Privacy Policy

Effective Date: November 2, 2026 · Version 2.4

        Privacy Commitment: WistonPlug ("Company", "We", "Us", or "Our") is dedicated to protecting user privacy and handling digital information with absolute transparency. This Privacy Policy governs the WistonPlug website (https://wistonplug.com) and the WistonPlug Mobile Application ("WistonPlug App") distributed through the Google Play Store and Apple App Store. We strictly comply with the Google Play Developer Policy, the Apple App Store Review Guidelines, the General Data Protection Regulation (GDPR), and applicable international privacy frameworks.
      

1. Information We Collect

We believe in data minimization and only collect information essential for delivering digital VTU telecommunications, utility payments, and virtual verification services securely:

A. Information You Voluntarily Provide

Account Registration Details: Username, valid email address, phone number, and a cryptographically salted & hashed password.
Profile & Verification Information: Optional full name and contact information provided during account customization or customer support requests.
Payment & Billing Metadata: Transaction reference identifiers, payment timestamps, chosen funding channels, and wallet ledger updates. Note: We never process, inspect, or store raw debit/credit card numbers or private cryptographic wallet keys on our servers. All sensitive financial transactions are securely tokenized through PCI-DSS Level 1 compliant gateway partners.
Support Communications: Inquiries, screenshots, transaction references, or attachments submitted to our customer care desk.

B. Information Automatically Collected

Device & Application Diagnostics: Device model, operating system version, unique application instance identifier, language preferences, network carrier, and crash log diagnostics for stability improvement.
Log & Security Data: Internet Protocol (IP) address, access timestamps, HTTP request headers, and session tokens used strictly to safeguard against automated credential stuffing, bot attacks, and fraudulent purchases.

2. Purpose and Legal Basis for Processing

We process your personal information under the following lawful bases and operational purposes:

Purpose	Data Categories	Lawful Basis
Account management & digital wallet operation	Email, username, password hash, wallet balance	Contractual necessity
Fulfillment of VTU airtime, mobile data & virtual line services	Recipient phone number, utility meter number, service code	Contractual performance
Payment verification & deposit confirmation	Transaction hash/reference, amount, payment channel	Legal obligation & contract
Fraud prevention, anti-abuse & system security	IP address, device identifiers, login history	Legitimate interests & safety
Customer support & transaction dispute resolution	Support tickets, messages, order IDs	Contractual necessity

3. Third-Party Service Providers & Data Disclosures

We DO NOT sell, monetize, rent, or lease your personal data to data brokers, advertisers, or any third party under any circumstances.

Data is shared solely with vetted third-party infrastructure providers necessary to fulfill user requests:

Authorized Payment Processors: Monnify, PaymentPoint, NOWPayments, Cryptomus, and Plisio for secure transaction processing under strict PCI-DSS confidentiality.
Telecommunications & Utility Aggregators: Licensed Nigerian telecom carriers (MTN, Airtel, Glo, 9mobile) and regional DISCO electricity distributors strictly to execute top-up requests.
Cloud Infrastructure: Encrypted cloud hosting and CDN services maintaining enterprise-grade ISO 27001 and SOC 2 security certifications.

4. Data Retention Policy

We retain personal information only for as long as your account remains active or as required to comply with statutory accounting, anti-money laundering (AML), and legal audit obligations. Upon account closure, authentication records and non-essential logs are permanently purged from active databases within thirty (30) days.

5. Apple App Store & Google Play Specific Disclosures

Third-Party Tracking: WistonPlug does NOT track users across third-party websites or applications for targeted behavioral advertising. We strictly honor Apple's App Tracking Transparency (ATT) framework and Google Play's Families & Data Safety policies.
Device Permissions: The WistonPlug mobile app requests minimal device permissions (such as network access and optional camera/storage access solely for scanning QR codes or uploading support receipts). Permissions can be modified or revoked at any time in device settings.
Children's Privacy (COPPA & GDPR-K Compliance): Our services are not directed to children under 13 years of age (or 16 in certain jurisdictions). We do not knowingly collect personal information from minors. Accounts identified as belonging to underage individuals are terminated immediately.

6. Security Safeguards

We employ robust administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, loss, misuse, or alteration:

End-to-end transport layer security (TLS 1.3 / HTTPS encryption).
Bcrypt cryptographic password hashing with unique per-user salts.
Multi-factor administrative access restrictions and continuous database intrusion monitoring.

7. Your Privacy Rights & Account Deletion (Google & Apple Requirement)

Under international privacy regulations (including GDPR, CCPA, and NDPR), you possess comprehensive rights over your personal data:

Right of Access: Request a copy of the personal information we hold about you.
Right to Rectification: Request correction of inaccurate or incomplete personal records.
Right to Erasure ("Right to be Forgotten"): Request complete deletion of your personal account and associated data.
Right to Restrict or Object: Object to processing carried out under legitimate interest.

How to Request Immediate Account & Data Deletion

In full compliance with Apple App Store Guideline 5.1.1(v) and Google Play Account Deletion Requirements, you can permanently delete your account and all associated personal data at any time through either of the following methods:

Inside the Mobile App: Open the WistonPlug App → Navigate to Profile → Tap Security & Settings → Select Delete Account. Confirm your request to initiate permanent erasure.
Via Support Request: Email our Data Protection Officer at support@wistonplug.com with the subject line "Data Erasure Request" from your registered email address.

Upon verification, your profile, authentication credentials, and personal records will be permanently expunged within 7 business days, retaining only legally mandated financial audit ledgers.

8. Policy Modifications & Notification

We may update this Privacy Policy periodically to reflect technological advances, service additions, or regulatory updates. When material modifications occur, we will update the "Effective Date" at the top of this document and notify active users via in-app alert or registered email.

9. Contact Our Data Protection Officer

If you have any questions, grievances, or requests regarding this Privacy Policy or our data handling practices, please contact our compliance desk:

Entity: WistonPlug Digital Services
Email: support@wistonplug.com
Website: https://wistonplug.com
Live Support: WistonPlug In-App Help Desk