ChopBack
Sign In Open App
Privacy & Data Protection

Privacy Policy

Last Updated: October 2026 • Compliant with the Nigeria Data Protection Act (NDPA)

At ChopBack ("we", "us", "our"), protecting your personal information and maintaining your trust is fundamental to our business. This Privacy Policy describes how we collect, use, store, process, and safeguard your data when you interact with our mobile application, web application, and API services.

Plain English Promise: We only collect the data necessary to verify your grocery receipts, award your cashback points, and disburse bank transfers. We never sell your personal contact details, and payment card numbers printed on receipts are never retained.

1. Overview & Data Controller

ChopBack is operated by NewOrbit Labs / Digivo, located in Lagos, Nigeria. For the purposes of the Nigeria Data Protection Act, 2023 (NDPA) and other applicable consumer data protection regulations, NewOrbit Labs acts as the Data Controller responsible for your personal data.

2. Information We Collect

We collect several types of information in order to provide, improve, and secure our Service:

A. Account and Profile Data

  • Identifiers: Email address, mobile telephone number, first name, and last name provided during registration.
  • Credentials: Cryptographically hashed passwords (we never store plain-text passwords).
  • Preferences: Push notification, price alert, and receipt notification preferences.

B. Receipt & Purchase Data

  • Receipt Images: Photos of paper receipts uploaded through your camera or device photo library.
  • Itemized Metadata: Extracted merchant name, store location, purchase date, time, individual items, quantities, prices, and receipt total.
  • Cryptographic Hashes: Digital SHA-256 fingerprint of uploaded images used exclusively for deduplication and anti-fraud validation.

C. Payout and Financial Information

  • Bank Details: Bank name, Nigerian Uniform Bank Account Number (NUBAN), and account holder name necessary to complete requested cashback redemptions.

D. Device and Technical Information

  • IP address, mobile operating system version, browser user agent, crash diagnostics, and API response logs required for platform stability and fraud detection.

3. Payment Card Protection & Redaction

Many supermarket cash register receipts print masked payment card digits (e.g., **** **** **** 1234) or cardholder names.

Important: ChopBack does not collect, store, or process payment card numbers or CVVs. During our optical character recognition (OCR) and document extraction pipeline, card account numbers and payment transaction codes are filtered and discarded. Only product item lines, prices, store names, and totals are retained.

4. How We Use Your Information

We use the collected information for the following legitimate business and service purposes:

  • Receipt Verification & Points Crediting: Validating that receipts meet our quality and eligibility criteria and applying loyalty points and tier multipliers to your wallet balance.
  • Bank Payout Execution: Processing direct bank transfers to your designated Nigerian bank account when you request a cash redemption.
  • Smart Shopping Intelligence: Providing you with personal expense recaps, price tracking across supermarkets, and auto-suggested shopping lists.
  • Aggregated Retail Trends: Combining depersonalized, aggregated purchase data to understand FMCG brand market share and price inflation trends in Nigeria. Individual identities and personal data are never exposed in these industry reports.
  • Fraud Prevention: Detecting altered receipts, duplicate uploads, and unauthorized account access to preserve platform integrity.

5. Data Sharing & Third Parties

We do not sell, rent, or trade your personally identifiable information to advertisers or marketing brokers. We share data only in the following strictly controlled circumstances:

  • Cloud Infrastructure Providers: Secure object storage (Cloudflare R2) and server hosting providers used to store receipt images and run backend processing.
  • AI and OCR Processors: Optical vision and natural language processing engines used to extract text and match FMCG products from receipt images.
  • Financial Payout Partners: Licensed Nigerian banks and payment gateways (such as Paystack or Flutterwave) solely to execute requested NUBAN cash payouts.
  • Legal & Regulatory Obligations: When required by Nigerian law, court order, or governmental authorities to comply with anti-fraud or financial crime inquiries.

6. Data Retention & Right to Deletion

We retain your account data and receipt records for as long as your account remains active, allowing you to access your lifetime points, expense history, and price watch bookmarks.

Right to Complete Account Deletion: You have the right to delete your ChopBack account and associated personal data at any time. You can initiate deletion:

  1. Inside the ChopBack mobile or web application under Profile → Privacy & Security → Request Account Deletion.
  2. By sending an email request from your registered email address to support@chopback.com.

Upon receiving your verified request, we will permanently delete or anonymize your personal account profile, stored bank accounts, and delete receipt images from our storage systems within thirty (30) days, except where retention is strictly required by statutory financial or tax laws.

7. Data Security Measures

We implement robust technical and organizational security controls to protect your data:

  • Encryption in Transit: All communications between your device and our servers use TLS 1.3 encryption.
  • Encryption at Rest: Database backups and cloud object storage are encrypted at rest with AES-256.
  • Access Controls: Server access is restricted through multi-factor authentication (MFA) and least-privilege security policies.

8. Your Rights Under the Nigeria Data Protection Act

Under the Nigeria Data Protection Act (NDPA) 2023, you have the right to:

  • Access: Request a copy of the personal data we hold about you.
  • Rectification: Request correction of inaccurate or incomplete personal information.
  • Erasure: Request the deletion of your personal data ("right to be forgotten").
  • Restriction & Objection: Object to or restrict the processing of your data under certain conditions.
  • Data Portability: Obtain your personal data in a structured, commonly used machine-readable format.

To exercise any of these rights, contact our Data Protection Team at support@chopback.com. We respond to all verified requests within thirty (30) days.

9. Local Storage & Diagnostics

Our web and mobile applications use secure local storage (such as Expo SecureStore and browser localStorage) solely for session token management, offline caching, and user preference persistence. We do not use third-party cross-site tracking cookies.

10. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or how your data is handled, please reach out to us:

  • Email: support@chopback.com
  • Data Protection Officer: NewOrbit Labs / Digivo
  • Office: Lagos, Nigeria