Privacy Policy
What we collect, why, who we share it with, and the rights you have.
Last updated 16 October 2026Faya by Xego (“Faya”, “we”, “us”) is a Nigerian merchant-checkout and payments service that works inside the chat apps people already use — WhatsApp, Instagram, Telegram and TikTok — and on secure web checkout pages. This notice explains what personal data we collect, why we collect it, who we share it with, how long we keep it and the rights you have.
We process personal data in line with the Nigeria Data Protection Act 2023 (NDPA) and its predecessor the Nigeria Data Protection Regulation 2019 (NDPR), and we meet our record-keeping and due-diligence duties under the Money Laundering (Prevention and Prohibition) Act 2022 (MLPPA), the Money Laundering (Prohibition) Act 2004 and the Central Bank of Nigeria (CBN) AML/CFT Regulations.
Data controller: Xego Technologies Limited, RC 9933966, trading as “Faya” — 221b Ikorodu Crescent, Dolphin Estate, Ikoyi, Lagos, Nigeria. Data Protection Officer (DPO): Bisi Oladiran — privacy@myfayago.com General support: support@myfayago.com
1. Scope
This notice covers the Faya payment and messaging service, the merchant dashboard, the customer web flows, the partner API and this website. It does not cover the independent privacy practices of the chat platforms (Meta, TikTok, Telegram), the payment gateway, or any other third party you use to reach us.
2. Summary
- We collect identity, contact, KYC, financial and usage data to run a regulated payment service.
- We use it to provide the service, verify who you are, meet AML/CFT law, prevent fraud and support you.
- We share it only with processors under contract (identity verification, hosting, messaging, payments) and where the law requires.
- We keep transaction and identity records for the statutory AML period, and delete chat and operational data much sooner.
- You can access, correct, export or erase your data, and withdraw consent, by emailing privacy@myfayago.com.
3. Personal data we collect
| Category | Examples |
|---|---|
| Account & identity | Legal name, phone number, email address, date of birth, gender, residential address, account tier. |
| KYC / verification | Government-issued photo ID type and number, BVN and/or NIN verification result, selfie/liveness capture, address proof, verification outcome and reference. |
| Merchant (KYB) | Business name, category and description, CAC registration details, TIN, ultimate beneficial owners, SCUML evidence, operating-location evidence. |
| AML / screening | Sanctions, politically-exposed-person (PEP) and adverse-media screening results, match decisions, risk observations, risk band and score, transaction-monitoring alerts. |
| Financial / transaction | Payments, invoices, invoices items, wallet balances and movements, thrift group contributions and payouts, mobile-data orders, settlements, payouts and refunds. |
| Communications | The content of messages you send us on a chat channel, and attachments you send (images, audio) which are read by our OCR/speech tools to extract text. |
| Device & usage | IP address, device and browser type, browser fingerprint, session and security logs, request identifiers, service-usage events. |
| Consent & preferences | Records of consents you give, and any preferences you set. |
| Support | Correspondence and the details you share when you contact support or raise a dispute. |
We do not store full card numbers. Card details are entered on the payment gateway’s secured fields and never touch our systems.
4. How we collect personal data
- From you — when you onboard, verify your identity, transact, chat with us, or contact support.
- From the chat platforms you use — a WhatsApp phone number, an Instagram-scoped ID, a TikTok
open_id(and account-levelunion_id), or a Telegram account identifier. - From verification and registry providers — identity, BVN/NIN, CAC, TIN and location checks.
- From payment and fulfilment providers — transaction status, settlement and refund outcomes.
- Automatically — device, usage and security data as you use the service.
5. Why we use it and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Open and run your account, process payments, wallets, invoices, thrift and data top-ups | Performance of a contract |
| Verify identity and beneficial ownership (KYC/KYB) and assign risk tiers | Legal obligation (CBN AML/CFT, MLPPA) |
| Sanctions, PEP and adverse-media screening, and ongoing due diligence | Legal obligation |
| Transaction monitoring, fraud prevention and platform security | Legal obligation and legitimate interests |
| Customer and merchant support, disputes and refunds | Performance of a contract; legitimate interests |
| Service, security and error logs, and audit records | Legitimate interests; legal obligation |
| Optional marketing and product updates | Consent (you can withdraw at any time) |
| Analytics to improve the service | Legitimate interests |
Feedback, consent records and our regulatory records let us demonstrate compliance.
