Privacy Policy

Who we are

Kyma is a mobile app for buying data, airtime and bills in Nigeria. It is a product of XCROBUY TECHNOLOGIES(“XCROBUY TECHNOLOGIES”, “we”, “us”), a business registered in Nigeria.

XCROBUY TECHNOLOGIES is the data controller for the personal data described here. Kyma is the platform through which it is collected. More about the relationship is on our About page.

This policy is written under the Nigeria Data Protection Act 2023 (NDPA). For anything about your data, write to privacy@kyma1.xyz.

What we collect

What you give us

• Your phone number. This is your account. We send a one-time code to it to confirm the number is yours.
• Your first and last name. Collected at signup so the app can greet you and so support can identify you.
• Your email address, if you give one. Optional. Nothing in the app requires it.
• Your PIN. Stored only as a cryptographic hash (argon2id). We cannot read it, and neither can anyone with database access.
• Saved beneficiaries. Any label and number you choose to save, such as “Mum”. You type these in — Kyma never reads your contacts.

What your use of Kyma creates

• Your wallet balance and its full ledger. Every credit and debit, with the balance after it. This record is append-only: we do not edit or delete entries, because it is what proves your balance is correct.
• Your purchases. What you bought, the phone number, meter number or smartcard number it was for, what you paid, when, and whether it succeeded.
• Your funding. Each transfer into your wallet, its amount and status, and the confirmation our payment provider sends us. We keep that confirmation in full so that if a transfer is ever disputed, there is a record to settle it with.
• Your virtual account details — the account number and bank name we generate for you to fund your wallet.

What we do not collect

This list is as much a part of the policy as the one above, and we hold ourselves to it:

• No analytics or tracking. Kyma ships with no analytics SDK, no crash-reporting SDK and no advertising SDK. There is no advertising identifier, no device fingerprint, and no third-party code watching what you tap.
• No contacts. The app never requests access to your address book. Beneficiaries exist only because you typed them in.
• No location. We never ask for it and never receive it.
• No photos, camera or microphone.
• No biometric data. When you unlock Kyma with a fingerprint or your face, your phone performs the check and tells Kyma only yes or no. Your fingerprint and face never leave your device and are never sent to us.

We do not sell your personal data, and we never will. We do not share it for advertising or share it with data brokers.

Why we are allowed to hold it

Under the NDPA, each thing we hold has a lawful basis:

• To perform our contract with you — your phone number, name, PIN hash, wallet, ledger and orders. Without these there is no account and nothing can be delivered.
• To meet legal obligations — transaction and funding records, which financial-services and anti-money-laundering law requires us to retain.
• Our legitimate interests — fraud prevention, resolving disputes, and keeping the service secure and working.
• Your consent — your optional email address, which you can remove at any time.

Who else sees it

We share the minimum each company needs to do its job, and nothing beyond it. Each acts as our processor under contract.

• Our delivery partner. To actually send the data, airtime or bill payment, we pass on the destination number — the phone number, meter number or smartcard number — and the product. We do not send your name, your balance or your other purchases.
• Our payment provider. Handles wallet funding and generates your virtual account. They receive what is needed to open and operate that account and to confirm transfers.
• Our SMS provider. Receives your phone number in order to deliver your one-time login code. Nothing else.
• Our hosting providers. Our database and this website run on managed infrastructure. These providers store data on our behalf and do not use it.
• Authorities, where we are legally required to disclose — for example a valid court order or a regulatory demand.

Some of these providers store or process data outside Nigeria. Where that happens, we rely on the transfer conditions in the NDPA and on contractual protections with the provider.

How long we keep it

• While your account is open: everything above, so the app works and your history is intact.
• After you close your account: we delete your profile, but we keep transaction and funding records for at least five years, because Nigerian anti-money-laundering law requires it. These retained records are locked down and used only to answer a legal or regulatory request.
• Login codes: deleted shortly after they expire. They are stored hashed, never in plain text.

How we protect it

• Your login and transaction PINs are separately hashed with argon2id and are never stored or logged in the clear.
• Your login session is held in your phone's hardware-backed secure storage — the iOS Keychain or the Android Keystore.
• Approving a payment requires a second, short-lived authorisation that is kept only in memory and never written to disk. It expires in minutes.
• Kyma re-locks whenever you leave it. Unlocking uses your six-digit login PIN or biometrics, while paying always needs the separate four-digit transaction PIN.
• The app blocks screenshots and screen recording on sensitive screens, and hides your balance in the app switcher.
• All traffic between the app and our servers is encrypted in transit.

No system is perfectly secure. If a breach ever affects your data, we will notify you and the Nigeria Data Protection Commission as the NDPA requires.

Your rights

Under the NDPA you can ask us to:

• Show you the personal data we hold about you.
• Correct anything wrong — you can change your name and email in the app yourself.
• Delete your account. See the limit on financial records above.
• Give you a copy of your data in a portable format.
• Stop or restrict a particular use, or withdraw consent you gave.

Write to privacy@kyma1.xyz and we will respond within 30 days. Requests are free. If you are not satisfied, you can complain to the Nigeria Data Protection Commission.

Deleting your account

Email privacy@kyma1.xyz from your registered number or email and ask us to close the account. Withdraw or spend any remaining balance first — see the Terms for how unused funds are returned. We will confirm when it is done.

Children

Kyma is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has an account, tell us and we will remove it.

This website

This site is a set of static pages. It sets no cookies, runs no analytics and has no third-party scripts, which is why you were never asked to accept anything.

Changes

If we change this policy we will update the date at the top, and for anything significant we will tell you in the app before it takes effect.

Contact

Privacy questions: privacy@kyma1.xyz
Everything else: support@kyma1.xyz
Registered business: XCROBUY TECHNOLOGIES, Nigeria
Full business information