Privacy Policy

OyaPoint
Last updated: 30 October 2026 · Version 1.1

1. Who we are and what this policy covers

OyaPoint ("we", "us", "our") is a business centre you use from your phone. Through the OyaPoint app you can register for exams (JAMB, WAEC, NECO, NABTEB and others), get NIN, BVN, CAC, ID card and newspaper services done, keep your documents in one place, pay bills and buy airtime, data, exam PINs and betting wallet top-ups, and chat with us.

This policy explains what personal information we collect, why, who we share it with, how long we keep it and the rights you have. It applies to everyone who uses the OyaPoint app or website (the "Service").

We are the data controller for the personal information described here. We handle it in line with the Nigeria Data Protection Act 2023 (NDPA) and the rules of the Nigeria Data Protection Commission (NDPC).

"Personal information" means any information that identifies you or could be used to identify you, such as your name, phone number, NIN or photo.

2. What we collect

Information you give us

• Account details — your name, email address, phone number and password (we only store it in a protected, scrambled form; we can never see it).
• Details on service forms — what each service needs, for example: full name, date of birth, gender, state and LGA of origin, place of origin, home address, height, exam choices, institution and course, JAMB registration number, NIN, BVN, bank account details (for BVN agent applications), meter or smartcard numbers, betting user IDs, next-of-kin and guardian details.
• Sensitive information — some services need information the law treats as sensitive:
  • blood group and genotype (school registration);
  • the photo and fingerprints taken when you come in for NIN enrolment;
  • NIN and BVN records and identity documents.

We only collect these when the service you choose needs them, and we ask for your clear agreement first.

• Documents and photos — files you upload to your document wallet or send in chat: passport photos, O'level results, birth certificate or declaration of age, state of origin certificate, NIN slip, JAMB slips or results, signature, affidavits and similar.
• Information about other people — if you order a service for someone else (for example a NIN slip or a child's NIN registration), you give us their details. You must have their permission, or be their parent or guardian.
• Chat messages and files — what you send us in Chat with OyaPoint.
• Agreements you give — when you tick a consent box or agree to a service notice, we record that you did.

Information created when you use the Service

• Orders and payments — what you ordered, prices, wallet top-ups, wallet payments and refunds, and the receipts, PINs, tokens and finished files we deliver.
• Alerts — the notifications we send you and whether you've read them.
• Phone notification details — if you turn on phone alerts, a technical address for your browser or phone so we can send them.
• Technical information — your IP address, browser and device type and sign-in times, used to keep you signed in and to protect your account. We don't use analytics or advertising trackers.

Information from others

• Our partners and government agencies — results of the work we do for you, for example a NIN slip, BVN report, CAC certificate, exam PIN or the account name linked to a meter, smartcard or betting ID.

3. Why we use it (and our legal basis)

We do not sell your personal information. We do not use it for automated decisions that have legal or similarly serious effects on you.

4. Who we share it with

We only share what each partner needs to do their part.

Government agencies and exam bodies

To do the services you order, we submit your details and documents to the relevant body. This includes the Joint Admissions and Matriculation Board (JAMB), WAEC, NECO, NABTEB, the National Identity Management Commission (NIMC), the Corporate Affairs Commission (CAC), banks and NIBSS (for BVN services), schools you're registering with, and newspapers (change of name). Their own laws and policies then apply.

Service partners

• Supabase — runs our database, sign-in and file storage. Stores all the information above. Privacy policy: supabase.com/privacy
• HubbyVerify — processes NIMC (NIN), BVN, CAC, ID card and newspaper requests for us. Receives the form details and documents for those services. Privacy policy: hubbyverify.com.ng/privacy.php
• VTpass — delivers airtime, data, electricity tokens, TV subscriptions and exam PINs. Receives the phone, meter or smartcard number, plan and amount. Privacy policy: vtpass.com/privacy-policy
• ClubKonnect (Nellobytes Systems) — delivers airtime, data, JAMB e-PINs and betting wallet top-ups. Receives the phone number, JAMB profile code, betting company and user ID, and amount. Privacy policy: clubkonnect.com/PrivacyPolicy.asp
• Browser and phone notification services (Google, Apple, Mozilla, depending on your device) — carry phone alerts to you. Receive the alert text and a technical device address.
• Vercel — hosts the OyaPoint app. Handles technical information such as IP addresses. Privacy policy: vercel.com/legal/privacy-policy
• Email delivery — sign-in codes and account emails are sent through Supabase, or an email-sending service we use for the same purpose. We'll name any new one here.
• Payment processor — when card and bank-transfer top-ups launch, payments will be handled by Paystack (privacy policy: paystack.com/terms#privacy). We will never see or store your full card details.

