Privacy Policy

This Privacy Policy explains how [Legal Entity Name](“Tella,” “tella,” “we,” “us”) collects, uses, shares, and protects personal information when you use our WhatsApp-based money interface and our website at [tella.app](the “Service”). It applies in addition to our Terms of Service.

We follow the Nigeria Data Protection Act 2023 (NDPA) and, where applicable, the GDPR, in our role as a data controller. If you interact with us through WhatsApp, Meta also processes your messages under its own policy.

You give us:

• Account & contact: your WhatsApp phone number, display name, and any name or label you set in chat.
• Identity verification: where required for compliance, your full legal name, date of birth, residential address, BVN/NIN, government ID details and images, and a selfie for liveness check. Collected through our identity-verification partner.
• Transaction instructions:the messages you send us — including amounts, recipient names or addresses, memos, and natural-language phrases like “send him the same as last week.”
• Payment details: bank-account details where you cash out to NGN, and wallet addresses you send to or receive from.
• PIN / authentication: a PIN or other factor you set, stored only as a salted hash.
• Support: anything you tell us when you contact support.

We collect automatically:

• Usage & device data from our confirmation web pages: IP address, approximate location derived from IP, browser and OS, timestamps, and pages visited.
• Transaction metadata: on-chain transaction hashes, block timestamps, balances, and counterparty addresses (public blockchain data).
• Cookies & similar: strictly-necessary cookies on the confirmation flow to secure your session; we do not use advertising cookies.

From third parties: we receive verification outcomes from our KYC provider, settlement data from the Arc network, and messaging metadata (e.g. delivery state) from Meta / WhatsApp and Twilio.

We share personal information only as needed:

• Service providers / processors acting on our instructions, including:
  • Meta Platforms (WhatsApp Business) — messaging delivery.
  • Twilio — messaging infrastructure.
  • Circle — wallet creation, USDC custody, and blockchain settlement.
  • Supabase — application database and authentication infrastructure.
  • [KYC provider, analytics].
• Public blockchains. Wallet addresses and transaction amounts are written to public ledgers that anyone can view. They are not anonymous.
• Regulators, courts, law enforcement where we are legally required to disclose, or to protect rights, safety, or property.
• Successors in a merger, acquisition, or reorganisation — subject to this Policy.

We do not sell your personal information.

Some of our processors operate outside Nigeria (for example, in the United States or the European Union). Where personal data is transferred outside Nigeria, we rely on lawful transfer mechanisms under the NDPA, including adequacy decisions or contractual safeguards with the recipient.

We keep personal information for as long as your account is active and for as long as we are required to keep records under applicable financial-services law — typically at least five years after the end of the relationship or the date of a transaction, whichever is later. We may retain limited records longer where needed to defend legal claims or comply with regulators.

On-chain data we have submitted (transaction hashes, addresses, amounts) cannot be deleted by us — that is a property of public blockchains, not a choice we make.

We use encryption in transit (TLS), encryption at rest for sensitive fields, hashed PINs, scoped database access, audit logging, and short-lived confirmation tokens to reduce the risk of unauthorised access. No system is perfectly secure — keep your WhatsApp account and device protected, and never share your PIN or confirmation link with anyone.

Subject to the NDPA (and, where applicable, the GDPR), you have the right to:

• access the personal information we hold about you;
• have inaccurate or incomplete information corrected;
• request deletion of your personal information, where we are not required to keep it;
• object to or restrict certain processing, including direct marketing;
• request portability of information you provided to us; and
• withdraw consent where we relied on it.

To exercise these rights, message us in chat or email [privacy@yourdomain.com]. For a deletion request specifically, see our Data Deletion page. You can also lodge a complaint with the Nigeria Data Protection Commission (NDPC).

Tella is not intended for anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

We may update this Policy from time to time. If a change is material, we will notify you in-chat or by another reasonable means before it takes effect. The “Last updated” date at the top of this page always reflects the current version.

For privacy questions or to exercise your rights, contact our Data Protection Officer at [privacy@yourdomain.com], or by post at [Registered office address].