Privacy Policy

Yael ("Yael", "we") decides how your personal data is used in the Yael app and website, so we are the data controller under the Nigeria Data Protection Act 2023 (NDPA).

Yael is non-custodial: your money is in a wallet you control, and we don't hold it. Anything recorded on the Solana blockchain, such as your wallet address and its transactions, is public by design, and we can't change or delete it.

• Your BVN or NIN, name and date of birth go to our identity partner, Dojah, which checks them against official records.
• Yael does not store your full BVN or NIN. We keep your verification level, the verified name, the last 4 digits, and a one-way fingerprint of the number, so the same number can't unlock a second account.
• ID photos and selfies are sent to Dojah for the check and are not stored by Yael.
• The check is automatic. If you think it got something wrong, contact us and a person will review it.

• Contract — to provide the service you asked for: your account, sync, sending, splitting and borrowing.
• Legal obligation — verification, daily limits, and keeping records the law requires.
• Legitimate interests — keeping Yael secure, preventing fraud and abuse, and fixing problems. We balance these against your rights.
• Consent — push notifications and linking your wallet for deposit alerts. You can withdraw consent at any time in Profile.

We never sell your personal data. We share only what each service needs to do its job for us:

• Privy — login and your embedded wallet.
• Vercel — hosting the app and its servers.
• Upstash — the database for account sync, usernames, verification level and notification settings.
• Dojah — identity verification.
• Paystack — looking up the account name for a bank account you enter.
• Helius and other Solana RPC providers — reading the blockchain, sending your transactions, and watching your linked wallet for deposits.
• Jupiter and Kamino — your wallet address and the amounts involved when you swap or borrow.
• Google, Apple, Mozilla or Expo — delivering push notifications to your device.
• WhatsApp (Meta) — if you contact support there.
• Authorities — when the law requires it, for example a valid court order or a request from a regulator.

Some of these providers store or process data outside Nigeria, for example in the United States or Europe. When that happens we rely on the safeguards the NDPA allows, such as the destination's adequate protection or contract terms that require the provider to protect your data to the NDPA's standard.

• Account sync, username, verification level and fingerprint, linked wallet and notification devices: until you delete your account data, unless the law requires us to keep something longer — if so, we'll tell you what and why.
• Loan monitoring: while you have a loan open through Yael; it stops when the loan is closed or you delete your data.
• Daily limit counters: 3 days. Records that stop an alert being sent twice: 7 days. Prepared-transaction records: 5 minutes. Rate-limit counters: a few hours at most.
• Server logs: kept briefly by our host for security and troubleshooting.
• Data on your device (browser storage): until you use 'Erase data on this device' or clear your browser.

Data is encrypted in transit. Access to our systems is limited to what's needed. We avoid storing sensitive data at all where we can, such as full BVN/NIN numbers and ID photos, and your wallet keys are never held by Yael. No system is perfectly secure; if a breach puts your rights at risk, we'll tell you and the Nigeria Data Protection Commission as the law requires.

Under the NDPA you have the right to:

• know what data we hold about you and get a copy;
• have wrong data corrected;
• have your data deleted — in the app, go to Profile → Delete my account data;
• limit or object to how we use it;
• get your data in a portable format;
• withdraw consent at any time, without affecting what we did before;
• ask for a person to review a decision made automatically, such as a verification result;
• complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

To use any of these rights, contact us through the Support page or at teevincs@useyael.site,. We'll reply within 30 days, and may need to confirm it's you first.

Yael stores your app state (for example your split settings and demo balances) in your browser's local storage so the app loads quickly. Privy uses storage to keep you logged in. We don't use advertising cookies or third-party trackers.

Yael is for adults 18 and over. We don't knowingly collect data from children.

If we change this policy in a way that matters to you, we'll tell you in the app before the change takes effect. The date at the top shows the latest version.