Privacy Policy
Last Updated: October 13, 2026 • Effective Date: October 13, 2026
1. Our Privacy Commitment
FLIP ("we", "us", or "our") is committed to protecting the privacy, confidentiality, and security of our users' personal and financial data. This Privacy Policy details our data collection, handling, and security practices across useflip.io and app.useflip.io.
We practice strict data minimization: we do not harvest unnecessary information, and we never monetize or sell user data.
2. Data We Collect
We collect information strictly necessary to operate our conversion services and fulfill AML/CFT compliance mandates:
Account Information
Full name, email address, password hashes, and user settings.
Government KYC Records
For Nigerian users: NIN, BVN, and identity verification processed via licensed identity partner QoreID.
Payout Bank Details
Bank institution name, account number, and recipient account name for fiat settlement.
Blockchain & Audit Data
On-chain deposit addresses, transaction hashes, IP addresses, and operational telemetry.
3. PIN Security & Cryptographic Safeguards
FLIP prioritizes rigorous cryptographic safeguards for user credentials:
- No Raw PIN Storage: User transaction PINs are hashed on the client side using SHA-256 before transmission and stored using salted bcrypt algorithms on the server side.
- OTP Required for PIN Updates: Modifying or resetting transaction PINs mandates two-factor verification via time-limited, 6-digit email OTPs.
4. Third-Party Sharing & Settlement Partners
We never sell your data. We share your information only with authorized entities directly involved in processing transactions:
- Banking Settlement Switches: Regulated institutions facilitating automated local fiat disbursements into your bank account.
- Identity Verification Providers: Licensed identity partners (e.g. QoreID) to perform instant biometric and database validation.
- Regulatory Bodies: When strictly compelled by legal process or court order under governing law.
5. Data Retention & User Rights
You have the right to request access to your account data or account closure. In compliance with financial regulations and anti-money laundering legislation, transaction histories and customer identification records are retained for statutory legal retention periods (typically 5 to 7 years).
6. Contact Us
If you have any questions about this Privacy Policy or wish to exercise your data rights:
Privacy & Data Inquiries
[email protected]