Tipany
Terms governing access to and use of the Tipany website, app and payment services
Company
Tipany Technologies Ltd
Effective date
17 September 2026
This Privacy Policy explains how Tipany Technologies Ltd ("Tipany", "we", "us" or "our") collects, uses, stores, shares and protects personal information when you use the Tipany mobile application, the Tipany website, TipEarn profiles, payment and receiving features, customer-support channels and related services (together, the "Services").
Tipany helps eligible users receive payments, present their work or services, manage payment activity and request withdrawals to supported bank accounts. This Policy should be read with Tipany’s Terms of Service and any additional privacy notice presented when information is collected.
For the purposes of the Nigeria Data Protection Act 2023 (the "NDPA") and other applicable data-protection law, Tipany is the data controller where it determines why and how personal information is processed. A service provider may instead act as Tipany’s processor or as an independent controller, depending on its role.
Company: Tipany Technologies Ltd
Jurisdiction: Nigeria
CAC number: RC 8861879
Registered office: Pathfinder's Garden, Ubonukam Onicha, Mbaise, Imo State, Nigeria
Operations address: c/o Memose, 11 Unity Street, Ogudu Orioke, Ogudu, Lagos, Nigeria
Privacy / DPO: privacy@tipany.me
General support: support@tipany.me
You may use these details to ask a privacy question, exercise a data-protection right or make a complaint. Tipany publishes the DPO contact channel above and will update this Policy if those details change.
The information collected depends on how you use Tipany and which features are available. Tipany seeks to collect only information relevant to providing, securing and improving the Services, or information it must process by law.
Account and profile information
Identity and KYC information
QoreID is Tipany’s identity-verification provider. Full BVN or NIN values and selfie/liveness images are sent directly to QoreID and are not stored by Tipany. Tipany briefly holds BVN and date of birth in application memory when passing the details to the wallet provider to open the wallet account, then discards them. Tipany stores the full result of QoreID VeriFind address verification. QoreID may separately process information under its own privacy notice.
Payments and transactions
Tipany does not collect or store payment-card numbers or card-entry fields. Payments are made through virtual Nigerian bank account numbers (NUBANs), including accounts supplied through Xpress Wallet and issued by Providus Bank.
TipEarn and communications
Device and usage information
Tipany uses OneSignal for push notifications, Sentry for error or crash monitoring, and Prometheus, OpenTelemetry and Grafana for service monitoring and observability. Tipany’s technical team has also identified a tool described as “Datahog”; its exact supplier and processing role remain under technical review, so this Policy will be updated if it processes personal information as a third-party service.
Where Tipany relies on legitimate interests, it assesses whether the processing is necessary and proportionate and whether your rights or reasonable expectations override that interest. Consent is voluntary unless the requested information is genuinely necessary for the feature you ask Tipany to provide. Withdrawing consent does not affect processing lawfully completed before withdrawal.
Information you deliberately publish on a TipEarn profile—such as your display name, profile photograph, service description, price, profile link or QR code—may be visible to other users or members of the public. Do not publish information you do not want others to see, copy or share. Tipany may retain limited evidence of removed content where necessary to resolve a dispute or meet a legal obligation.
Tipany does not sell personal information. It discloses information only where reasonably necessary to provide the Services, fulfil a purpose described in this Policy, comply with law or protect users and the Services.
A recipient may act as Tipany’s processor, as a joint controller or as an independent controller depending on the service and applicable law. Tipany requires appropriate contractual, confidentiality and security protections where the recipient acts on Tipany’s behalf. A recipient acting as an independent controller may give you its own privacy notice.
If Tipany is involved in a merger, investment, reorganisation, financing or sale of all or part of its business, personal information may be disclosed to advisers, potential counterparties and a successor subject to confidentiality and appropriate safeguards.
DigitalOcean, OneSignal, Resend, Sentry and other technical providers may process personal information outside Nigeria or permit access from other countries. The destination can depend on the hosting region selected, the provider’s corporate location, its support arrangements and its authorised subprocessors.
Before a transfer outside Nigeria, Tipany will use a mechanism permitted by the NDPA and applicable NDPC requirements, such as an NDPC adequacy decision, an approved certification or code, binding corporate rules, contractual clauses or another legally available exception. Where consent is the required transfer basis, Tipany will ask for explicit consent after giving relevant information about the transfer risk. You may contact privacy@tipany.me for information about the safeguards relevant to your information.
