Privacy Policy
This Privacy Policy ("Policy") explains how instantcards, a product of Sanaga Digital operating at instantcards.app and sanagadigital.app ("we", "us", "our"), collects, uses, stores, shares, and protects your personal data when you use our mobile application, website, and payment services (collectively, the "Service"). We are committed to handling your data lawfully, transparently, and in accordance with applicable data protection and financial services legislation across all markets in which we operate.
Key principle: We collect only what we need to provide the Service, protect it with industry-leading encryption, never sell it to third parties, and give you meaningful control over it at all times.
1. Identity and Contact Details of the Controller
Data Controller: Sanaga Digital (trading as instantcards)
Product: instantcards.app
Website: sanagadigital.app
Data Protection Contact: legal@instantcards.app
For data protection enquiries, identity verification, or to exercise your rights, please contact us at the address above. We will respond within 30 calendar days.
2. Scope of This Policy
This Policy applies to all personal data we collect and process in connection with:
- Registration and use of the instantcards mobile application (iOS and Android)
- Use of our website at instantcards.app and sanagadigital.app
- Mobile money top-up transactions processed via Flutterwave and CinetPay
- Virtual card issuance and management via Sudo Africa
- Identity verification processes conducted via Smile Identity
- Customer support interactions via email and in-app messaging
- Any other communication you have with us
3. Categories of Personal Data We Collect
3.1 Data You Provide Directly
| Category | Specific data | When collected |
|---|---|---|
| Identity data | First name, last name, date of birth (Tier 2 KYC) | Registration / KYC |
| Contact data | Phone number, email address (optional) | Registration |
| Credential data | PIN — stored exclusively as a bcrypt hash (cost 12); never in plain text | Registration / PIN change |
| KYC documents | National ID number, passport number, document photograph, selfie (Tier 1 / 2) | KYC verification |
| Country of residence | Two-letter ISO country code | Registration |
3.2 Data Generated by Your Use of the Service
| Category | Specific data | Purpose |
|---|---|---|
| Wallet data | Balance, currency denomination, transaction history | Service delivery |
| Transaction data | Amount, timestamp, provider reference, Flutterwave/CinetPay transaction ID, status, fee charged | Settlement, audit, support |
| Card data (encrypted) | Masked PAN (last 4 digits visible); full PAN and CVV stored AES-256-CBC encrypted; expiry date; card network; card status | Card management |
| Device data | Expo push notification token; operating system type (iOS/Android) | Push notifications |
| Authentication data | JWT token (device-side only); token expiry; last login timestamp | Security, session management |
| KYC status | Tier (0/1/2), verification status (none/pending/verified/rejected), rejection reason | Limit enforcement, compliance |
3.3 Data We Explicitly Do Not Collect
- Your full card number (PAN) in plain text: The PAN is received from Sudo Africa over TLS and immediately encrypted with AES-256-CBC. It exists in plain text only in server memory for the sub-second duration of the encryption operation.
- Your CVV in plain text: Same protection as PAN. The decrypted CVV is held in memory for a maximum of 60 seconds during the PIN-gated reveal window and is never written to disk, logs, or monitoring tools.
- Your Mobile Money PIN: This is entered directly with your mobile money provider via USSD or their own interface. We never receive, transmit, or store it.
- Biometric data (other than what Smile Identity processes independently under their own policy)
- Location data, browser history, or behavioural tracking beyond our own application
- Advertising identifiers (IDFA, GAID, or equivalents)
4. Legal Bases for Processing
| Processing activity | Legal basis | Details |
|---|---|---|
| Creating and managing your account | Performance of contract | Necessary to provide the Service you have contracted for |
| Processing mobile money top-ups | Performance of contract | Core service delivery |
| Issuing and managing virtual cards | Performance of contract | Core service delivery |
| KYC identity verification | Legal obligation | Required under COBAC R-2019/02, FATF Recommendations, and applicable AML/CFT law |
| AML transaction monitoring and fraud prevention | Legal obligation / Legitimate interest | Required by financial crime regulations; necessary to protect users and the platform |
| Sanctions screening | Legal obligation | Required under OFAC, UN, EU, and African Union sanctions regimes |
| Retaining financial records | Legal obligation | 7-year minimum retention under financial audit regulations |
| Sending push notifications (wallet credits, card spend) | Consent | You grant permission when you enable notifications in-app |
| Customer support | Legitimate interest | Necessary to resolve queries and disputes |
| Service security and fraud detection | Legitimate interest | Protecting the platform and all users from fraud and cyberattack |
| Anonymised service improvement analytics | Legitimate interest | Improving the product; data anonymised before use |
5. How We Protect Your Data
5.1 Encryption at Rest
- Card numbers (PAN) and CVV codes: AES-256-CBC with a random 16-byte IV per encryption operation. Stored as
<iv_hex>:<ciphertext_hex>. Encryption key held exclusively in server-side environment variables, never in source code or version control. - User PINs: bcrypt hash (cost factor 12). The hash is one-way — we cannot recover your PIN. We only verify it.
- JWT access tokens: stored on-device in expo-secure-store (AES-256 on iOS/Android secure enclave). Never in AsyncStorage or browser localStorage.
5.2 Encryption in Transit
- All connections use TLS 1.2 or higher. HTTP requests are rejected at the server level. HSTS headers enforce HTTPS.
- All API calls to Flutterwave, CinetPay, Sudo Africa, and Smile Identity are made over TLS.
5.3 Access Controls
- Card details (PAN and CVV) are never included in list API responses. The
GET /cardsendpoint returns only the masked PAN (last 4 digits). - Full card details are only accessible via the PIN-gated
POST /cards/:id/revealendpoint, which is rate-limited and audited. - Card data is never included in error messages, application logs, monitoring dashboards (e.g. Datadog, Sentry), or any third-party logging tool.
5.4 Infrastructure Security
- Backend hosted on cloud infrastructure with IP allowlist and strong access credentials.
- Rate limiting: 100 requests per 15 minutes globally; 10 login attempts per 15 minutes per IP.
- Webhook signature verification using
crypto.timingSafeEqual()to prevent timing attacks. - All secrets (JWT secret, encryption key, payment API keys, webhook hashes) are stored in environment variables. None appear in source code or version control.
- Dependency security audits (
npm audit) run in CI/CD. High and critical vulnerabilities block deployment.
6. Data Storage and Location
User data is stored on MongoDB Atlas, hosted in the Frankfurt, Germany region. This region operates under EU-equivalent data protection standards. No sensitive financial data is stored on servers physically located within any user's country of residence unless specifically required by applicable local law.
Push notification delivery is facilitated by Expo Push Notification Service, which uses Apple Push Notification Service (APNs) for iOS and Firebase Cloud Messaging (FCM) for Android. Notification payloads are minimised and do not contain card numbers, CVV codes, or account balances.
7. Data Retention
| Data type | Retention period | Reason |
|---|---|---|
| Account identity data | Account lifetime + 5 years after closure | Regulatory and AML/CFT requirements |
| Transaction records | 7 years minimum | Financial audit obligations; AML/CFT record-keeping requirements |
| Encrypted PAN and CVV | Card lifetime + 7 years | Payment dispute resolution; regulatory audit |
| KYC documents | As per Smile Identity policy (typically 5–7 years) | Financial services regulatory requirement |
| Push notification device tokens | Until removed by user or device change | Service delivery |
| Application error logs | 90 days | Operational troubleshooting |
| Authentication tokens | 7-day access token; 30-day refresh token | Session management |
| Customer support records | 3 years after last interaction | Dispute resolution; regulatory audit |
8. Third-Party Data Sharing
We do not sell, rent, or trade your personal data. We share your data only as follows:
| Recipient | Data shared | Purpose | Legal basis |
|---|---|---|---|
| Flutterwave | Normalised phone number, transaction reference (tx_ref), amount, currency | Initiating mobile money charge via USSD | Contract performance |
| CinetPay | Normalised phone number, transaction reference, amount, currency | Mobile money collection for XOF-belt markets | Contract performance |
| Sudo Africa | Minimal data required to create a card customer profile and issue a card | Virtual Visa/Mastercard issuance and management | Contract performance |
| Smile Identity | Name, date of birth, ID document details, document photograph | Tier 2 KYC identity verification | Legal obligation / consent |
| Expo / Apple / Google | Device push token; notification content (no card data) | Delivery of push notifications | Consent |
| Legal authorities | As required by law, court order, or regulatory request | Compliance with legal obligations; fraud prevention | Legal obligation |
| Business acquirer | All user data (in the event of merger/acquisition) | Business continuity | Legitimate interest; user notification provided |
All third-party processors are contractually bound to process your data only for the specified purposes, under equivalent confidentiality and security obligations, and in compliance with applicable data protection law.
9. International Transfers
Flutterwave is incorporated in the United States and operates across multiple African jurisdictions. CinetPay operates from Côte d'Ivoire. Sudo Africa operates from Nigeria. Smile Identity operates from the United States. Data transfers to these recipients are governed by their respective data processing agreements and applicable international transfer mechanisms. We perform due diligence on all processors prior to engagement to ensure adequate data protection standards are in place.
10. Cookies and Tracking Technologies
The instantcards mobile application does not use cookies. Our website (sanagadigital.app / instantcards.app) uses only strictly necessary cookies required for basic functionality (e.g. session state). We do not use:
- Advertising or tracking cookies
- Third-party analytics cookies without explicit consent
- Fingerprinting, pixel tracking, or behavioural profiling technologies
- Social media tracking buttons or embeds that set cookies without consent
11. Automated Decision-Making
We use automated systems for:
- Transaction velocity checks: automated limits based on KYC tier and transaction patterns
- Fraud scoring: via Flutterwave and Sudo Africa's built-in systems, which may result in transaction refusal
- Sanctions screening: automated matching against OFAC, UN, EU, and AU sanctions lists
Where a significant automated decision affects you (e.g. account freeze or transaction refusal), you have the right to request human review. Contact legal@instantcards.app.
12. Your Rights
Depending on your country of residence, you may have the following rights under applicable data protection law. We will honour these rights to the fullest extent permitted:
| Right | Description | Limitations |
|---|---|---|
| Right of access | Request a copy of all personal data we hold about you | Identity verification required |
| Right of rectification | Correct inaccurate or incomplete personal data | May not apply to immutable audit records |
| Right of erasure ("right to be forgotten") | Request deletion of your personal data | Subject to our legal retention obligations (7-year financial records) |
| Right to restrict processing | Request we limit how we use your data while a dispute is resolved | May temporarily suspend service |
| Right to data portability | Receive your data in a structured, machine-readable format (JSON) | Applies to data you provided; not derived data |
| Right to object | Object to processing based on legitimate interest | We will balance your interests against ours |
| Right to withdraw consent | Withdraw consent for push notifications at any time (in-app or by contacting us) | Does not affect processing before withdrawal |
| Right not to be subject to automated decisions | Request human review of significant automated decisions | See Section 11 |
To exercise any right, contact legal@instantcards.app with your name, phone number, and a clear description of your request. We will respond within 30 calendar days. We may request identity verification before processing sensitive requests.
13. Children's Privacy
instantcards is not directed to, and does not knowingly collect personal data from, individuals under the age of 18. The Service requires a mobile money account, which itself requires minimum age verification by the mobile network operator. If we become aware that a minor has registered, we will immediately delete their account and associated data. If you believe a minor has registered, contact legal@instantcards.app.
14. Data Breach Notification
In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify affected users without undue delay and in any case within 72 hours of becoming aware of the breach. Notification will include: the nature of the breach, the categories of data affected, the likely consequences, and the measures taken or proposed to address the breach.
We will also notify the relevant data protection authority or financial services regulator as required by applicable law.
15. Changes to This Policy
We may update this Policy to reflect changes in our practices, our Service, or applicable law. Material changes will be communicated via push notification and/or email (if provided) at least 14 days before they take effect. The "Last updated" date at the top of this Policy will be revised accordingly. Your continued use of the Service after the effective date constitutes acceptance of the updated Policy. If you do not accept material changes, you must stop using the Service and contact us to close your account.
16. Contact and Complaints
For all privacy matters: legal@instantcards.app
You also have the right to lodge a complaint with the relevant data protection supervisory authority or financial regulator in your country of residence. In Cameroon, this is the Commission Nationale de l'Informatique et des Libertés (CNIL Cameroun) or the COBAC for financial services matters.