Privacy notice

In short

The main points

We use your data to run your account and payments, keep them safe, and meet the law. We don't sell your data and we don't use it for advertising.

Public networks are public. Wallet addresses, amounts and transaction references are recorded permanently on public blockchains, and we can't erase them.

The outside AI model is off unless you turn it on.

You can export or delete your data from Profile, and email privacy@evabob.app about any right in section 9.

1. Who we are

Evabob ("we", "us"), the registered business name of the company that operates the service, is the data controller for the personal data described here. That means we decide how and why it is processed. This notice covers the Evabob app, the websites at evabob.app and its subdomains, public payment, receipt, claim and link pages, and our support channels.

We follow the Nigeria Data Protection Act 2023 and the Nigeria Data Protection Commission's General Application and Implementation Directive 2025. Where other data-protection laws apply to you, such as the GDPR in Europe or the UK, you have the rights those laws give you too.

2. What we collect

Kind of data	Examples	Where it comes from
Account	Email address, @username, display name, profile photo, main currency, app settings	You, and our sign-in provider
Wallet and payments	Wallet addresses, balances, payment instructions, amounts, notes, receipts, requests, invoices, held payments, circle and collection membership, transaction references	You, Circle, public blockchains
People you deal with	Names, @usernames, emails or addresses of people you pay, request from, chat with or mark as family	You, and other users
Contacts	Details you pick from your phone's contacts	Your phone, only after you open the contact picker
Messages and evidence	Chat messages and photos, review conversations, links and photos you submit as evidence, support messages	You, and other users
Selling and agents	Links, listings, paywalls, agent wallets, allowances, paid-call records and evidence bundles	You, and software you authorise
Device and security	Sign-in sessions, device and app version, push-notification tokens, IP address, security events such as sign-ins, recovery requests and wrong PINs	Your phone and our systems
Assistant	Questions you ask the Evabob Agent and its replies	You
Technical logs	Error reports, reference codes, request timing	Our systems

What we don't collect: your wallet PIN, private keys or recovery phrases, or your fingerprint or face data. Your phone checks your fingerprint or face, and only the result is used. We don't ask for government ID during the testnet preview.

3. Why we use it, and our lawful basis

Purpose	Lawful basis
Create and run your account, wallet, payments, chats, requests, held payments, links, circles, collections and agent wallets	Performing our contract with you
Let people find and pay you by @username or email, and show your name and photo to people you deal with	Contract
Send sign-in codes, claim emails, reminders, receipts and alerts	Contract
Prevent fraud and abuse: payee checks, look-alike warnings, rate limits, account-recovery checks, security alerts	Legitimate interests (keeping users and the service safe), and legal obligation where it applies
Decide held-payment reviews	Contract, and legitimate interests in resolving disputes fairly
Fix problems and keep the service reliable	Legitimate interests
Send your question to the outside AI model	Your consent, given by turning it on, which you can withdraw at any time
Read contacts you pick from your phone	Your consent, given through the phone's permission
Keep records and respond to lawful requests from authorities	Legal obligation

Where we rely on legitimate interests, we have weighed them against your rights, and you can object (see section 9).

4. Public networks and permanence

Payments run on public blockchains. They permanently record wallet addresses, amounts, times and transaction references, which anyone can see. Evabob can't change or erase blockchain records, including after you delete your account.

We don't put chat text or photo evidence on the network. Held payments carry a random reference, not your words.
A note you add to a payment is written on the network only where the send screen says "anyone can see it, forever". It is then public and permanent.
Your @username is linked to your wallet on the network so people can pay it.
Where enabled, a one-way hash of your email is linked to your wallet so money can be held for you before you join. Anyone who already knows your email can match that hash to your wallet.
When you delete your account, we retire these links so they no longer resolve to you in Evabob, but the history of earlier links and transactions stays visible on the network.

5. The AI assistant

The Evabob Agent answers simple money commands on our own servers. For fuller answers it can use an outside model (DeepSeek), only after you turn on External AI assistant in Profile.