When a retention period expires, Tipany deletes, anonymises or securely isolates the information unless it must be kept for a lawful reason. Account closure does not require immediate deletion of KYC, transaction, accounting, fraud-prevention, dispute or regulatory records that Tipany or a financial-service provider must retain.
You may initiate account deletion in the Tipany app, visit https://tipany.me/delete-account, or email support@tipany.me. Tipany may take reasonable steps to verify that the request is genuine and authorised. Tipany aims to complete deletion or anonymisation within 30 days after verification, except for information that must or may lawfully be retained as described in Section 9.
Information retained after account deletion will be restricted to the lawful retention purpose and will not be used to continue providing an active account or for direct marketing.
Subject to the NDPA and any lawful limitation or exemption, you may have the right to:
To exercise a right, email privacy@tipany.me. Explain the right you wish to exercise and provide enough information to identify your account. Tipany may verify your identity before disclosing or changing information. Requests are generally handled free of charge, but Tipany may charge or decline a manifestly unfounded or excessive request where the law permits. Tipany will respond without undue delay and explain any lawful refusal or extension.
Tipany uses technical and organisational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, disclosure or access. Measures include role-based access controls, authentication, encryption where appropriate, monitoring, secure development practices, data minimisation, incident response and supplier controls. No online service can guarantee absolute security.
If Tipany becomes aware of a personal-data breach, it will assess the likely risk, take reasonable containment and remediation steps, notify the NDPC within the legally required period where notification is required, and notify affected individuals promptly where the breach is likely to create a high risk to their rights and freedoms.
Keep your PIN and authentication credentials confidential. Contact support@tipany.me promptly if you believe your account, phone or credentials have been compromised.
The Tipany website and app may use storage technologies, SDKs or similar tools for core functionality, security, communications, diagnostics, analytics or performance monitoring. Strictly necessary technologies may operate without an opt-in where permitted by law. Tipany will request a specific choice before using non-essential cookies or tracking tools where consent is required, and rejecting non-essential tools will not prevent access to core services.
The production Webflow website is subject to a separate cookie and tracking audit. Tipany will publish a Cookie Notice and a conspicuous consent control identifying each non-essential technology, its purpose, provider and duration before enabling it. Until that control is implemented, non-essential website tracking must remain disabled.
Tipany will seek consent before sending direct marketing where required. You may withdraw consent through the unsubscribe link, communication settings or by emailing privacy@tipany.me. Withdrawing marketing consent does not stop essential transaction, security, legal or service messages.
The Services are for people aged 18 or over. Tipany does not knowingly permit a person under 18 to open an account or provide financial or identity information through the Services. If Tipany learns that it has collected a child’s personal information contrary to this rule, it will suspend the account, investigate and delete or otherwise lawfully handle the information. A parent or guardian may contact privacy@tipany.me.
Tipany uses limited automated security controls. After five incorrect PIN attempts within 15 minutes, all active sessions are ended and the account is locked until the user completes a reset. IP-based rate limiting may temporarily block excessive requests. These controls protect accounts and service availability.
Tipany does not currently use automated fraud scoring or automatically reject transactions on that basis. Wallet freezes and account blocking or disabling require administrator authorisation. If you believe an automated security control has affected you incorrectly, contact support@tipany.me to request assistance and human review.
Before beginning processing likely to create a high risk to individuals—taking account of its nature, scope, context and purpose—Tipany will carry out a Data Privacy Impact Assessment. If the assessment shows a residual high risk that cannot be sufficiently reduced, Tipany will consult the NDPC before starting that processing where required.
Tipany may update this Policy to reflect changes to the Services, technology, providers or law. It will publish the updated version, revise the effective date and give additional notice of material changes where required. Tipany will seek fresh consent if a change introduces processing for which new consent is legally required.
Contact Tipany’s privacy and DPO channel at privacy@tipany.me. You may also write to Tipany Technologies Ltd at c/o Memose, 11 Unity Street, Ogudu Orioke, Ogudu, Lagos, Nigeria.
If you are dissatisfied with Tipany’s response, you may lodge a complaint with the Nigeria Data Protection Commission at https://ndpc.gov.ng. This does not affect any other legal right or remedy.