6. Who we share it with
We share personal data only as needed, and only with parties bound by contract:
- Identity verification providers (for example Smile ID, Youverify, Dojah or an NIN/BVN provider) for KYC/KYB checks.
- Cloud hosting and database providers that run the platform and store data.
- Observability / security (SIEM) providers that receive logs and alerts.
- Email and support tooling used to reply to you.
- Messaging platforms — Meta (WhatsApp, Instagram), TikTok and Telegram — to deliver and receive messages on the channel you chose.
- Payment and fulfilment providers — for example Interswitch (card and bank-transfer checkout), Interswitch NIP (payouts) and VTPass (mobile data).
- Corporate and tax registries used for merchant checks (CAC, FIRS TIN, location/geocoding).
- AI providers that power image reading (OCR) and speech-to-text for attachments, and any assistant used to understand your request.
- Professional advisers, auditors and regulators where required by law, or where necessary to establish or defend legal claims.
We do not sell your personal data.
7. International transfers
We aim to keep production data in Nigeria (Phase 1 hosting). Where a processor stores or accesses data outside Nigeria, we transfer it only under the NDPA’s cross-border requirements and with contractual safeguards, as recorded in our Data Processing Agreements and Data Inventory / Residency Register.
8. How we protect it
- Encryption in transit (TLS) and encryption at rest (AES-256-GCM) for sensitive fields such as chat payloads and session secrets.
- Session tokens stored only as hashes.
- Two-factor authentication (authenticator apps, passkeys, emailed codes) and role-based access control for staff.
- Rate limiting on public and webhook endpoints.
- An append-only, hash-chained audit log of privileged actions.
- Regular backups with point-in-time recovery, and a documented incident-response plan.
No system is perfectly secure, but we maintain controls proportionate to a regulated payment service.
9. How long we keep it
We keep personal data only as long as necessary, combining our regulatory minimums with data minimisation.
| Data | Retention |
|---|---|
| Chat / message content and webhook logs | About 90 days |
| Sessions and one-time codes | 24 hours (or validity period) |
| Support and dispute records | Up to 3 years |
| Security / audit logs | At least 2 years |
| KYC, identity, screening and transaction / ledger records | Statutory AML period — a minimum of 5 years and up to 7 years |
| Optional marketing data | Until you withdraw consent |
When the retention period ends, records are securely deleted or anonymised, in logged batches. We keep records longer where they are on legal hold for litigation, a dispute, an investigation or a CBN/NFIU examination.
10. Your rights
Under the NDPA/NDPR you can:
- Access a copy of your personal data (we can export it in a machine-readable format).
- Correct data that is inaccurate or incomplete.
- Erase your data (“right to be forgotten”), subject to our legal retention duties.
- Restrict or object to certain processing.
- Port your data in a structured, machine-readable format.
- Withdraw consent at any time for consent-based processing.
- Complain to the Nigeria Data Protection Commission (NDPC) — or, for the NDPR period, NITDA.
To exercise a right, email privacy@myfayago.com from the contact details on your account and tell us what you need. We acknowledge requests promptly and aim to complete them within the statutory timeframe. An erasure request first enters a short cooling-off hold so you can reverse it or so a pending transaction can settle; after that we delete your account data and keep only what AML/CFT law requires. See Data Deletion for how erasure works in practice.
11. Children
The service is for people aged 18 and over. We do not knowingly collect data from children. If we learn we hold a child’s data, we will delete it.
12. Automated processing and profiling
We use automated tools to score risk, monitor transactions and screen against sanctions and watchlists, because the law requires it. These tools can flag an account for review, but a human reviews and decides on alerts, KYC/KYB outcomes and any restriction of service. You can ask us about a decision by contacting us.
13. Cookies
This website uses only what is needed to work and to keep it secure. The payment service uses short-lived capability tokens and secure sessions rather than tracking cookies. Where we add analytics, we will disclose it here.
14. Changes to this notice
We may update this notice as the service or the law changes. We will change the “last updated” date and, for significant changes, tell you through the channel you use.
15. Contact
Questions, requests or complaints:
- Data Protection Officer: privacy@myfayago.com
- Support: support@myfayago.com
- Post: Xego Technologies Limited (Faya), 221b Ikorodu Crescent, Dolphin Estate, Ikoyi, Lagos, Nigeria
- Regulator: Nigeria Data Protection Commission (NDPC)