Others

• Professional advisers (lawyers, accountants) where needed.
• Authorities, when the law requires it or to protect people's safety or our legal rights.
• A buyer or successor, if OyaPoint's business is sold or merged, under the same protections.

5. How long we keep it

• Account details — while your account is open. When you ask us to close it, we delete your profile within 30 days (details inside order and payment records stay with those records).
• Orders, payments, wallet and receipts — 6 years after the transaction, for tax and financial record-keeping.
• Documents in your wallet — until you delete them or close your account.
• Copies of documents attached to an order — with that order's record.
• Chat messages and files — while your account is open. We delete them when you close your account.
• Alerts — 12 months, then deleted automatically.
• Phone notification details — until you turn alerts off or the device stops accepting them.
• NIN, BVN, bank details, blood group and genotype typed on a service form — removed from the order automatically as soon as the order is finished, refunded or cancelled. We don't keep fingerprints or photos taken at NIN enrolment; they go straight to NIMC.

When something no longer needs to be kept, we delete it or make it anonymous. Backups are overwritten on a rolling basis.

6. Where your information is stored

Our partners may store or process your information outside Nigeria. For example, our database and files are stored on Supabase's cloud servers (run on Amazon Web Services) outside Nigeria, and the app is served from Vercel's global network. When information leaves Nigeria, we rely on the protections allowed by the NDPA (sections 41–43), such as the receiving country's adequate protection, contracts with suitable safeguards, or your consent.

7. How we protect it

• All connections to OyaPoint are encrypted (HTTPS).
• Passwords are stored scrambled, never in plain text.
• Strict database rules mean each customer can only see their own orders, documents, wallet and chat. Only the OyaPoint owner can see customer records to do the work.
• Documents are stored privately and opened through short-lived links.
• Payment and partner keys are kept on our servers, never on your phone.

No system is completely secure. If a personal data breach puts your rights at risk, we will tell the NDPC within 72 hours as the NDPA requires, and tell you without undue delay where the law requires it.

8. Your rights

Under the NDPA you have the right to:

• Access — get a copy of the personal information we hold about you.
• Correct — have wrong or incomplete information fixed. You can update your profile in the app at any time.
• Delete — ask us to erase your information. We may need to keep some records the law requires (such as payment records).
• Restrict or object — ask us to stop or limit some uses, including news and offers.
• Portability — get your information in a common electronic format.
• Withdraw consent — at any time, for anything we do based on your consent. This doesn't affect what we did before.
• Complain — to the Nigeria Data Protection Commission (NDPC) if you're unhappy with how we handle your information.

To use any of these rights, email hello@amojuto.ng from the email on your account (or tell us in Chat with OyaPoint). We may ask you to confirm who you are. We will reply within 30 days.

9. Cookies and storage on your device

We use only what the Service needs to work:

• Sign-in cookies — keep you signed in securely.
• Storage on your device — remembers form drafts you haven't sent, the service notices you've agreed to, and (if you allow it) the phone-alerts setting.

We do not use advertising or tracking cookies. If that ever changes, we'll update this policy and ask you first where the law requires it.

10. Children

People under 18 may use OyaPoint's registration services (for example JAMB, exam and NIN registration) with the consent of a parent or legal guardian. A parent or guardian may also order services for their child. By ordering for a child, or letting a child use their account, the parent or guardian gives that consent and is responsible for the child's use.

Betting wallet top-ups are only for people aged 18 and over. We do not knowingly fund betting accounts for anyone under 18.

If you believe a child's information was given to us without proper consent, contact us and we will deal with it promptly.

11. Changes to this policy

We may update this policy as the Service or the law changes. We'll change the "Last updated" date. For important changes, we'll tell you in the app (an alert or a message) before they take effect.

12. Contact us

OyaPoint
Email: hello@amojuto.ng

For privacy questions, requests and complaints, email us or use Chat with OyaPoint. If we don't resolve your complaint, you can contact the Nigeria Data Protection Commission (NDPC).