Privacy Policy

Aurra is a WhatsApp-based banking app that enables Nigerian users to send money, buy airtime, and pay bills through guided screens (WhatsApp Flows). We are not a bank. We work with CBN-licensed payment processors.

For privacy enquiries, contact: contact@aurra.online

Information you provide:

• Full name and WhatsApp phone number (required to create an account)
• National Identification Number (NIN), for identity verification with our payment processor
• Email address (optional, for account recovery)
• 6-digit transaction PIN (stored as a one-way hash. We cannot read it)

Information collected automatically:

• Transaction history (amounts, recipients, timestamps, status)
• WhatsApp message content and Flow form data, only for processing your requests, never stored permanently
• IP address at signup and each login, for audit trails and fraud detection
• Device identifier (hashed user-agent), to detect unauthorised access from new devices
• Approximate geographic location (country/city) derived from IP, for fraud detection only
• Identity verification status (pending, verified, or failed)

Information we do NOT collect:

• Your bank account password or internet banking credentials
• Biometric data of any kind

• To process your payment instructions sent via WhatsApp
• To verify your identity before each transaction using your PIN
• To detect and prevent fraud, suspicious activity, and unauthorised access
• To verify your identity by comparing your current device and location against your known history
• To send you security alerts (for example a new device or location login) via WhatsApp
• To maintain your transaction history and spending summaries
• To send you transaction confirmations and security alerts via WhatsApp
• To comply with legal and regulatory obligations

We do not use your data for advertising, and we do not sell your data to any third party.

We share your data only with the following parties, and only as necessary:

• Our payment processor: Your name, phone number, and NIN are shared with our CBN-licensed payment processor to provision virtual bank accounts, verify your identity, and process transfers.
• Meta (WhatsApp):Your messages pass through the WhatsApp Business API. Meta's own privacy policy applies to message transmission.
• Infrastructure: Our database is hosted in the EU. All data is encrypted at rest and in transit.
• Law enforcement: If required by a valid legal order, court order, or Nigerian regulation.

We never sell, rent, or trade your personal information.

When you receive money via your virtual bank account (provided by our payment processor), the deposit details (amount, date) are shared with us so we can credit your wallet. Your virtual account number and bank name are visible to anyone you share them with. Treat them like any regular bank account.

• Your PIN is hashed with bcrypt (12 rounds) plus a server-side secret, then never stored in plaintext. It cannot be reversed or read by anyone, including us
• All data is encrypted in transit (HTTPS/TLS) and at rest
• Five incorrect PIN attempts locks your account for 24 hours
• Transaction sessions expire after 10 minutes of inactivity
• All sensitive operations are logged in an immutable audit trail
• Webhook endpoints verify cryptographic signatures before processing any request
• Rate limiting protects all API endpoints from brute-force attacks

• Transaction records are retained for 7 years to comply with Nigerian financial regulations
• KYC data (NIN, BVN) is retained for as long as your account is active and for 7 years after closure per regulatory requirements
• Audit logs are retained for 2 years
• If you delete your account, your personal details are anonymised within 30 days, but transaction records and KYC data may be retained as required by law

You have the right to:

• Request a copy of all personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and personal data (subject to legal retention requirements)
• Object to processing of your data for any purpose beyond service delivery

To exercise any of these rights, email contact@aurra.online. We will respond within 14 business days.

Aurra is not intended for use by anyone under the age of 18. We do not knowingly collect data from minors. If you believe a minor has created an account, please contact us immediately.

We may update this Privacy Policy from time to time. When we do, we will notify you via WhatsApp and update the "Last updated" date at the top. Continued use of Aurra after changes constitutes your acceptance of the new policy.

For any privacy-related questions or concerns:

• General: contact@aurra.online
• Privacy and data: admin@aurra.online