When it's on, each message you send goes to that model with the information needed to answer it. That can include your balance, recent payments, saved contacts, email address and wallet address. Earlier messages in the conversation are not sent. You can turn it off at any time; every wallet and payment feature keeps working.

7. International transfers

Some of our providers process data outside Nigeria, for example in the United States, the European Union or Asia. When that happens, we rely on the grounds the Nigeria Data Protection Act allows. These include adequate protection in the destination country, contractual safeguards with the provider, or where a transfer is needed to perform our contract with you. You can ask us for more detail about the safeguards for a particular provider.

8. How long we keep it

Data	How long
Profile, contacts and chats	While your account is open, then deleted or anonymised after a verified deletion request
Chat photos	Scheduled to expire after 180 days
Review evidence	365 days, longer only while a dispute is active or the law requires it
Account-recovery requests	Until their verification and cooling-off periods end
Push-notification tokens	Removed when you sign out or delete your account
Transaction, fraud-prevention and financial records	As long as the law requires, which may be after your account closes
Backups	Until they expire on our provider's backup cycle
Blockchain records	Permanently, on the public network; we can't delete them

9. Your rights

Under the Nigeria Data Protection Act 2023 you have the right to:

be told how your data is used (this notice);
access your data and get a copy;
have inaccurate data corrected;
have your data deleted, where there's no overriding reason to keep it;
restrict how we use it in some situations;
receive it in a portable, machine-readable format;
object to uses based on our legitimate interests;
withdraw consent at any time, without affecting what we did before;
not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you (see section 10).

How to use them

Profile › Export my data creates a machine-readable copy of your account data.
Profile › Delete account deletes or anonymises your off-chain data and revokes your public receipt links. We also ask our providers to delete data where they support it. Move any money out first.
Change your display name and photo in Profile, and turn off the outside AI model or detailed notification previews there.
For anything else, or to appeal a decision, email privacy@evabob.app. We will reply within one month, or sooner where the law requires, and may need to confirm it's you first.

Exporting and deleting need a recent sign-in, so that someone holding your unlocked phone can't do them. Some records must be kept for legal, fraud-prevention or accounting reasons, and blockchain records can't be deleted.

10. Automated checks

We use automated checks to protect you: payee and look-alike warnings, rate limits, the loop breaker on agent wallets, and blocks on suspicious activity. They can delay or stop an action. They don't make final decisions with legal effect about you. You can ask a person to look at an outcome by emailing support@evabob.app. Held-payment reviews are decided by a person.

11. Security and data breaches

We use encrypted connections, restricted access to private media, short-lived wallet sessions, PIN and device authentication, and logging rules that keep tokens, keys and private links out of our logs. No system is completely secure.

If a personal-data breach is likely to put your rights at risk, we will report it to the Nigeria Data Protection Commission within 72 hours of becoming aware of it. If the risk to you is high, we will tell you without undue delay, in plain language, with steps you can take.

If you think your account is at risk, stop using it and contact support@evabob.app from a device you control.

12. Phone permissions

Camera: to scan QR codes and take photos you choose to send.
Photos: only the pictures you pick.
Contacts: only when you open the contact picker, and only the details you select.
Notifications: for payment alerts. Lock-screen notifications hide names, amounts and messages.
Fingerprint or Face ID: checked by your phone; we never receive the biometric data.

You can change these in your phone's settings at any time. Some features won't work without them.

13. This website

This website doesn't use cookies, analytics or advertising trackers. Our host, like any web server, receives your IP address and basic request details in order to deliver pages. Some background photos load from Unsplash's servers, which also receive your IP address and browser details under Unsplash's own privacy policy.

14. Children

Evabob is only for people aged 18 or over. We don't knowingly collect data from children. If you think a child has an account, tell us at privacy@evabob.app and we will delete it.

15. Changes to this notice

We will update this notice when our practices change, for example before Evabob handles real money. If we make a significant change, we will tell you in the app or by email. The date at the top shows the latest version.

16. Contact and complaints

Privacy questions and requests: privacy@evabob.app
General support: support@evabob.app

If you're unhappy with how we handled your data, please tell us first so we can put it right. You can also complain to the Nigeria Data Protection Commission, or to the data-protection authority where you live.