Privacy Policy

• We collect what we need to run your account, your pages and your gifts, and to keep money safe.
• We never sell your personal data.
• We do not see your BVN or NIN. Identity checks are done by FinZ and its verification providers, and we only learn the result (your verification level, name, country and date of birth).
• You decide who can see your birthday, your pages and your age. You can change these in Settings.
• You can ask us to access, correct or delete your data at any time.

FinZ Africa Limited ("we") is the data controller for Wrapp. We are registered with the Nigeria Data Protection Commission (NDPC) as a data controller and processor, and handle personal data under the Nigeria Data Protection Act 2023 and other laws that apply to you.

For money and identity, FinZ Africa Limited and its licensed banking and verification partners act under their own legal duties, such as anti-money-laundering rules, and may be controllers of that data in their own right.

Wrapp and FinZ work together, but each holds different parts of your information. FinZ is the identity and money side. It holds your identity documents and official identity numbers (your BVN or NIN), your verification selfies and liveness records, your verified legal name, date of birth and nationality, and your money and banking records: your FinZ wallet, your dedicated Wrapp bank account number, balances, transaction histories and your secure transaction PIN.

Wrapp is the social side. It holds your public profile (display name, handle, bio, picture, country and interests), your celebration pages, guest lists, wishes, voice notes, photos, stories and thank-you messages, and your gift history, fan drops and celebration activity.

Wrapp does not hold your BVN or NIN, never sees your verification selfies, and does not hold your banking passwords. Brand pages are different: to verify a company, Wrapp collects company details and documents, for example its registration number and papers.

You give us some of this, we collect some automatically, and some comes from partners.

Information you give us:

• Account details: name, username, phone number and/or email, country and region, profile photo and bio, interests, and your date of birth.
• Your content: celebration pages, wishes, voice notes, photos, thank-you notes and messages you send through Wrapp.
• For the waitlist: your name, email, the username you want, the kind of celebration you plan, your business name (for brands) and optionally your WhatsApp number.
• Payment details you give guests or checkout partners: your name and email or phone for receipts. Card details go straight to the payment processor; we never see or store full card numbers.
• If you choose to sync contacts: phone numbers from your address book or Google contacts, used once to find friends already on Wrapp and not stored (see section 7).
• Messages to support and anything you tell us in surveys or reports.

Information we collect automatically:

• Device and usage information: browser and device type, language, time zone, approximate location from your network address, and how you use Wrapp (pages viewed, features used, errors).
• Security signals: network address, device and sign-in events, used to prevent fraud and abuse.
• Push notification details, if you turn them on (a token from your browser that lets us send notifications).

Information from partners:

• FinZ and its verification providers: that you verified your identity, your verification level, your legal name, verified date of birth, and verified nationality.
• Payment partners: whether a payment succeeded, its amount, and the payer details needed for receipts and refunds.

• To create and run your account and pages, show wishes and gifts to the right people, and send you what you ask for. (Contract.)
• To take and settle gifts, and to keep money safe and follow the law: fraud prevention, sanctions and anti-money-laundering checks, record keeping. (Legal obligation and legitimate interests.)
• To create your birthday page and remind friends who asked to be reminded. (Contract and your choices.)
• To check content for abuse and enforce our rules, using automated tools and people. (Legitimate interests.)
• To send you notices about your account, activity and money; sign-in codes; and, if you chose, reminders and updates. (Contract, consent where required.)
• To understand how Wrapp is used, fix problems and improve it. (Legitimate interests.)
• To tell you when Wrapp opens if you reserved a username. (Consent.)
• To meet legal requests and protect our rights. (Legal obligation and legitimate interests.)

• Your public profile shows your name, username, photo, bio, region and country, follower counts and the pages you made public.
• Your birthday is shown as a day and month only, to the people you allow (everyone, people you follow back, or only you). The year of birth is shown only if you choose to show your age.
• Wishes you post are visible to the celebrant and, if the celebrant approves them, on the page. You can post anonymously, but we still know who you are.
• Gifts: the celebrant sees who sent a gift unless the sender chose to stay anonymous. Leaderboards show a display name, never contact details.
• Websites and social usernames are shown only for verified creators and brands.

We share data only with the people who need it to run Wrapp, under contracts that require them to protect it:

• FinZ and its licensed banking partners, for accounts, identity verification, payments and payouts.
• Payment processors for card and bank-transfer gifts.
• Identity verification providers (through FinZ), to confirm who you are.
• Hosting, content delivery, security, email, messaging (including WhatsApp and SMS for sign-in codes) and push providers.
• Analytics and error-monitoring providers (Google Analytics and PostHog, only if you allow analytics; Sentry for error reports).
• Providers that help us check wishes, photos and voice notes for abuse and turn voice notes into text. For example, OpenAI's moderation service reads the text or photo of a wish to flag harmful content. It receives only that text or photo, with no name or contact details.
• Gift card partners, if you send or receive a gift card.
• Professional advisers, auditors and insurers.
• Authorities, regulators and courts, where the law requires or to protect people and our rights.
• A buyer or investor, if Wrapp's business is reorganised or sold (we will tell you and your rights continue).

What Wrapp sends to FinZ: your verified phone number, your email address (if you gave one) and your legal name when you open a Wrapp account; the 4-digit PIN you choose for your Wrapp account, which goes straight to FinZ and which Wrapp does not keep (FinZ stores it scrambled so no one can read it); and, when you send a gift, spend from your balance or withdraw, the amount, a reference and your PIN authorisation. FinZ needs this to set up or connect your customer account, issue your dedicated bank account number, process payments safely and follow anti-money-laundering laws.

What FinZ sends to Wrapp: whether your identity check passed, your verification level, your verified legal name, date of birth and nationality (Wrapp uses these to lock your name and birthday to prevent fraud and to unlock gifting); your dedicated Wrapp bank account number, the partner bank's name and your available balance; updates when a deposit arrives or a payout succeeds or fails; and security notices, for example if your connection changes or an account closure has started.

What is never shared: FinZ never gives Wrapp your raw BVN, your NIN or your identity selfie photos. Wrapp never gives FinZ your private drafts, hidden wishes or what you browse on Wrapp.

The main partners and what each does: Dojah, through FinZ, checks your BVN or NIN against official databases and checks your selfie and liveness to prevent impersonation. Payrep Microfinance Bank and Bloc Microfinance Bank are our licensed banking partners: they issue dedicated bank account numbers, hold deposits and route bank transfers. Flutterwave processes card and other online payments on its own payment page, and also supports bank-transfer collection if a banking partner is unavailable. Meta (WhatsApp) and Termii (SMS) deliver one-time sign-in codes and security alerts. Each receives only what it needs for its job.

We do not sell your personal data and we do not share it for third-party advertising.

You can use Google with Wrapp in two optional ways. This section explains exactly what we receive from Google and what we do with it.

• Sign in with Google: we receive your name, email address and profile photo. We use them only to create your Wrapp account, sign you in and fill in your profile, which you can edit.
• Sync Google contacts (read-only): if you choose it, your browser reads the names and phone numbers in your Google contacts. Names stay on your device. Only the phone numbers are sent to Wrapp, once, to check which of your contacts already use Wrapp so you can follow or invite them. We do not store your contact list after that check, and we never message your contacts.

We do not sell Google user data, use it for advertising, use it to train AI or machine-learning models, or let people read it, except where you ask us to, where it is needed for security or to investigate abuse, or where the law requires it.

We share Google user data only with the service providers that run Wrapp for us (hosting and email), under contract and only to provide Wrapp to you.

You can stop at any time: remove Wrapp's access in your Google Account at myaccount.google.com/permissions, and delete your Wrapp account in Settings > Security, which deletes the profile details we received from Google.

Wrapp's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Regulated financial and identity records are held in Nigeria. Other parts of Wrapp, such as images, voice notes and the website, are delivered through a global network, and some of our providers are outside Nigeria. When we transfer personal data abroad, we do it only where the law allows and with safeguards, such as contracts and security measures, to protect it.

