Privacy Policy for Converge Socials

Last Updated: 27th of June 2026

1. Introduction

This Privacy Policy explains how CONVERGE SOCIALS NIG LTD, trading as Converge Socials (“Converge Socials”, “we”, “us”, or “our”), collects, uses, stores, shares, protects, and otherwise processes personal data when you use the Converge Socials mobile application, website, admin systems, wallet features, academic hub, messaging features, vendor tools, and related services.

Converge Socials combines school-based social networking, academic content, past questions, in-app wallet and payments, messaging, rewards, vendor tools, and admin moderation. Because the platform handles social content, financial activity, identity data, school affiliation, messages, files, and safety reports, this policy is intentionally detailed.

This policy is intended to align with the Nigeria Data Protection Act, 2023 and other applicable data protection laws. If a local law gives you stronger rights than this policy, we will apply that law where required.

2. Who We Are and How to Contact Us

For data protection purposes, CONVERGE SOCIALS NIG LTD is the organisation responsible for deciding how and why personal data is processed through Converge Socials, except where a third-party provider independently determines its own processing under its own terms or privacy notice.

• Controller / Company: CONVERGE SOCIALS NIG LTD
• Trading Name: Converge Socials

Registered Address: 1, GRANVILLE DRIVE, CASTLE AND GREEN, ESTATE, OFF ENEKA LINK ROAD, PORT, HARCOURT , RIVERS STATE, NIGERIA

Support Email: info@convergesocials.com

Privacy Contact / Data Protection Contact: jonathan@convergesocials.com

Data Protection Officer: Jonathan Obulor/CEO, contactable at jonathan@convergesocials.com

Website: convergesocials.com

3. Scope of This Policy

This policy applies to personal data processed when you:

• create, verify, access, or manage a Converge Socials account;
• use social features such as profiles, posts, comments, likes, reposts, shares, bookmarks, statuses, communities, follows, blocks, or mutes;
• use messaging, direct messages, group chats, media sharing, voice notes, files, or read receipts;
• use the academic hub, browse or purchase past questions, upload academic materials, gift access, download files, or submit answers;
• register or operate as a vendor;
• create or use a wallet, provide BVN information, fund a wallet, send gifts, receive rewards, purchase boosts, add bank accounts, or request withdrawals;
• receive emails, in-app notifications, push notifications, SMS, or platform announcements;
• submit reports, contact support, use the public contact form, or interact with admins;

use the app from a device, browser, or network that generates technical logs such as IP address, user agent, device metadata, and session data.

This policy does not replace the privacy notices of third-party providers, app stores, banks, identity providers, email providers, cloud providers, or payment partners.

4. Personal Data We Collect

We collect different categories of personal data depending on the features you use.

4.1 Account and Identity Data

• name, username, email address, phone number, password hash, role, school, optional birth date, verification status, and account status;
• email change records, old and new email metadata, and security challenge records;
• OTP records, reset tokens, verification tokens, expiry timestamps, retry counts, and related security metadata. OTPs and passwords should not be stored in plaintext;

BVN and identity-verification information where required for wallet or compliance features. Full BVN is processed for verification through our identity/wallet verification providers and is not retained by Converge Socials after the verification transaction is complete. We retain only masked BVN where necessary, verification result, verification timestamp, provider reference, and compliance metadata.

4.2 Profile, School, and Role Data

• profile photo, bio, role badge, school badge, school affiliation, discovery preferences, profile visibility settings, and message privacy settings;
• school, course, department, level, semester, and academic catalogue interactions where applicable;

vendor profile details, including business name, business description, location, school, phone number, logo, verification status, and related admin decisions.

4.3 Social Content and Interaction Data

• posts, captions, text, media attachments, screenshots, link previews, GIF metadata, polls, poll votes, mentions, hashtags, post visibility, school or community scope, and edit/delete history;
• likes, comments, replies, comment likes, reposts, bookmarks, shares, post views, view timestamps, share channel tags, engagement counts, and gift totals;
• follow, unfollow, followers, following, block, mute, mute expiry, groups in common, and other relationship data;
• communities, memberships, invitations, admin roles, private/public community status, and community posts;

temporary statuses, status media, status expiry time, status viewer identity, and view timestamps.

4.4 Messaging and Conversation Data

• direct messages, group messages, message text, images, videos, voice notes, files, replies, scheduled messages, edits, deletes, delivery metadata, read receipts, read timestamps, conversation membership, group admins, and shared content indexes;

message metadata such as sender, recipients, conversation ID, timestamps, attachment type, and message status.

