Privacy Policy
Data controller: OneWeave Technologies Ltd (“Weave”,
“we”)
Registered address: No 27 Araromi Street, Igbobi,
Shomolu, Lagos State
Contact / Data Protection Officer: Emmanuel Adeiza
Oziyusuf — privacy@oneweave.app
Version: 1.0 · Effective date: 17 June
2026
1. Who we are
Weave provides a shared group-account service that lets groups collect, hold, pay, and track money together in Nigeria. Funds are held by our licensed banking/custody partner, not by Weave — we operate the application and the record-keeping. We are the data controller for the personal data described here and process it in line with the Nigeria Data Protection Act 2023 (NDPA) and the NDPR.
2. What data we collect
- Identity & contact: phone number; and, when you verify to move money or hold authority in a group, your BVN-derived details (name, date of birth, gender as returned by the verification partner) and a selfie/liveness check.
- Authentication: a transaction PIN and device/passkey credentials.
- Financial activity: the groups you belong to, contributions, payouts, and transaction history.
- Payout details: bank account details you save to receive money.
- Technical: device identifiers for notifications and sessions, and standard request metadata (e.g., IP, timestamps) used for security and to operate the service.
What we deliberately do not keep: we do not store your raw BVN (only a salted hash and the last four digits), we do not retain your selfie image (it is processed by the licensed KYC partner), and we do not store card numbers. PINs and one-time codes are stored only in hashed form; access tokens only as fingerprints.
3. Why we process it (lawful bases)
| Purpose | Lawful basis (NDPA) |
|---|---|
| Create and operate your account and groups | Performance of a contract |
| Verify your identity (KYC) and prevent fraud | Legal obligation; legitimate interest |
| Move money on your instruction | Performance of a contract; your consent/authorization |
| Security, audit, and reconciliation | Legal obligation; legitimate interest |
| Send you service notifications | Performance of a contract |
We ask for your consent to our terms and this policy at onboarding, and you separately authorize each outbound payment in-app (via your PIN and, where applicable, group approval).
4. Who we share it with (sub-processors)
We share the minimum necessary with vetted providers, each under contractual and data-processing terms:
| Category | Provider(s) | Purpose |
|---|---|---|
| Banking / custody partner | PayRep MFB; Safe Haven MFB | Holding funds; opening and operating accounts; moving money |
| KYC / identity verification | PayRep MFB | Verifying your BVN/NIN and liveness |
| Cloud hosting | Hetzner | Running the service |
| SMS / messaging | Termii | One-time passcodes and alerts |
| Push notifications | Firebase Cloud Messaging | In-app notifications |
| Payment processing | Paystack | Card / collection processing where used |
We do not sell your personal data.
5. Where your data is stored
Your data is hosted in the European Union (Finland). Where we transfer personal data outside Nigeria, we do so under a legal basis permitted by the Nigeria Data Protection Act 2023 — relying on jurisdictions that provide an adequate level of data protection. Data in transit is protected by TLS; data at rest is on encrypted storage.
6. How long we keep it
We keep your data for as long as you have an account and as required afterward to meet legal, regulatory, tax, and fraud-prevention obligations (typically 6 years for financial records under applicable Nigerian law), then delete or anonymize it.
7. Your rights
Under the NDPA you may request access to, correction of, or deletion of your personal data, object to or restrict certain processing, and withdraw consent (where processing relies on it), subject to our legal and regulatory retention obligations. To exercise a right, contact privacy@oneweave.app. You may also complain to the Nigeria Data Protection Commission (NDPC).
8. Security
We protect your data with role-based least-privilege access, multi-factor authentication on administrative systems, encryption in transit and at rest, data minimization, and a policy of never logging sensitive data. See our Information Security Policy for detail.
9. Children
Weave is not directed to persons under 18 and we do not knowingly collect their data.
10. Changes
We may update this policy; we will post the new version with an updated effective date and, for material changes, notify you in-app.
11. Contact
OneWeave Technologies Ltd, No 27 Araromi Street, Igbobi, Shomolu, Lagos State — privacy@oneweave.app.