Last updated: July 2026
Important: This Privacy Policy is provided for transparency about how Xtrapay handles information. It is not legal advice. Businesses should obtain independent counsel regarding their own compliance obligations (including Nigeria Data Protection Act requirements where applicable).
This Privacy Policy describes how Xtrapay ("we", "us", "our") processes personal data in connection with services offered through xta.xta.check-outnow.com and related applications (the "Services").
This Policy applies to visitors, registered merchants, consumers using wallet features, developer partners, and individuals whose data is processed because they pay a merchant using Xtrapay.
It should be read with our Terms and Conditions and Security page.
Xtrapay Ltd (trading as Xtrapay and Xtrapay) provides payment and business tools for organisations operating in Nigeria. For WhatsApp Wallet, Xtrapay app login, and related consumer services, Xtrapay Ltd is the data controller for personal data we process, including personal data we receive from Meta platforms through the WhatsApp Cloud API.
Certain regulated payment, settlement, and safeguarding functions are delivered in cooperation with MetroOven Innovations, operating within applicable Central Bank of Nigeria (CBN) and Nigeria Deposit Insurance Corporation (NDIC) frameworks as relevant to its licence and role.
For privacy requests, use the contact methods at the end of this Policy.
You acknowledge that operational details, thresholds, and enablement criteria may vary by account type, verification status, and product module without prior notice where permitted by law.
Merchants are businesses that accept payments through the platform. Consumers may use wallet or checkout experiences. Developer partners are integrators participating in our developer program where offered. Each role may involve different categories of data.
Depending on your relationship with us, we may process identifiers, contact details, financial and transaction information, device and log data, communications, and documents submitted for verification.
We collect what is reasonably necessary—we do not maintain a public inventory of every internal database field.
Business registration may include legal name, trading name, address, phone, email, tax or registration identifiers, website URLs, and user accounts for staff.
We may record login timestamps, IP addresses, and security events associated with accounts.
When payments are created or received, we process amounts, currency, references, status, timestamps, payer-provided information where applicable, and records needed for reconciliation, settlement, fees, refunds, and disputes.
We do not describe internal matching or reconciliation mechanics on this page.
We may collect identity documents, photographs, proof of address, beneficial ownership information, and results of verification checks conducted directly or through authorised verification providers.
Failure to complete required verification may limit features.
You acknowledge that operational details, thresholds, and enablement criteria may vary by account type, verification status, and product module without prior notice where permitted by law.
Use of invoices, tickets, memberships, rentals, collections, charity pages, marketplace listings, or lending features (where available) may involve additional data about your customers or subscribers that you upload or generate through the product.
You acknowledge that operational details, thresholds, and enablement criteria may vary by account type, verification status, and product module without prior notice where permitted by law.
WhatsApp Wallet and related consumer flows may process phone numbers, messaging metadata necessary to operate the service, confirmation events, and PIN-related security data. Interactions may occur through third-party messaging platforms subject to their own policies.
Our official WhatsApp business number for Xtrapay wallet services is +234 906 333 3668 (display name: Xtrapay). When you message us on WhatsApp, you initiate the conversation; we use replies to provide wallet menus, balances, payments support, OTP codes where requested, and related service messages within applicable WhatsApp policy windows.
The Xtrapay consumer app (Android and iOS) may process your phone number, wallet balance and transaction history, device identifiers, app version, push-notification tokens where enabled, and security data such as your wallet PIN (stored and verified through our systems, not displayed in plain text). If you enable optional biometric sign-in or transaction confirmation on your device, authentication is performed by your phone’s operating system; we do not receive or store your fingerprint or face data—only a successful unlock event that lets the app use credentials already stored in the device secure enclave for your Xtrapay wallet on that device.
If you request or use a Dollar Virtual Card, we and our card programme partners may process cardholder name, billing address, identity and KYC details already on your wallet profile, card identifiers, masked or full card credentials when you choose to view them, USD balance, top-up and withdrawal amounts, exchange rates applied, freeze/unfreeze status, and records needed for fees, refunds, fraud prevention, and regulatory compliance. Card issuance and processing may involve regulated third-party providers outside Nigeria; where that occurs we take steps consistent with applicable law to protect your information.
We use Meta’s WhatsApp Business Platform (WhatsApp Cloud API) to operate Xtrapay wallet messaging on our verified business account. “Platform Data” means information we receive from Meta in connection with that service, such as your WhatsApp phone number, profile name where provided by Meta, message content you send us, message identifiers, timestamps, and delivery or read status where available.
How we use Platform Data: solely to provide and secure the Services you request—for example wallet onboarding, interactive menus, login OTP delivery, transaction confirmations, fraud prevention, and customer support. We do not sell Platform Data. We do not use Platform Data for unrelated advertising profiles.
Lawful basis and consent: Processing is based on performing our contract with you, legitimate interests in operating a secure financial messaging service, and—where required—your initiation of contact on WhatsApp or in-app consent to receive service messages.
Customer-initiated messaging: Our bot responds when you message our business number first or continue an active service session. We do not send unsolicited promotional WhatsApp broadcasts outside approved template or session rules.
Data processors: Platform Data is stored and processed on infrastructure operated by Namecheap, Inc. (cloud hosting provider) on our behalf, under confidentiality and security obligations. We do not grant hosting providers independent use of your data.
Retention: We retain Platform Data only as long as needed to operate the Services, meet financial and regulatory record-keeping duties, resolve disputes, and prevent abuse, then delete or anonymise according to our retention schedules (see Section 20).
Your choices: You can stop messaging us on WhatsApp at any time. To request deletion of wallet-related data, use xta.xta.check-outnow.com/account-deletion or contact support. Meta’s own privacy practices are described in the WhatsApp Privacy Policy and Meta Privacy Policy.