4.5 Academic Hub and Past Question Data

• past-question browsing activity, access state, purchase records, gift records, personal library records, download activity, and presigned URL activity;
• uploaded academic files, titles, descriptions, year, semester, course, school, uploader identity, approval status, rejection notes, admin review history, and community answers;

records showing whether content was free, purchased, gifted, restricted, approved, rejected, or withdrawn.

4.6 Wallet, Financial, and Payment Data

• wallet account information, Rubies virtual account details, wallet balance, earned totals, spent totals, full transaction history, ledger entries, payment references, gateway responses, idempotency keys, and webhook metadata;
• wallet PIN hashes, PIN verification records, wallet security tokens, reset challenges, OTP confirmations, and sensitive-action logs;
• bank account name, bank account number, bank code, bank name, account enquiry results, saved payout accounts, primary account status, withdrawals, withdrawal amounts, approval status, rejection reason, processing metadata, and admin action history;

money gifts, academic gifts, post-linked gifts, sender and receiver IDs, amounts, optional messages, post association, reward earnings, reward conversion history, boost purchases, boost tiers, impressions, clicks, engagement metrics, and related wallet transactions.

4.7 Device, Session, Technical, and Activity Data

• device name, platform, session ID, login timestamps, logout timestamps, token versioning metadata, refresh-token rotation records, IP address, user agent, browser or app metadata, and session status;
• push notification tokens, platform field, token status, notification preferences, unread counts, and delivery metadata;
• search queries, explore interactions, trending and discovery interactions, analytics events, activity logs, report metadata, admin audit logs, moderation notes, and support activity;

file metadata such as file name, content type, size, storage key, upload purpose, owner, alt text, and presigned URL metadata.

4.8 Contact Form and Support Data

full name, email address, message text, attachments, support messages, complaint details, evidence, screenshots, transaction references, and communication history.

5. How We Collect Personal Data

We collect personal data directly from you when you create an account, update your profile, submit forms, upload content, send messages, make payments, verify your identity, add bank details, report content, or contact support.

We also collect data automatically when you use the App, including session metadata, IP address, user agent, device data, logs, engagement events, view events, search interactions, notification activity, and analytics data.

We may receive data from third-party providers, including wallet providers, banks, identity verification providers, email providers, push notification providers, app stores, cloud providers, and other service providers used to operate the App.

6. Lawful Bases for Processing

Depending on the situation and applicable law, we may process personal data on one or more of the following bases:

• Contract: to provide the App, accounts, academic access, wallet features, messaging, vendor tools, and support your request;
• Consent: where we ask for permission, such as optional communications, certain notification preferences, or optional profile/discovery settings;
• Legal obligation: to comply with applicable laws, regulatory requirements, financial record obligations, tax, fraud prevention, identity verification, dispute handling, and law-enforcement requests where legally valid;
• Legitimate interests: to secure the App, prevent fraud, improve features, moderate content, investigate reports, maintain logs, run analytics, detect abuse, and protect users and the platform;
• Vital or public-interest grounds: where processing is necessary to protect someone from serious harm or respond to lawful public authority requirements;

User-published content: where you intentionally publish content to public, school, community, vendor, or social areas of the App under the visibility settings you choose.

7. How We Use Personal Data

We use personal data to:

• create, authenticate, verify, secure, and manage accounts;
• provide login, logout, session management, token refresh, password reset, password change, email change, and account deactivation features;
• display profiles, role badges, school badges, public profiles, user directories, and visibility-scoped follower lists;
• operate social feeds, posts, comments, reposts, likes, bookmarks, shares, polls, statuses, communities, hashtags, search, explore, and recommendations;
• enable messaging, group chats, attachments, voice notes, scheduled messages, replies, shared content views, and read receipts;
• operate the academic hub, past-question access, purchases, gifts, uploads, downloads, review workflows, and personal libraries;
• operate vendor profiles, vendor dashboards, vendor posts, and vendor verification;
• create and manage wallets, virtual accounts, funding, bank account enquiry, saved payout accounts, withdrawals, wallet PINs, transaction history, gifts, rewards, boosts, and ledgers;
• send transactional emails, OTPs, password reset messages, in-app notifications, push notifications, admin announcements, and support messages;
• process reports, moderate content, investigate suspicious activity, enforce rules, and protect users;
• administer the platform, generate analytics, rebuild aggregated snapshots, debug issues, improve reliability, and maintain audit logs;

comply with legal, regulatory, accounting, security, and dispute-resolution obligations.

