Your data & security matter.

Privacy at JOYET

JOYET is a consumer digital wallet and everyday value platform engineered and operated by Apaxaa Technologies LTD. JOYET bridges digital currencies (USDT, USDC, BTC, and ETH) with instantaneous Nigerian Naira utility bill settlements, peer-to-peer transfers, and banking rails.

Because JOYET manages real monetary value, identity verification, and financial transactions, we treat data privacy and cryptographic protection as fundamental engineering requirements rather than optional features. We practice strict data minimization, client-side cryptographic hashing for sensitive PINs, and total isolation of raw credentials.

This Privacy Policy sets out our data collection practices, security standards, retention policies, and your rights in full compliance with the Nigeria Data Protection Act (NDPA) and applicable financial compliance frameworks.

Information we collect

To provide instantaneous settlement, prevent financial fraud, and comply with mandatory financial regulations, JOYET collects specific categories of data based on your tier and usage:

1. Profile and account credentials

• Your full legal name, unique @username handle, email address, and verified phone number.
• Salted and hashed password credentials used to authenticate your session.
• Your in-app notification preferences and customer support correspondence.

2. Cryptographic transaction PIN & biometrics

• Transaction PIN: Your 4-digit PIN is processed client-side through 310,000 iterations of PBKDF2-SHA256 with a unique cryptographic salt. JOYET never stores, transmits, or possesses your plaintext transaction PIN.
• Biometric Data: If enabled, Touch ID, Face ID, or Android BiometricPrompt authentication operates exclusively within your device's local hardware enclave (Secure Enclave / Android Keystore). JOYET servers never receive, process, or store your raw biometric markers.

3. Regulatory identity verification (Tiered KYC)

• Tier 1: Verified phone number and email address for entry-level limits.
• Tier 2: National Identification Number (NIN) or Bank Verification Number (BVN) to verify legal name, date of birth, and identity against national verification registries. Note: JOYET uses BVN strictly for identity matching and never gains access to your external bank balances or history.
• Tier 3: Government-issued identity document (National ID card, Driver's License, or International Passport), proof of address, and liveness facial verification selfie to unlock high-volume limits.

4. Wallet and transaction records

• Dedicated digital currency deposit addresses generated for your wallet (USDT, USDC, BTC, ETH) and on-chain transaction hashes.
• Real-time Naira wallet balance, automated conversion ledgers, and transaction timestamps.
• Peer-to-peer transfers made via @username, payment request references, and user remarks.
• Utility payment parameters: Electricity meter numbers, Cable TV smartcard numbers, telecom phone numbers, betting account IDs, and exam voucher references.
• Outbound withdrawal destinations: Bank name, bank account number, and verified recipient account name.

5. Device information & active session tracking

To secure your funds against unauthorized device logins, our device management service records your device model, operating system version, mobile app build, IP address, device identifier, and active session tokens. This powers your in-app Active Sessions dashboard, enabling you to inspect and remotely sign out of any device.

How we use information

We process your data strictly for legitimate operational, security, and compliance purposes:

• Executing Instant Services: Detecting incoming crypto deposits, executing automated Naira conversions at live rates, validating electricity meter numbers, vending prepaid tokens, and processing instant bank transfers.
• Account Defense & Anti-Fraud: Enforcing our mandatory 24-hour transfer hold following a PIN reset, monitoring rapid withdrawal spikes, detecting concurrent unrecognized device sessions, and preventing unauthorized account takeovers.
• Legal & Regulatory Compliance: Satisfying Anti-Money Laundering (AML), Counter-Terrorism Financing (CFT), and Know Your Customer (KYC) statutory reporting standards under Nigerian fintech regulations.
• Auditability & Disputes: Generating transparent cryptographic transaction receipts, verifying failed bill vending statuses with utility providers, and facilitating refund reversals.
• Customer Support: Assisting you through our in-app AI support assistant and human escalation teams regarding account questions or transaction inquiries.

Information sharing & third parties

JOYET does not sell, rent, or trade your personal data to marketing brokers or third-party advertisers. We disclose information only to vetted, licensed partners strictly necessary to fulfill your requested transactions:

Regulated liquidity & banking rails

To convert digital assets into Naira and disburse funds to commercial banks, transaction amounts and destination bank account details are securely communicated to licensed financial and liquidity partners.

