Who is responsible
Nifelux Technologies Limited (RC 9980878), Lagos, Nigeria, is the data controller for personal data processed through SPLUG. We process personal data in line with the Nigeria Data Protection Act 2023 (NDPA) and applicable regulations and guidance issued by the Nigeria Data Protection Commission (NDPC), including the Nigeria Data Protection Regulation (NDPR). Contact us about privacy at contact@nifelux.com.
Data we collect
- Account data: username, email address and password (stored in hashed form by our authentication provider).
- Wallet and payment data: funding amounts, transaction references, status and timestamps. Card or bank details are entered on our payment partner’s page and are not stored by SPLUG.
- Order data: the service and country you select, the number assigned, the price, order status, and the SMS code and message text received for your order.
- Technical data: IP address, browser and device information, and server logs needed to run and secure the Service.
- Support data: the content of messages you send us.
How we use your data
- to create and manage your account and sign you in;
- to process wallet funding, purchases, cancellations and refunds;
- to obtain numbers from suppliers and show you the codes received;
- to provide support and communicate with you about the Service;
- to detect, prevent and investigate fraud, abuse and security incidents;
- to comply with legal, tax and regulatory obligations.
We do not sell your personal data and we do not use it for third-party advertising.
Lawful bases
We rely on: performance of our contract with you (providing the Service); compliance with legal obligations; our legitimate interests in securing and improving the Service and preventing fraud, balanced against your rights; and your consent where we ask for it, which you may withdraw at any time.
Who we share data with
- Hosting and infrastructure: Vercel (website and serverless functions) and Supabase (database and authentication).
- Payments: our licensed payment partner, to process wallet funding.
- Number suppliers: we request numbers using the selected service and country and receive the SMS for your order; we do not send them your name or email.
- Authorities and advisers: where required by law, court order or to protect rights and safety.
These parties may only use the data to provide their services to us.
International transfers
Some of our service providers process data outside Nigeria. Where personal data is transferred outside Nigeria, we take steps required by the NDPA to ensure an adequate level of protection, such as relying on the provider’s contractual commitments and security measures.
Retention
We keep account, order and transaction records for as long as your account is active and afterwards for as long as needed for legal, accounting, dispute-resolution and fraud-prevention purposes. We then delete or anonymise them.
Security
We use encryption in transit (HTTPS), access controls and reputable infrastructure providers to protect your data. No system is completely secure; please use a strong, unique password and keep it private. We will notify affected users and the NDPC of personal data breaches where the law requires.
Your rights
Under the NDPA you may have the right to: be informed; access your personal data; correct inaccurate data; request erasure; restrict or object to processing; data portability; withdraw consent; and not be subject to decisions based solely on automated processing that significantly affect you. To exercise these rights, email contact@nifelux.com from your registered email address. You may also lodge a complaint with the Nigeria Data Protection Commission.
Cookies and local storage
SPLUG stores your sign-in session token in your browser’s local storage so you stay signed in. We do not use advertising cookies. Our pages load fonts from Google Fonts, which means Google receives your IP address when the fonts are requested.
Children
SPLUG is not intended for anyone under 18 and we do not knowingly collect their data.
Changes to this policy
We may update this policy and will post the new version here with a new “Last updated” date.