Privacy Policy

Last updated: April 21, 2026

This Privacy Policy explains what personal data WebbNexa ("we") collects, how we use it, and your rights. If you are located in the EEA, UK, or California, see the region-specific sections below.

1. Data we collect

Account data: email, username, hashed password, 2FA metadata.
Identity verification data (where KYC is required): name, date of birth, government ID.
Transaction data: purchases, balances, dispute history, payment-method fingerprints.
Technical data: IP address, user agent, device fingerprint for fraud prevention.
SMS content: codes delivered to rented numbers during the rental window.

2. Why we process it

Provide the Service (legal basis: contract).
Comply with KYC/AML obligations (legal basis: legal obligation).
Detect and prevent fraud (legal basis: legitimate interest).
Send service announcements and, with consent, marketing emails.

3. Sharing

We share data only with:

Infrastructure subprocessors (cloud hosting, email delivery, error tracking).
Payment processors to handle transactions (Paystack, Quidax).
Identity-verification providers when KYC is required.
Law enforcement when required by a valid legal process.

We do not sell your personal data.

4. Retention

We retain account data for the life of the account plus 7 years for legal/tax purposes. SMS contents are purged 30 days after rental ends. Audit logs are retained for 2 years.

5. Security

Passwords are hashed with Argon2. Credentials for escrowed social accounts are stored in an AES-256-GCM encrypted vault. All traffic is encrypted in transit (TLS 1.2+). Access to production is gated by hardware-key 2FA and audited.

6. Your rights

Depending on where you live, you may have the right to access, correct, delete, port, or object to the processing of your personal data. To exercise these rights, email privacy@example.com. We respond within 30 days.

7. Cookies

We use strictly necessary cookies for authentication (session tokens) and optional cookies for analytics with your consent. You can manage preferences via the cookie banner displayed on your first visit.

8. International transfers

Your data may be processed outside your country. Where required, we rely on Standard Contractual Clauses or equivalent safeguards.

9. Children

The Service is not directed to people under 18. We do not knowingly collect data from children; if we learn we have, we will delete it.

10. Changes

Material changes will be announced at least 14 days in advance by email and on this page.

11. Contact

Data protection queries: privacy@example.com. EU representative: to be named before EU launch.