Legal
Privacy Policy
Last updated 28 August 2026
Kobora is a Nigerian payments app. You use it to buy airtime and data, pay for cable, electricity and betting, buy eSIMs, and turn unused airtime into cash.
Doing any of that means handling information about you. This page sets out exactly what we collect, why we collect it, who else sees it, how long we keep it, and what you can make us do with it. It is written to be read, not to be skipped.
The short version. We collect what we need to run your account, move your money and satisfy Nigerian financial regulation — and not more. We do not sell your data. We do not share it for anyone else's advertising.
1. Who is responsible for your data
Kobora is the data controller for the information described here. Contact us about anything on this page at [email protected], or through Support inside the app.
We handle personal data under the Nigeria Data Protection Act 2023 and the regulations made under it.
2. What we collect
Information you give us
- Creating an account: your name, phone number, email address, date of birth and the password and transaction PIN you choose.
- Verifying your identity: your BVN or NIN, a photograph of an identity document, a selfie, and your residential address. We ask for this when you move up a tier, and Nigerian regulation requires it before certain limits and features are available to you.
- Using the app: the phone numbers, meter numbers, smartcard numbers and betting IDs you pay for, the bank accounts you withdraw to, and the beneficiaries you save.
- Contacting us: whatever you write to Support, and the messages we exchange with you.
Information we collect automatically
- Device and app: device model, operating system version, app version, language, a device identifier, and crash and performance diagnostics.
- Use: the screens you open and the actions you take in the app, so we can tell what is working and what is broken.
- Connection: IP address and approximate location derived from it, and the times you sign in.
Information from other people
- Identity providers return your verified name, date of birth and photograph when we check a BVN or NIN you have given us.
- Payment partners and banks tell us that a transfer into your wallet has arrived, and who sent it.
- Billers and telcos tell us whether a payment you made was delivered.
What we never collect. Your bank password, your card PIN, or your BVN's own PIN or password. Nobody at Kobora will ever ask you for them. Your Kobora password and transaction PIN are stored only in a hashed form — we cannot read them, which is why we can only ever reset them, never tell you what they are.
3. Why we use it, and on what legal basis
| What we do | Why | Basis |
|---|---|---|
| Create and run your account; carry out the payments, purchases, swaps and withdrawals you ask for | It is the service you signed up for | Performance of a contract |
| Verify your identity, screen against sanctions lists, monitor for fraud and money laundering, keep transaction records | Nigerian financial regulation requires it of us | Legal obligation |
| Notify you about a transaction, a security event, or a change to these terms | You need to know | Contract and legal obligation |
| Investigate a dispute or a failed transaction you report | To put it right | Contract and legitimate interest |
| Diagnose crashes, measure performance, decide what to build | To keep the app working and make it better | Legitimate interest |
| Send you marketing about Kobora | Only if you agreed | Consent — withdrawable at any time |
Where we rely on consent you can withdraw it whenever you like, and doing so does not affect anything we did before you withdrew it. Where we rely on a legal obligation we cannot delete the records concerned even if you ask, and section 8 explains why.
4. Who we share it with
We share personal data only with parties who need it to deliver something you asked for, or where the law requires it. Every one of them is bound to use it only for the purpose we gave it to them for.
- Identity verification providers — to confirm a BVN or NIN and match it to your document and selfie.
- Banks, payment processors and card schemes — to fund your wallet and to pay money out to your bank account.
- Telecommunications operators, billers and betting platforms — the number, meter, smartcard or account ID you are paying for, because it cannot be delivered without it.
- eSIM providers — to issue and activate a plan you bought.
- Cloud hosting, email delivery, push notification and error monitoring providers — the infrastructure the app runs on.
- Regulators, law enforcement and courts — where we are legally compelled, or where it is necessary to establish or defend a legal claim, or to prevent fraud or harm.
- A buyer or successor — if Kobora is ever sold or merged, in which case this policy continues to apply until you are told otherwise.
We do not sell your personal data, and we do not share it with advertising networks or data brokers.
5. Transfers outside Nigeria
Some of the providers above operate outside Nigeria, so your data may be processed abroad. Where that happens we transfer it only under a mechanism the Nigeria Data Protection Act permits — an adequacy decision, or contractual terms binding the recipient to a standard of protection equivalent to Nigerian law.
6. How we protect it
- Traffic between the app and our servers is encrypted in transit; sensitive fields are encrypted at rest.
- Your password and transaction PIN are hashed. Nobody at Kobora can read either.
- Access to customer data is restricted to staff who need it for their work, and is logged.
- Sensitive actions — withdrawing, changing your PIN, deleting your account — require a PIN, a one-time code sent to your email, or both.
No system is perfectly secure. If a breach occurs that is likely to put your rights at risk, we will notify you and the Nigeria Data Protection Commission as the Act requires.
Your part in this. Keep your PIN and password to yourself, and treat anyone who asks for them as a fraudster — including if they say they are from Kobora.
7. Cookies and similar technologies
The Kobora app does not use advertising cookies or third-party tracking pixels. This website uses only what it needs to serve pages and remember your preferences. The app stores a session token on your device so you are not signed out between uses; clearing the app's data or signing out removes it.
8. How long we keep it
- While your account is open — for as long as you use Kobora.
- After you close it — identity records and transaction history are retained for at least five years from your last transaction, because anti-money-laundering rules in Nigeria require it. We cannot shorten this, and it applies even if you ask us to delete everything.
- Support conversations — up to two years, so a dispute can be re-examined.
- Diagnostics and crash logs — up to twelve months.
Once a retention period ends, we delete the data or irreversibly anonymise it.
9. Your rights
Under the Nigeria Data Protection Act you may ask us to:
- Show you the personal data we hold about you.
- Correct anything inaccurate. Some verified fields — your name and date of birth as returned by your BVN or NIN — can only be corrected at the source.
- Delete your data, subject to the retention periods in section 8.
- Restrict or object to a use that relies on our legitimate interest.
- Port your data to another provider in a machine-readable form.
- Withdraw consent where consent is what we relied on.
Ask through Support in the app or at [email protected]. We respond within 30 days. There is no charge unless a request is repetitive or excessive, and we will tell you before any charge applies.
You can delete your account yourself from Settings in the app, or at kobora.ng/delete-account. Withdraw your balance first — deletion does not release funds to you, and section 8 still governs the records we must keep.
If you are not satisfied with how we have handled a request, you may complain to the Nigeria Data Protection Commission.
10. Children
Kobora is for people aged 18 and over. We do not knowingly collect data from children. If we learn that an account belongs to someone under 18, we close it and delete the data except what the law requires us to keep.
11. Automated decisions
We use automated checks to screen transactions for fraud and money laundering. These can delay or block a transaction, or restrict an account. A person reviews any decision that materially affects you, and you can contest one through Support and ask for it to be looked at again by a human.
12. Changes to this policy
When we change this policy we update the date at the top. If a change materially affects your rights we will tell you in the app or by email before it takes effect.
13. Contact
Email [email protected], or open Support in the Kobora app.