This Privacy Policy explains how Citylink ("Citylink", "we", "us") collects, uses, stores, shares, and protects personal data when you use the Citylink app and website for wallet, airtime/data, marketplace, and delivery/ride services in Nigeria (the "Service").
This policy is written to describe what Citylink actually does, based on how the Service is built today — not a generic template. It is intended to be read together with our Terms of Service.
/admin/legal-settings. This policy does not claim any certification, license, or regulatory registration that has not been separately confirmed.
Citylink is operated by [company name not yet configured], based at [business address not yet configured]. For any privacy question, see Contact us below.
This policy covers the customer-facing Citylink app (registration, wallet, airtime/data, marketplace, delivery and ride requests, notifications, support). Citylink also operates separate driver and shop-owner ("marketer") interfaces with their own accounts; where this policy discusses drivers or shops, it is limited to what a customer's data-processing activity involves.
We do not collect information from third-party data brokers, and the Service does not currently include any social-login integration (Google/Facebook sign-in) that would bring in data from those platforms.
Citylink is not a bank, deposit-taking institution, or licensed payment service provider. Your in-app wallet is an internal record of funds you have paid in, which can only be spent inside the app (airtime, data, delivery/ride fees, marketplace purchases) — it does not earn interest and is not separately deposit-insured.
Wallet funding is processed by KatPay, our third-party payment processor, which issues you a dedicated virtual bank account number to transfer money into. We keep a record of every transaction (amount, fee, type, status, and a short description) associated with your account for as long as described in section 15.
Citylink allows you to optionally submit identity details — your legal name, date of birth, an ID type (NIN, BVN, driver's licence, voter's card, or passport), and the ID number — to raise your account's trust/verification level. This is self-declared: an admin reviews what you typed for consistency, but Citylink does not currently run an automated check against NIMC, a bank BVN database, or any other government/verification registry. Treat this feature as identity-linking within Citylink, not government-grade identity verification.
If your KYC submission is rejected, we keep a short rejection reason so you can see why. If you delete your account, these fields are permanently cleared as part of the deletion process (see section 16).
Citylink requests access to your device's location only where it's needed to run a delivery/ride:
Location pings tied to a specific trip are stored (driver coordinates, heading, and timestamp) so that trip's route history can be reviewed if there's a dispute or safety report (including SOS alerts). We do not track a customer's location in the background outside of an active delivery/ride request.
Under the Nigeria Data Protection Act 2023 (NDPA), we rely on the following bases depending on the activity:
| Activity | Basis |
|---|---|
| Creating your account, processing transactions you request, delivering the Service you signed up for | Performance of a contract with you |
| Security logging, fraud detection, enforcing rate limits and lockouts | Legitimate interest — keeping the platform and its users safe |
| Optional identity verification (KYC) | Your consent — submitting it is optional |
| Retaining financial/transaction records after a transaction completes | Legal/regulatory obligation and our legitimate interest in accounting and dispute resolution |
| Responding to a legal request from a competent authority | Compliance with a legal obligation |
Where consent is the basis (such as KYC), you may withdraw it at any time — see section 17. Withdrawing consent for optional features does not affect the lawfulness of processing already carried out, or of processing that rests on a different basis (such as your existing transaction history).
We do not sell personal data. We share it only as needed to run the Service:
We do not currently use any third-party analytics, advertising, or tracking service — there is no Google Analytics, ad pixel, or similar tool anywhere in the Service as of the effective date of this policy.
| Provider | Purpose | Data involved |
|---|---|---|
| KatPay | Wallet funding, virtual account issuance, pay-with-transfer payments | Name, email, phone, funding amounts |
| SMEPlug | Airtime and data bundle fulfilment | Phone number, network, amount/plan |
| Email delivery (your own SMTP mailbox, or the Brevo transactional email API — whichever Citylink's administrators have configured) | OTP codes, welcome emails, and privacy/support request alerts | Name, email address, message content |
Citylink's settings also list Monnify and Paystack as gateways it can be configured to use in the future. As of this policy's effective date, no live customer funding has been wired through either — if that changes, this policy and the table above will be updated first.
Citylink does not use cookies for authentication. Instead, after you log in, your device stores a session token and basic profile info (name, phone, email) in your browser's local storage so you stay signed in — this data never leaves your device except when your browser sends the token to our API to authenticate a request. Clearing your browser's site data, or using "sign out", removes it.
