Privacy policy

Last updated 23 October 2026

This policy explains what personal data Splitverse collects, why, who we share it with and how long we keep it, in line with the Nigeria Data Protection Act 2023 (NDPA). Splitverse is the data controller for the data described here.

What we collect

Account: your email, name and, if you add them, phone number and profile photo.
Identity check: a bank account in your name, confirmed with your bank through our payment partner. We keep the account number encrypted and the name the bank confirmed.
Payments: processed by our licensed payment partner (currently Bachs). If you save a card we keep only a reference to it (brand, last four digits, expiry), never your full card number or PIN.
Bank details for withdrawals and payouts, stored encrypted and shown only to authorised staff.
Activity: your plans, listings, messages with hosts or members, and security records such as sign-ins and the device and IP address used.
Notifications: if you turn on push notifications, a device address from your browser so we can send them, and whether you chose to get offers and news (with the date you chose it).
Usage: anonymous counts of how people use the site (for example which plans are viewed), without advertising trackers.

Why we use it, and on what basis

To run your account, take and hold payments, give access to plans and pay hosts: needed to provide the service you signed up for.
To keep the marketplace safe, verify identities, prevent fraud and review flagged messages: our legitimate interest and legal obligations.
To keep financial and tax records: a legal obligation.
To send offers and news by push notification: only with your consent, which you can withdraw any time in Account → Notification settings.

Who we share it with

Service providers that help us run Splitverse, only with what each needs: our payment partner (payments, payouts and bank account checks; it receives your name, email and, if you added one, phone number), Brevo (email), our hosting and storage providers, and your browser’s push service (Google, Apple, Mozilla or Microsoft) for notifications you turned on. Push messages never contain codes, passwords or account numbers.
Hosts see your first name and the email you chose for the invite. Members see a host’s first name and trust score. Your phone number is only ever seen by Splitverse staff.
Authorities, where the law requires it. We never sell your data.

Where your data is stored

Our servers and database are hosted in the European Union with providers that protect data to a standard comparable to the NDPA, under contracts that require them to keep it secure and use it only for us.

How long we keep it

Payment, billing and payout records: as long as the law requires for financial records (at least six years), even after you close your account.
Account and identity details: while your account is open, and then only as long as needed for those records, open disputes or fraud prevention.
Sign-in codes and signed-out sessions: deleted after 30 days. Records of emails and notifications sent: deleted after 90 days; read in-app notifications after a year.
Payment providers’ messages: personal details removed after six months, keeping only the amount, currency and reference.

Your rights

You can ask to access, correct, download or delete your data, or object to or restrict how it’s used, as the NDPA provides. Email support@usesplitverse.com and we’ll respond within 30 days. Some records must be kept by law even if you ask us to delete them. If you’re unhappy with how we handle your data, you can complain to the Nigeria Data Protection Commission.

Security

Data is encrypted in transit and sensitive data (bank details, shared logins) is encrypted at rest. Staff access is limited by role and protected by two-step verification, important actions are recorded in a tamper-evident audit log, and we back up our database every night, encrypted.

Changes

We’ll update this policy when what we do with data changes, and tell you about important changes by email or in the app.