Public authority requests: We review legal requests for user information for validity and disclose only what is required by applicable law, applying data-minimisation practices. We document requests and responses where appropriate.
You acknowledge that operational details, thresholds, and enablement criteria may vary by account type, verification status, and product module without prior notice where permitted by law.
API and integration use may generate request metadata, authentication events, webhook delivery logs, and error records. Merchants are responsible for personal data they send us via API beyond what is required for the transaction.
You acknowledge that operational details, thresholds, and enablement criteria may vary by account type, verification status, and product module without prior notice where permitted by law.
When you contact support, we process the content of tickets, chats, emails, attachments, and related account identifiers. We may record calls or sessions where permitted and disclosed.
You acknowledge that operational details, thresholds, and enablement criteria may vary by account type, verification status, and product module without prior notice where permitted by law.
We use cookies and similar technologies to maintain sessions, remember preferences, measure performance, and protect against abuse. You can control cookies through browser settings; some features may not work if cookies are disabled.
You acknowledge that operational details, thresholds, and enablement criteria may vary by account type, verification status, and product module without prior notice where permitted by law.
Where Nigerian law requires a legal basis, we rely on combinations of contract performance, legal obligation, legitimate interests (such as securing the platform), and consent where appropriate (for example certain marketing).
Merchants are often independent controllers of their customers' data; you must provide your own privacy notices to payers.
You acknowledge that operational details, thresholds, and enablement criteria may vary by account type, verification status, and product module without prior notice where permitted by law.
We may use automated tools to score risk, flag unusual activity, or block transactions. Such processing is intended to protect users and the financial system. You may contact us if you believe an automated decision adversely affected you, subject to applicable law.
You acknowledge that operational details, thresholds, and enablement criteria may vary by account type, verification status, and product module without prior notice where permitted by law.
We may send product updates or educational content where permitted. You can opt out of non-essential marketing using unsubscribe links or support requests.
We do not sell personal data. We may share data with: infrastructure and software providers under confidentiality obligations (including cloud hosting providers that store application and database data on our behalf); professional advisers; payment and banking partners; verification services; and affiliates involved in operating the Services.
Personal data received through Meta’s WhatsApp Business Platform is processed by us as controller and is not sold to third parties. We use Meta’s APIs solely to send and receive service messages you request or initiate.
We do not publish a exhaustive list of subprocessors here.
You acknowledge that operational details, thresholds, and enablement criteria may vary by account type, verification status, and product module without prior notice where permitted by law.
We may disclose information to regulators, courts, or law enforcement when required by law or reasonably necessary to protect rights, safety, and integrity of the platform.
You acknowledge that operational details, thresholds, and enablement criteria may vary by account type, verification status, and product module without prior notice where permitted by law.
Data may be processed in Nigeria or other locations where our providers operate. Where transfers occur, we take steps consistent with applicable law to ensure appropriate safeguards.
We retain data for as long as needed to provide the Services, meet regulatory and tax record-keeping requirements (which may extend several years for financial records), resolve disputes, and then delete or anonymise according to internal schedules.
Backups may persist for a limited period after deletion from active systems.
You acknowledge that operational details, thresholds, and enablement criteria may vary by account type, verification status, and product module without prior notice where permitted by law.
We implement technical and organisational measures appropriate to the nature of the data, as described further on our Security page. No method of transmission or storage is completely secure.
Subject to applicable law (including rights under the Nigeria Data Protection Act 2023 where applicable), you may request access, correction, deletion, restriction, portability, or objection to certain processing, and withdraw consent where processing is consent-based.
Rights may be limited where we must retain data for legal or regulatory reasons.
You acknowledge that operational details, thresholds, and enablement criteria may vary by account type, verification status, and product module without prior notice where permitted by law.
Submit requests through the official support or contact options on this website. Xtrapay and WhatsApp Wallet users can request account and data deletion at xta.xta.check-outnow.com/account-deletion. We may ask for information to verify your identity before acting. We aim to respond within reasonable timelines prescribed by law.
You acknowledge that operational details, thresholds, and enablement criteria may vary by account type, verification status, and product module without prior notice where permitted by law.
If you are unsatisfied with our response, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC) or other competent authority where applicable.
You acknowledge that operational details, thresholds, and enablement criteria may vary by account type, verification status, and product module without prior notice where permitted by law.
The Services are directed at businesses. Wallet features are not intended for children. If you believe a minor's data was submitted, contact us for appropriate action.
You acknowledge that operational details, thresholds, and enablement criteria may vary by account type, verification status, and product module without prior notice where permitted by law.
Our site may link to third-party websites or plugins (for example WooCommerce). Their privacy practices are governed by their own policies.
You acknowledge that operational details, thresholds, and enablement criteria may vary by account type, verification status, and product module without prior notice where permitted by law.
If we undergo merger, acquisition, or asset sale, personal data may transfer subject to continued protection consistent with this Policy.
You acknowledge that operational details, thresholds, and enablement criteria may vary by account type, verification status, and product module without prior notice where permitted by law.
Approved developer partners may provide Business IDs for attribution. We process partner business identifiers and transaction metadata necessary to calculate program benefits without publishing commission algorithms here.
You acknowledge that operational details, thresholds, and enablement criteria may vary by account type, verification status, and product module without prior notice where permitted by law.
We may revise this Policy. Material changes will be reflected in the "Last updated" date and, where appropriate, additional notice through the product or website.
You acknowledge that operational details, thresholds, and enablement criteria may vary by account type, verification status, and product module without prior notice where permitted by law.
For privacy questions or requests, use the Contact or Support pages on this website.