to. We read the clipboard only when you tap to paste.
- Your PIN is never stored in readable form, by you or by us: we keep only a one-way hash of it.
We don't access your contacts, location, or photos you haven't chosen. Nod has no advertising or analytics trackers.
What other Nod users see
When someone looks up your @username to pay you, or you pay each other, they see your first name and last initial (your full name on the transfer and receipt), your @username and your profile photo if you added one. Your QR code, if you share it, shows your name, @username and account number, so people can pay you. Nobody sees your balance, BVN, NIN, phone number or address. A business profile is shown by its business name, logo and @username, with a Verified badge once its CAC registration is checked; its QR poster also shows its account number and your name as the account holder at our partner bank.
Why we use it
- To open and run your account: verify who you are, create your account number, move your money, show your history, send receipts and statements. (Needed to provide the service you asked for.)
- To meet the law: know-your-customer checks, account limits by tier, record keeping, and reporting to regulators and law enforcement under the Money Laundering (Prevention and Prohibition) Act 2022, Central Bank of Nigeria rules and other laws. (Legal obligation.)
- To keep your account safe: device checks, the new-phone selfie, limits after you move to a new phone, fraud monitoring, and security alerts. (Legal obligation and our legitimate interest in preventing fraud.)
- To keep you informed: alerts when money moves, and occasional notices about Nod, such as new features or service updates. You can switch off push notifications and email alerts in the app at any time; security alerts are always sent.
- To support you and to fix and improve Nod.
Who we share it with
Only with the companies that help us run Nod, each for its part of the service and under a contract that protects your data:
| Who | For |
|---|---|
| Rubies Microfinance Bank | Holding your account and money, and sending and receiving transfers (through the NIBSS interbank system). |
| uVerify | Checking your BVN and NIN with the official databases, the selfie check, and looking up a business's CAC number on the CAC register. |
| Other banks and wallets | When you send money, the receiving bank sees your name and the details of the transfer, as with any bank transfer. |
| Hollatags | Sending SMS codes to your phone. |
| SendCore email service | Sending email codes, alerts and statements, and codes on WhatsApp when you ask for one there (run by SendCore Limited; WhatsApp messages are delivered by WhatsApp, part of Meta). |
| Google Firebase Cloud Messaging and Apple Push Notification service | Delivering push notifications to your phone. |
| Cloudflare and DigitalOcean | Hosting our servers and storing documents securely. |
We also share data with regulators, courts and law enforcement when the law requires it, and with professional advisers or a buyer of our business under confidentiality. We never sell your personal data.
Outside Nigeria
Some of these providers process data outside Nigeria. When they do, we rely on the safeguards the Nigeria Data Protection Act allows, such as contractual protections, and only share what each provider needs.
How long we keep it
- While your account is open, we keep your data to run it.
- After you close your account, the law requires us to keep identity and transaction records for at least 5 years. We keep them securely for that period, use them only for legal and regulatory purposes, and then delete or anonymise them.
- Sign-in and email codes expire within minutes. Statement download links work for 24 hours.
How we protect it
- Everything between the app and our servers is encrypted (TLS).
- Your BVN and NIN are encrypted in our database, and your PIN is stored only as a one-way hash.
- Your account works on one phone at a time, and signing in on a new phone needs your PIN and a selfie.
- Documents are stored privately and opened only through short-lived links.
- Only staff who need it can see customer data. They sign in with a password and an authenticator app, and every view and action is logged.
No system is perfectly secure. If a breach affects your data, we'll tell you and the regulator as the law requires.
Your rights
Under the Nigeria Data Protection Act 2023 you can:
- ask for a copy of your personal data;
- have wrong or incomplete data corrected;
- ask us to delete your data (we'll delete what the law doesn't require us to keep);
- object to, or ask us to restrict, some uses of your data;
- receive your data in a portable format;
- withdraw consent where we rely on it, for example for optional notifications.
Email [email protected] from the email on your account, or message us from Help in the app. We'll confirm it's you and reply within 30 days. To close your account and have your data deleted, see Delete your account.
If you're not happy with our answer, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).
Children
Nod is for people aged 18 and over. We don't knowingly open accounts for anyone younger.
Changes to this policy
When we change this policy we'll update the date at the top, and tell you in the app or by email before any important change takes effect.
Contact
Spendo Technology Limited, Lagos, Nigeria. Email [email protected], or WhatsApp +234 906 901 9514.