• Account and profile data: for as long as you have an account. When you close it, it is switched off and hidden at once and you have 60 days to change your mind. On day 60 your personal details (name, handle, email, phone number, bio, picture and links), photos, voice notes and celebration pages are removed or anonymised, unless we must keep them. A Wrapp profile that was never identity-verified is erased completely.
• While an account is closing, we keep your phone number and email address on file so nobody else can claim them or take over the account.
• Your content: until you delete it or close your account. Copies in backups are removed on a rolling schedule.
• Payment and identity records: identity verification records and BVN or NIN lookups, bank account records, ledger entries, deposit logs and payout histories are kept by FinZ for the period the law requires, which can be several years after the transaction or after you close your account. They are kept in a restricted archive that only authorised staff handling legal compliance, fraud investigations or regulatory audits can open, are never used for marketing, profiling or product features, and are deleted when the period ends. Audit records of compliance actions are kept with personal details removed.
• Waitlist reservations: until launch and afterwards while your reserved username is held for you; unconfirmed website reservations are removed after 30 minutes.
• Security and abuse records: as long as needed to protect Wrapp and others.

Under the Nigeria Data Protection Act and other laws that apply to you, you can:

• ask for a copy of your personal data and how it is used;
• correct data that is wrong or incomplete (some data, such as your verified date of birth, can only change through verification);
• ask us to delete your data, subject to what we must keep by law;
• object to, or ask us to restrict, some uses, including processing based on our legitimate interests;
• withdraw consent where we rely on it, for example for push notifications or contact sync;
• receive your data in a portable form;
• not be subject to a decision made only by automated means that significantly affects you, and ask for a person to review one.

In Settings > Security you can download a copy of your data and delete your account yourself. When you delete, we ask why; that answer is stored without your name or any way to link it back to you. Your money balance must be zero first: withdraw or transfer anything in your Wrapp account or FinZ wallet before you delete. Once you confirm, your account is switched off and your profile, celebrations, wishes and posts are hidden at once; you can restore it for 60 days by signing in again, and on day 60 your personal details are removed (see section 9). If someone sends money to your closed Wrapp account number, it goes to your FinZ wallet while your FinZ account is open, or is returned to the sender if your FinZ account is closed too. Records of money that moved through Wrapp are kept for the period the law requires, with your name and contact details taken off. You can manage most other choices in Settings (privacy, notifications, profile) or by contacting us. We will reply within a reasonable time, and may need to confirm who you are first.

If you are unhappy with how we handled your data, please tell us. You can also complain to the Nigeria Data Protection Commission, or the data protection authority where you live.

Wrapp is for people aged 13 and over. We do not knowingly collect data from younger children, and we remove it if we learn we have. People under 18 cannot receive money or verify an identity. We do not support birthday pages for children created by a parent.

We use encryption in transit, restricted access, separate handling of financial and identity data, rate limiting and abuse monitoring. We never store your PIN or card numbers. No system is perfectly secure, so please use a strong sign-in method, keep your devices safe, and tell us quickly if you notice anything wrong.

If a data breach is likely to put you at risk, we will tell you and the regulator as the law requires.

You can choose which notifications you get, and by which channel, in Settings. Money and account notices are always sent because they are a record of your account. We do not use WhatsApp or SMS for marketing. You can unsubscribe from marketing email at any time using the link in it.

We send marketing emails or promotional messages only if you give separate, explicit consent. Opening or using a Wrapp account never adds you to FinZ marketing campaigns, product newsletters or Melody chat promotions; accounts created through Wrapp are left out of FinZ marketing audiences by default. Service messages still reach you: sign-in codes, security alerts (for example a new device, or your Wrapp account connecting to FinZ), receipts, and notices if your account is closing. FinZ may send promotions on WhatsApp only to customers who opted in, every such message has a "Stop promotions" option, and a person who stops is never opted back in.

We will update this policy when how we handle data changes, and show the date at the top. If a change matters, we will tell you in the app or by email.

To use your rights or ask a question, contact us using the details at the bottom of this page.