Privacy Policy

This Privacy Policy explains what information OTPBox ("we", "us") collects when you use our service, why we collect it, and how it's handled. OTPBox is operated by a business registered in Nigeria. We built OTPBox for people in Nigeria and handle your data in line with the Nigeria Data Protection Act (NDPA) 2023.

1. Information We Collect

• Account information: your name and email address, provided at signup (or by Google, if you sign up with Google).
• Transaction data: your wallet balance, top-ups, purchases, and the phone numbers and codes associated with them.
• Payment information: we never see or store your full card details — payments are processed directly by our payment processor. We only receive confirmation that a payment succeeded and its amount.
• Support communications: messages you send us via email.
• Technical data: basic device/browser information and IP address, collected automatically for security and fraud prevention.

2. How We Use It

• To create and manage your account and wallet;
• To process purchases, refunds, and top-ups;
• To deliver OTP codes to you and provide customer support;
• To detect and prevent fraud or abuse of the service;
• To meet our legal and regulatory obligations.

3. Who We Share It With

We share the minimum data necessary with the providers that make the service work:

• Our virtual number provider, to purchase and manage numbers on your behalf;
• Our payment processor(s), to process wallet top-ups;
• Our database and hosting providers, who store and run the application;
• Our email provider, to send account and transactional emails.

We do not sell your personal information to anyone, for any reason.

4. Data Retention

We keep account and transaction data for as long as your account is active, and for a reasonable period afterward where needed for legal, tax, or fraud-prevention purposes.

5. Your Rights & Data Deletion

Under the NDPA you can ask us to access, correct, or delete your personal data. To request deletion of your account and associated personal data, email otpboxofficial.support@gmail.com with the subject “Data deletion request” from the email address on your account. We'll action verified requests within 30 days.

We may retain a minimal record of transactions where we're legally required to (for example, tax and fraud-prevention obligations), but this will no longer be linked to an active account.

6. Security

We use industry-standard measures to protect your data, including encrypted connections, restricted database access, and never storing raw card details on our own systems.

7. Cookies

We use only strictly necessary cookies (to sign you in securely and keep the site working) — no advertising or tracking cookies. See our Cookie Policy for details.

8. Children

OTPBox is intended only for adults aged 18 and over. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us data, contact us and we will delete it.

9. Changes to This Policy

We may update this policy as the service changes. We'll update the date at the top when we do.

10. Contact

Questions about your data? Email us at otpboxofficial.support@gmail.com.