We do not use any third-party cookies, tracking pixels, or fingerprinting scripts.
Passwords and wallet PINs are hashed with a strong one-way algorithm (bcrypt) — we cannot see or recover your actual password or PIN, even internally. Repeated failed login or PIN attempts temporarily lock the relevant action to slow down guessing attacks. Registration and password reset are confirmed by a one-time code sent to your email.
We apply reasonable technical and organizational measures appropriate to the sensitivity of the data involved, including: encrypted password/PIN storage, parameterized database queries, per-account and per-IP rate limiting on sensitive actions, admin-only access to internal tools behind a separate authenticated login, and restricting direct access to raw configuration/credential files on our servers.
No system is perfectly secure, and we cannot guarantee absolute security of information transmitted over the internet. If we become aware of a data breach affecting your personal data, we will take reasonable steps to contain it and to notify affected users and, where required by the NDPA, the Nigeria Data Protection Commission (NDPC), without undue delay.
We keep different categories of data for different lengths of time, based on why we needed it in the first place:
| Category | Why we keep it | Operational rule |
|---|---|---|
| Active account profile (name, email, phone, KYC) | To operate your account | For as long as your account remains open |
| Transactions, deliveries/rides, marketplace orders | Accounting accuracy, dispute resolution, fraud investigation, and because deleting them would corrupt other users' and drivers' own transaction history that references the same records | Retained even after an account is deleted, in de-identified form (see section 16) — not tied back to a name, email, or phone once deletion completes |
| Security/authentication logs (login attempts, lockouts, IP/session logs) | Detecting and investigating abuse | Kept for a limited operational window, then may be purged or rotated |
| Support, dispute, and SOS/safety records | Resolving the issue raised and maintaining a safety record | Kept for as long as reasonably needed to resolve the matter and defend against later claims about it |
| Privacy/data-subject requests you file | Keeping a compliance audit trail that we actually responded | Kept as a permanent record of the request and its outcome |
You can request deletion of your Citylink account from Privacy & Data Requests in your Profile. Here's exactly what happens:
Subject to the NDPA and applicable exceptions, you have the right to:
Citylink does not currently have a one-click automated data export tool. Access, correction, objection, and portability requests are logged as a support ticket and fulfilled manually by our team — see below.
Open Privacy & Data Requests from your Profile screen while signed in, choose the type of request, and submit it. You can also email us directly — see Contact us. We aim to acknowledge requests promptly and resolve them without undue delay; complex requests may take longer, in which case we'll tell you why.
We may need to verify your identity (e.g. confirm you're signed in as the account holder) before acting on a request, to avoid disclosing your data to someone impersonating you.
Citylink's database and application servers are hosted with a commercial web hosting provider; some of our service providers (email delivery, payment processing) may process data on infrastructure located outside Nigeria as part of their own operations. Where that happens, we rely on those providers' own security and data-protection commitments. We do not otherwise routinely transfer personal data outside Nigeria.
Citylink is intended for users aged 18 and over — the Service involves a real financial wallet and contractual transactions, which under Nigerian law generally requires legal capacity to contract. We do not knowingly collect personal data from anyone under 18. If you believe a minor has registered an account, please contact us so we can review and, if appropriate, delete it.
We do not currently run marketing email or SMS campaigns. Emails you receive from us are transactional — verification codes, password resets, a welcome message, and (if you file one) an acknowledgement related to a support or privacy request. In-app notifications relate to your own orders, deliveries, and wallet activity. If this changes in the future, marketing messages will come with their own separate, unticked opt-in and an easy way to opt out.
We use account-level and IP-level rate limiting, login/PIN lockouts after repeated failures, and manual admin review of disputes, SOS alerts, and KYC submissions to detect and respond to suspicious activity. We may suspend an account or freeze a wallet while we investigate a suspected fraud or policy violation, consistent with our Terms of Service.
We may update this policy as the Service changes. Material changes will be reflected in a new version number and effective date at the top of this page, and — where you have an existing account — you may be asked to review and re-confirm your acceptance the next time you sign in.
If you're unhappy with how we've handled your personal data, please contact us first using the details below so we can try to resolve it directly. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC), the independent regulator for data protection in Nigeria.
For any privacy question, access/correction/deletion request, or complaint:
Citylink has not yet formally appointed a Data Protection Officer. Until it does, privacy requests are handled by the contact above.