Privacy Policy

1. Introduction

Stack Technology Limited ("we", "us", "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use the StackApi Developer Platform.

2. Information We Collect

Account information

When you register, we collect: full name, email address, company name (optional), hashed password. We never store plaintext passwords, all passwords are hashed with bcrypt.

API usage data

We log: API request method, endpoint, HTTP status code, response latency, and client IP address. This is used for debugging and usage analytics displayed in your dashboard.

Transactional data

Data submitted through our APIs (phone numbers, email addresses, meter and smartcard numbers, BVN, NIN and other identity numbers) is processed to perform the request and logged for your account's audit trail. Identity numbers are masked in your verification history; the full record is returned only in the response to the original check.

Verification data

When you call a verification, background check or compliance API, we process the identity details you send (for example names, date of birth, identity numbers, document images and selfies) and the record returned by the official registry or data source. Photos and signatures returned by a registry are not stored. You are responsible for obtaining your end user's consent before you submit their data, as required by the Nigeria Data Protection Act 2023.

3. How We Use Your Information

• To provide and maintain the Service
• To authenticate API requests and prevent abuse
• To display usage analytics in your dashboard
• To send service-critical emails (account verification, security alerts)
• To improve platform reliability and performance
• To comply with legal obligations under Nigerian law

4. API Keys

Secret keys are stored only as keyed hashes (HMAC-SHA256). The plaintext secret key is shown only once at creation and cannot be recovered. We recommend storing keys in environment variables or a secrets manager. A revoked key stops working immediately and cannot be re-activated; a deleted key is also removed from your dashboard, while its past request logs stay in your account history.

5. Third-Party Providers

To perform a request we pass only the data it needs to the following processors, each bound by its own privacy policy and by Nigerian data protection law:

• Prembly (Identitypass). Identity, business and document verification (Nigeria), our primary verification processor
• Dojah. Identity verification (Nigeria), used when the primary processor cannot answer
• Termii, KudiSMS and BulkSMSNigeria. SMS delivery (Nigeria)
• Paystack and Flutterwave. Payment processing (Nigeria and Africa)
• VTpass and Paybeta. Airtime, data and bill payments (Nigeria)

We do not sell personal data, and processors may not use it for their own purposes.

6. Data Security

We implement industry-standard security practices:

• All data in transit is encrypted via TLS 1.2+
• Passwords hashed with bcrypt (cost factor 12)
• Secret keys stored only as keyed hashes (HMAC-SHA256)
• JWT tokens expire after 30 days
• Rate limiting prevents brute-force attacks
• Generic error messages, no internal details exposed to clients
• Every webhook we send is signed with HMAC-SHA256 so you can verify it came from us

7. Data Retention

Account data is retained while your account is active. API request logs are retained for 90 days. Verification and transaction records are kept for as long as Nigerian law requires us to keep them. You can delete your account yourself in Settings, Security: deletion is immediate and removes your keys, sessions, team, request logs, verification documents and saved provider connections. Payment, wallet and billing records are kept for five years without your name or email, as the Money Laundering (Prevention and Prohibition) Act 2022 requires. An account cannot be deleted while it holds a wallet balance, owes a balance, has other team members or has payments, bills, escrows or payouts still in progress. You can also ask us to delete your account by writing to [email protected].

8. Your Rights (NDPA 2023)

Under the Nigeria Data Protection Act 2023, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to certain processing of your data
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC)

9. Cookies

The StackApi dashboard does not use tracking cookies. We use localStorage only to persist your authentication token and environment preference on your device. No third-party analytics or advertising cookies are used.

10. Contact

For privacy-related requests or questions, contact our Data Protection Officer at [email protected] or write to: Stack Technology Limited, Port Harcourt, Rivers State, Nigeria. For commercial questions, write to [email protected].