📅 Last updated: November 8, 2026 · Effective date: November 8, 2026
Summary: TrustMoni collects only the information necessary to provide our services and comply with Nigerian financial regulations. We never sell your personal data to third parties.
1 Who We Are
TrustMoni ("we", "us", "our") is a cryptocurrency exchange platform operated by Trustmoni.com Limited, a company registered in Nigeria. We are the data controller responsible for your personal information collected through our mobile application and website at trustmoni.com.
Contact: help@trustmoni.com
2 Information We Collect
| Category | Data Collected | Purpose |
|---|
| Account Info | Full name, email address, phone number, password (hashed), transaction PIN (hashed) | Account creation and authentication |
| Identity (KYC) | NIN, live selfie photo, state, residential address | Identity verification per CBN regulations |
| Financial | Bank name, account number, account name, transaction history | Processing withdrawals and confirming the account name |
| Crypto Wallets | Wallet addresses (HD-derived), transaction hashes, amounts | Deposit monitoring and crediting |
| Bill Payments | Phone number, meter number, or subscriber ID you provide for bill payments | Processing airtime, electricity, data, and cable TV payments |
| Referrals | Your referral code and the accounts that signed up with it | Running the referral programme and paying bonuses |
| Device & Usage | IP address, device type, login timestamps, the device currently signed in, push notification token | Security, fraud prevention, one-device sign-in, and sending you notifications |
2.1 Camera Access
TrustMoni requests access to your device's front camera only during KYC verification to capture a live selfie. We do not access your camera at any other time, and photos are never saved to your device gallery.
2.2 Information We Do NOT Collect
- We do not collect your private cryptocurrency keys or seed phrases
- We do not access your contacts, microphone, or location
- We do not collect information from children under 18
3 How We Use Your Information
We use your information to:
- Create and manage your TrustMoni account
- Verify your identity as required by Nigerian AML/KYC regulations
- Process cryptocurrency deposits, NGN withdrawals, and transfers between TrustMoni users
- Process bill payments including airtime, data, electricity, and cable TV on your behalf
- Send transaction confirmations and account notifications via email and push notification
- Detect, prevent, and investigate fraud and security incidents
- Screen blockchain transactions for suspicious activity in compliance with AML obligations
- Comply with legal obligations under Nigerian law (NDPA, CBN, EFCC, NFIU, SCUML)
- Improve our services through anonymized analytics
- Respond to your customer support inquiries
💡 We process your data based on: (1) performance of our contract with you, (2) legal obligations under Nigerian law, and (3) our legitimate interest in preventing fraud.
4 How We Share Your Information
We never sell your personal information. We may share your data only in these limited circumstances:
- Identity Verification: We share your NIN with Prembly (IdentityPass) solely to verify your identity. They are bound by strict data protection obligations.
- Bank Account Verification: When you enter a bank account for a withdrawal, the account number and bank are checked with our bank account verification provider solely to confirm the account name before paying out.
- Blockchain Data Services: To detect and credit your deposits, your deposit addresses and transaction hashes are looked up through blockchain data providers (public network nodes and explorers). This information is already public on the blockchain. Transaction details may also be checked with blockchain analytics services as part of our AML/CFT obligations.
- Bill Payment Processing: When you initiate a bill payment, the relevant recipient details you provide such as your phone number for airtime, your meter number for electricity, or your decoder number for cable TV are shared with our bill payment aggregator solely to fulfil your payment instruction. This information is used only for that specific transaction and is not retained by the aggregator beyond what is necessary for processing.
- Withdrawal Processing: Your bank account details and withdrawal amounts are used solely for the purpose of processing your NGN withdrawal to your Nigerian bank account. This information is handled securely by authorised TrustMoni staff only and is never shared with unauthorized third parties.
- Legal Authorities: We may disclose information to EFCC, NFIU, CBN, SCUML, Nigerian Police, or other authorities when required by law or court order.
- Email Service: We use Google Workspace for transactional email delivery. Google accesses only the minimum data necessary to deliver your emails.
- Push Notifications: We use Google Firebase Cloud Messaging to deliver app notifications. It receives a notification token for your device and the content of the notification.
- Business Transfer: In the event of a merger or acquisition, your data may be transferred with prior notice to you.
