Privacy Policy

1. Introduction

Rilstack ("we," "us," or "our") is a product of Rick Investments Limited (RC: 1768492), registered in Nigeria. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use Rilstack's budgeting, Safelock savings, and investment services (collectively, the "Service").

2. Information We Collect

2.1 Personal Information

• Full name, email address, phone number, date of birth, and gender
• National Identification Number (NIN) and Bank Verification Number (BVN)
• State of origin and residential address
• Account credentials (encrypted password)

2.2 Financial Information

• Budget categories, income, and expense data you enter
• Safelock vault configurations and savings goals
• Investment portfolio selections and transaction history
• Payment and withdrawal details processed through our payment partners

2.3 Automatically Collected Information

• Device type, browser type, operating system, and IP address
• Usage patterns, session duration, and feature interactions
• Cookies and similar tracking technologies for session management

3. How We Use Your Information

• To create, verify, and maintain your account via BVN/NIN verification
• To provide budgeting, Safelock, and investment features
• To process deposits, withdrawals, and investment transactions
• To detect, prevent, and investigate fraud and unauthorized access
• To comply with applicable Nigerian financial regulations (CBN, SEC, NDIC)
• To communicate service updates, security alerts, and account notifications
• To improve and personalize your experience

4. Legal Basis for Processing

We process your data under the Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Act (NDPA) 2023. Our legal bases include:

• Consent: You consent to data collection when creating an account
• Contractual necessity: Processing required to deliver our Service
• Legal obligation: Compliance with KYC/AML regulations
• Legitimate interest: Fraud prevention and service improvement

5. Data Sharing and Disclosure

We do not sell your personal data. We may share information with:

• Payment processors: Paystack and banking partners for transaction processing
• Identity verification providers: For NIN/BVN validation
• Regulatory authorities: When required by law (CBN, EFCC, SEC, NFIU)
• Service providers: Cloud hosting, analytics, and email services operating under strict data processing agreements

6. Data Security

We implement industry-standard security measures including:

• 256-bit SSL/TLS encryption for all data in transit
• AES-256 encryption for data at rest
• Bcrypt hashing for password storage
• Regular security audits and penetration testing
• Role-based access controls and multi-factor authentication for internal systems

7. Data Retention

We retain your personal data for as long as your account is active. Upon account closure, we retain financial records for a minimum of 6 years as required by Nigerian financial regulations. Non-essential data is deleted within 90 days of account closure.

8. Your Rights

Under the NDPR and NDPA, you have the right to:

• Access your personal data held by us
• Rectify inaccurate or incomplete data
• Request deletion of your data (subject to regulatory retention requirements)
• Restrict or object to certain processing activities
• Data portability — receive your data in a structured, machine-readable format
• Withdraw consent at any time

To exercise these rights, contact us at rickinvestmentslimited@gmail.com.

9. Cookies

We use essential cookies for authentication and session management. We do not use third-party advertising cookies. You can manage cookie preferences through your browser settings.

10. Children's Privacy

Rilstack is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from minors. If we discover that a minor has provided us with personal data, we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes via email or in-app notification at least 30 days before they take effect. Continued use of the Service after changes constitutes acceptance.

12. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices: