Last updated: June 2026
This policy explains how Mystack collects, uses, and protects your personal data, in line with the Nigeria Data Protection Act and NDPR. By using Mystack you consent to the practices described here.
To open and operate your accounts we collect: your name, phone number, email; your BVN and the identity details it returns (legal name, date of birth) for verification; your bank account details for payouts; and a record of your transactions and bucket settings.
We use your data to verify your identity (KYC), open and run your bucket accounts, process payments and withdrawals, prevent fraud and money laundering, provide support, and meet our legal and regulatory obligations.
We never store your raw BVN. We use it once to verify your identity and to open your bank accounts, then keep only a one-way hash. We do not use your BVN to access your existing bank accounts, and it cannot be used to move money from them.
We share the minimum necessary data with: our licensed banking partner (Flutterwave) to provide your accounts and transfers; our identity-verification partner (Prembly) to confirm your BVN; and regulators or law-enforcement where required by law. We do not sell your data.
Data is encrypted in transit, secrets are stored in protected vaults, transaction PINs and BVNs are hashed, and access is restricted. No system is perfectly secure, but we take reasonable measures to protect your information.
You have the right to access your data, correct it, request deletion (subject to legal retention rules), object to certain processing, and withdraw consent. To exercise these rights, contact us.
We keep your data while your account is active and for as long as required by financial-services and anti-money-laundering laws after closure, then delete or anonymise it.
For any privacy request, reach us on WhatsApp at +234 915 307 2571.