5 Data Retention
We retain your personal data as follows:
- Account data: For the duration of your account, plus 5 years after closure (required by Nigerian financial regulations)
- KYC documents: Minimum 5 years as required by the CBN AML/CFT framework
- Transaction records: Minimum 5 years
- Bill payment records: Minimum 5 years
- AML screening records: Minimum 5 years as required by SCUML
- Login/security logs: 12 months
After retention periods expire, data is securely deleted or anonymized.
6 Data Security
We protect your information using industry-standard security measures:
- All data transmitted using 256-bit SSL/TLS encryption
- Passwords stored using bcrypt hashing, never in plain text
- Transaction PINs stored using bcrypt hashing
- Your account can be signed in on one device at a time, and repeated wrong PIN attempts temporarily lock it
- Access to your data restricted to authorised TrustMoni staff only
- KYC selfies stored in secure, non-publicly-accessible server directories
In the event of a personal data breach, we will notify the Nigeria Data Protection Commission and, where required, affected users, within the time limits set by the Nigeria Data Protection Act 2023.
7 Your Privacy Rights
Under the Nigeria Data Protection Act (NDPA) 2023, you have the following rights:
👁️
Right to Access
Request a copy of the personal data we hold about you
✏️
Right to Rectification
Correct inaccurate or incomplete personal data
🗑️
Right to Erasure
Request deletion of data where we have no legal obligation to retain it
🚫
Right to Object
Object to processing of your data for marketing purposes
📦
Right to Portability
Receive your data in a portable, machine-readable format
⏸️
Right to Restriction
Request restriction of processing in certain circumstances
To exercise any of these rights, contact us at help@trustmoni.com. We will respond within 30 days. Note that some rights are limited by our legal obligations under Nigerian financial law.
8 Cookies & Tracking
Our website uses essential session cookies necessary for authentication and security. We do not use advertising cookies or third-party tracking pixels. Our mobile app displays the TrustMoni website and uses the same essential cookies.
- Session cookies: Required for login and security cannot be disabled
- CSRF tokens: Required to protect against cross-site request forgery
9 Children's Privacy
TrustMoni does not knowingly collect personal information from anyone under 18 years of age. If we become aware that we have collected data from a child under 18, we will delete it immediately. Contact us at help@trustmoni.com if you believe we have inadvertently collected such data.
10 Third-Party Links
TrustMoni may contain links to third-party websites (e.g. blockchain explorers). We are not responsible for the privacy practices of those sites.
11 International Data Transfers
Your data is primarily stored and processed in Nigeria. Where data is processed outside Nigeria (e.g. by Prembly for identity verification, Google for email and push notifications, or blockchain data and analytics providers), we ensure appropriate safeguards are in place and that such transfers comply with the Nigeria Data Protection Act 2023.
12 Regulatory Compliance
TrustMoni operates in compliance with:
- Nigeria Data Protection Act (NDPA) 2023
- Central Bank of Nigeria (CBN) AML/CFT Regulations
- Money Laundering (Prevention and Prohibition) Act 2022
- Nigerian Financial Intelligence Unit (NFIU) guidelines
- Special Control Unit Against Money Laundering (SCUML) requirements
💡 Cryptocurrency transactions on TrustMoni may be monitored and screened to detect and prevent money laundering, fraud, and other financial crimes in accordance with our SCUML obligations.
13 Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification at least 7 days before they take effect.
14 Contact & Complaints
For privacy concerns, data requests, or complaints:
15 Account & Data Deletion
You have the right to request deletion of your TrustMoni account and associated personal data at any time. Use the form below to submit your request you do not need to be logged in.
1
Submit your request below
Fill in your registered email address and reason. No login required.
2
We verify your identity
We will send a confirmation email to your registered address within 24 hours to verify the request is from you.
3
Account deleted within 7 days
Once confirmed, your account and personal data will be permanently deleted within 7 business days. You will receive a final confirmation email.
What gets deleted
- Your name, email address, phone number and password
- Your bank account details
- Your KYC selfie photo
- Your crypto wallet addresses
- Your login history and device information
- Your referral code and referral relationships
- Your NGN balance (must be ₦0 before deletion)
⚖️ Data we are legally required to keep Nigerian financial regulations (CBN, NFIU, SCUML) require us to retain the following for a minimum of 5 years even after account deletion:
- Transaction records (deposit and withdrawal history)
- Bill payment records
- KYC identity verification records (NIN verification result)
- AML screening records
This is a legal obligation we cannot override. Retained data is used solely for regulatory compliance and is never used for commercial purposes.