Utility aggregators & infrastructure billers

When you vend electricity, subscribe to cable television, buy data, or fund betting accounts, essential identifiers (meter number, smartcard number, telephone number, customer ID) are transmitted to the relevant utility operators (e.g., Nigerian Electricity Distribution Companies, Telcos, Multichoice) to validate account ownership and credit the value.

Accredited identity verification partners

For Tier 2 and Tier 3 identity verification, your NIN, BVN, or government ID documents are encrypted and transmitted to licensed verification agencies solely to confirm regulatory database matches.

Law enforcement & regulatory authorities

We may disclose records when legally mandated by a valid subpoena, court order, or official request from competent financial regulators or law enforcement bodies investigating fraud, cybercrime, or financial offenses.

Security & cryptographic safeguards

JOYET employs defense-in-depth security architecture designed to prevent unauthorized balance access, credential theft, and systemic compromise:

• 310,000 PBKDF2 Iterations: Every transaction PIN is hashed client-side before any debit authorization. Even in the hypothetical event of a database compromise, brute-forcing your PIN is computationally prohibitive.
• 24-Hour PIN Reset Hold: Any request to reset a transaction PIN triggers an automated 24-hour security quarantine during which outward transfers and withdrawals are frozen, giving legitimate account owners time to intervene.
• Active Session Management: Real-time session monitoring lets you view every active login with IP address and device model, with single-tap remote kill switches for any unrecognized session.
• Encryption in Transit & at Rest: All traffic between the JOYET client and our cloud infrastructure is protected by TLS 1.3 encryption. Internal databases utilize Row-Level Security (RLS) to enforce isolated data boundaries.

Cookies and local device storage

Our website uses limited cookies and browser storage technologies to maintain secure sessions, remember theme preferences, and monitor anonymous site uptime.

Mobile app local storage

Within the JOYET mobile application, we do not utilize browser tracking cookies. Instead, encrypted session tokens and authentication preferences are stored securely using platform-native hardware enclaves (iOS Keychain and Android EncryptedSharedPreferences).

For detailed information on web cookie categories and consent controls, review our Cookie Policy.

Data retention & account deletion

We retain your personal and financial information for as long as your JOYET account remains active and as required by governing laws.

Because JOYET provides regulated financial settlement, anti-money laundering regulations mandate that transaction ledgers, billing receipts, and identity verification records be retained for statutory minimum audit periods (typically five to seven years) even after an account is closed.

Non-financial telemetry and expired session logs are automatically purged on rolling schedules. If you request account closure, your profile is permanently deactivated, and active credentials are removed from our login directories.

Your privacy choices and rights

Under the Nigeria Data Protection Act (NDPA) and applicable data protection regulations, you hold recognized statutory rights regarding your personal information:

• Right of Access: Request a complete summary of your personal information and transaction history.
• Right to Rectification: Request correction of outdated or inaccurate legal details in your profile.
• Right to Erasure: Request deletion of your personal data, subject to mandatory statutory financial record-keeping laws.
• Right to Restriction: Request limitation of data processing under disputed circumstances.
• Right to Object: Object to any non-essential processing or marketing communications at any time.
• Right to Data Portability: Request your transaction logs in a standard, machine-readable format.

To exercise any of these rights, contact our Data Protection Team at privacy@joyet.site. We respond to verified requests within statutory timeframes.

Age eligibility & minors

JOYET is strictly designed and legally restricted to individuals aged 18 and above who possess the legal capacity to operate financial accounts under applicable law.

We do not knowingly collect personal or biometric information from individuals under 18 years of age. If we discover that an account has been registered by a minor, the account will be immediately terminated and its credentials purged.

Cross-border data processing

JOYET operates on resilient, globally distributed cloud infrastructure. While our primary market operations and banking integrations are centered in Nigeria, encrypted application data and transaction records may be hosted on secure cloud nodes located in other international jurisdictions.

Where cross-border transfers occur, we implement industry-standard contractual safeguards and encryption protocols ensuring your data receives equivalent protection under the Nigeria Data Protection Act.

Changes to this policy

We may periodically update this Privacy Policy to reflect enhancements in our mobile architecture, new utility integrations, or shifts in regulatory requirements.

When significant modifications occur, we will notify you through in-app notices, email alerts, or prominent updates on this website. Continued use of JOYET following notice constitutes acceptance of the amended policy.

Data Controller & Contact

If you have questions regarding this Privacy Policy, your personal data, or wish to file a data inquiry, reach out directly to our dedicated compliance office: