Privacy Policy

Last updated: 15 October 2026

This Privacy Policy explains how Mekudi collects, uses, shares and protects personal data when you visit our website, use the Mekudi dashboard, integrate with our API, pay a business that uses Mekudi, or contact us. We wrote it to be read, not skimmed past: if anything is unclear, ask us.

1. Who we are

Mekudi is a payments platform operated by Sandbox Technologies & Innovations ("Mekudi", "we", "us", "our"). We help businesses accept payments by card and bank transfer, hold balances in a ledger, and pay out to verified bank accounts.

We process personal data in line with the Nigeria Data Protection Act 2023 (NDPA) and, where they apply to you, the EU General Data Protection Regulation (GDPR) and the UK GDPR.

2. Our role

Businesses and their people. For merchants (businesses with a Mekudi account), their directors, owners and team members, we are the data controller.
A merchant's customers. When a merchant sends us their customer's details to verify them and process payments, the merchant is a controller of that data. We are also an independent controller for the parts we must carry out ourselves by law: identity verification, anti-money-laundering (AML) and counter-terrorist-financing (CFT) checks, fraud prevention and record keeping.
Visitors and enquiries. For people browsing our website or contacting our team, we are the controller.

3. What we collect

Information you or a merchant give us

Account details: name, work email, phone number, role, password (stored only as a salted hash) and two-step verification settings.
Identity (KYC) details: first and last name, date of birth, nationality, country of residence, residential address, and identity numbers such as a Bank Verification Number (BVN), National Identification Number (NIN), passport, national ID card or driver's licence number.
Identity documents: photos or scans of identity documents (both sides where the document has two), proof of address (for example a utility bill or bank statement), and, where needed, a selfie.
Source of funds: where the money moving through Mekudi comes from, with supporting evidence such as a statement of account, payslips, audited accounts, or an investment or loan agreement.
Business (KYB) details: legal and trading name, registration and tax numbers, registered address, industry, expected volumes, certificates of incorporation and registers of directors and shareholders, and the identity details above for every director and every owner of 25% or more.
Payout details: the bank accounts you ask us to pay out to.
Communications: messages to our support and compliance teams, answers to requests for information, appeals, and enquiries sent through our contact form.

Information we collect as you use Mekudi

Transaction data: amounts, currencies, dates, payment method, payer and payee names, bank and card details needed to complete the payment (full card numbers are handled by our PCI DSS-certified card processing partners, not stored by us), and the status of each payment, refund, dispute and payout.
Technical data: IP address, device and browser type, sign-in times, and security events such as failed sign-ins. We use these to keep accounts secure and to enforce IP allow-lists on API keys.

Information from other sources

Identity verification services and official registers that confirm identity numbers, names and dates of birth (for example, the BVN record held by Nigerian banks), and company registries.
Sanctions, politically exposed persons (PEP) and adverse-media screening lists.
Banks, card networks and payment partners, about the payments we process, disputes and suspected fraud.

4. How we use it, and why we are allowed to

Purpose	Lawful basis
Opening and running accounts, processing payments, settlements, refunds and payouts	Performance of a contract
Verifying identity (KYC/KYB), screening against sanctions and PEP lists, checking source of funds, monitoring transactions, reporting suspicious activity, and keeping records	Legal obligation, including the Money Laundering (Prevention and Prohibition) Act 2022, the Terrorism (Prevention and Prohibition) Act 2022 and Central Bank of Nigeria regulations
Preventing fraud, securing accounts, investigating disputes and chargebacks	Legitimate interests and legal obligation
Service and security notices, and answering your enquiries	Contract and legitimate interests
Improving our services using aggregated or de-identified data	Legitimate interests
Cookies that keep you signed in and remember your display preferences	Consent

We do not sell personal data, and we do not use it for third-party advertising.

5. Identity checks and automated decisions

When identity details are submitted, we check them automatically. For example, a Nigerian BVN is compared with the name and date of birth on the BVN record. If the details do not match, or the number does not exist, the account is suspended at once to prevent fraud. No person or business is approved automatically: a member of our compliance team reviews every verification before an account can transact. If an automated check has suspended you or your customer, you can appeal, and a person reviews the appeal.

We share personal data only as needed for the purposes above:

Payment and banking partners: licensed banks, payment processors and card networks that move funds, issue virtual accounts and settle payments.
Identity and compliance providers: services that verify identity numbers and documents and screen against sanctions and PEP lists.
Infrastructure providers: hosting, email delivery and security services that process data on our instructions under written contracts.
The merchant you pay: the payment details they need to fulfil your order and handle refunds or disputes.
Authorities: regulators, the Nigerian Financial Intelligence Unit, law enforcement and courts, when the law requires us to.
Professional advisers and successors: auditors and lawyers under duties of confidentiality, and a buyer or successor of our business, who would be bound by this policy.

7. International transfers

Some of our partners process data outside Nigeria or your country. When we transfer personal data abroad, we do so as the NDPA and, where relevant, the GDPR allow: to countries with adequate protection, or with appropriate safeguards such as standard contractual clauses, and only to recipients bound to protect it.

8. How we protect it

All identity (KYC) data is encrypted at rest with AES-256-GCM, separately from the database's own protections. This includes names, dates of birth, nationality, addresses, identity numbers (BVN, NIN, passport and ID numbers), source-of-funds details and every uploaded document. Merchants and their API see only the last four digits of identity numbers.
Data in transit is protected with TLS. Uploaded files are checked by their content before they are accepted.
Every person who signs in to Mekudi uses two-step verification. Staff access is restricted by role and network, and every view of a full identity number or document is logged.
API keys are signed per request and can be restricted to IP addresses you approve.

No system is perfectly secure. If a breach affects your personal data in a way that risks your rights, we will notify you and the relevant authority as the law requires.

9. How long we keep it

KYC, KYB and transaction records: for at least five years after the business relationship ends or the transaction completes, as anti-money-laundering law requires, and longer if a regulator, court or investigation requires it.
Account and security logs: for as long as the account is open and up to two years after.
Enquiries through our contact form: for up to two years, unless they lead to a business relationship.

When we no longer need personal data, we delete it or anonymise it.

10. Your rights

Depending on where you live, you can ask us to:

give you a copy of the personal data we hold about you;
correct data that is wrong or incomplete;
delete data, or restrict how we use it, where we have no legal duty to keep it;
send your data to you or another provider in a portable format;
stop using it for a purpose based on our legitimate interests;
withdraw consent you gave, such as consent to cookies, at any time; and
have a person review a decision made automatically.

To use these rights, email [email protected]. We will confirm your identity first, and reply within 30 days. If you are a merchant's customer, you can also contact that merchant. Some data we must keep by law even if you ask us to delete it; if so, we will tell you.

You also have the right to complain to the Nigeria Data Protection Commission (ndpc.gov.ng) or to the data protection authority where you live.

11. Cookies and similar technologies

We use only the cookies and browser storage Mekudi needs to work. We do not use advertising, analytics or third-party tracking cookies. Nothing is stored on your device until you accept cookies in the banner. If you decline, you can still read our website, but you cannot sign in to the dashboard, because signing in needs a cookie.

Name	Type	What it does	How long
mk_consent	Cookie	Remembers that you accepted cookies	1 year
mk_sess	Cookie (HttpOnly, secure)	Keeps you signed in to the merchant dashboard	Until you sign out or close the browser; the session ends after 60 minutes idle and 12 hours at most
mk_staff	Cookie (HttpOnly, secure)	Keeps Mekudi staff signed in to the staff console	Until sign-out or browser close; ends after 30 minutes idle
theme, mekudi.theme, mekudi.checkout.theme	Local storage	Remembers whether you chose the light or dark theme	Until you clear it or withdraw consent

Our hosted checkout page may load our card processing partner's secure card fields. They use their own strictly necessary storage to protect card details and prevent fraud while you pay.

12. Children

Mekudi is for businesses and adults. We do not knowingly collect personal data from children under 18, except as the law requires to verify the owners of a business. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes to this policy

We will update this policy when our practices or the law change, and show the new date at the top. If a change is significant, we will tell merchants by email or in the dashboard before it takes effect.

14. Contact us

Data Protection Officer, Sandbox Technologies & Innovations (Mekudi)
Email: [email protected]