8. Public, School, Community, and Private Visibility

Converge Socials includes visibility settings and social features. Some data may be visible to other users depending on your role, profile settings, post visibility, school scope, community membership, or feature rules.

Your public or visible information may include your name, username, profile photo, role badge, school badge, bio, posts, comments, reposts, vendor profile, communities, followers/following lists, and other content you choose to publish.

School-only or community-only content may be shown to users who meet the relevant school, community, or access criteria. Private or restricted content is intended to be limited, but no online system can guarantee that other users will not copy, screenshot, record, or redistribute content they can view.

Bookmarks, muted users, some privacy settings, some wallet data, and private account/security information are not intended to be public.

9. Messaging Privacy

Messages are intended for the participants in the relevant direct conversation or group chat. Message content, attachments, read receipts, group membership, and message metadata are processed so we can deliver messaging features.

Messages are not treated as public content, but authorised personnel may access or review messages where necessary for support, safety, moderation, abuse investigation, legal compliance, technical troubleshooting, account security, or where a conversation or message is reported.

Message attachments may be stored in cloud object storage and accessed using time-limited links or internal systems. Recipients may save, copy, screenshot, forward, or otherwise preserve messages outside the App, and we cannot control what recipients do with messages they receive.

10. Wallet, BVN, Bank, and Financial Data

Wallet and financial features are sensitive. We process wallet, identity, bank, and transaction data to create wallet accounts, verify identity, provision virtual accounts, process bank transfers, handle wallet funding, perform name enquiry, record transactions, enable gifts and rewards, process withdrawals, and prevent fraud.

We collect or process BVN and identity verification information only where required for wallet-related identity checks, fraud prevention, regulatory compliance, or account security. Full BVN is processed through our identity/wallet verification providers, including Prembly and Rubies where applicable. Converge Socials does not retain the full BVN after the verification transaction is complete. We retain only masked BVN where necessary, verification result, verification timestamp, provider reference, and compliance metadata. Full BVN must not be logged, displayed to admins unnecessarily, or stored in plaintext.

We do not intend to store plaintext wallet PINs, passwords, or OTPs. Wallet PINs, passwords, and OTPs should be hashed or otherwise protected according to the applicable security design.

We may retain financial records, wallet ledgers, transaction histories, gateway responses, webhook records, withdrawal records, bank account records, and admin action logs for legal, accounting, fraud prevention, dispute resolution, audit, and compliance purposes.

11. Academic Content and User Uploads

When you browse, purchase, upload, gift, download, or submit academic content, we process data related to the course, school, material, uploader, access status, purchase, gift, download activity, admin review, and file metadata.

Uploaded academic content may be reviewed by admins before approval. Admins may approve, reject, remove, moderate, or restrict academic uploads where necessary for quality, safety, legal compliance, platform rules, intellectual property concerns, or abuse prevention.

Vendors may be allowed to upload academic content but are restricted from accessing restricted academic materials where the platform rules provide that restriction.

12. Vendor Data

If you register or operate as a vendor, we may process vendor profile data such as business name, description, location, school, phone number, logo, posts, dashboard metrics, academic uploads, verification status, and admin review decisions.

Vendor profile information you provide, including business name, description, school affiliation, location, phone number, logo, public posts, and related commercial information, may be publicly visible to users of Converge Socials and may appear in search, discovery, feeds, vendor pages, and other app surfaces. Vendor verification is handled by Converge Socials admins and may involve review of submitted business information or documents. Vendors are responsible for ensuring that submitted information is accurate, lawful, and does not infringe third-party rights. Vendors may also be subject to additional vendor terms or agreements governing their commercial relationship with Converge Socials.

13. Notifications and Communications

We may send you account, security, wallet, academic, moderation, transactional, service, support, and administrative communications. These may include OTPs, password reset emails, wallet alerts, withdrawal updates, academic access notifications, moderation notices, rewards notices, messages, gifts, boosts, and admin announcements.

Depending on your settings and feature availability, we may send communications through email, in-app notifications, push notifications, SMS, or other channels. You can adjust some notification preferences in the App, but we may still send important security, account, legal, or transactional messages where necessary.

14. Search, Explore, Analytics, and Recommendations

We may process search queries, discovery interactions, follows, likes, views, hashtags, trending activity, school/community interactions, post engagement, and related usage data to provide search, explore, recommendations, trending hashtags, who-to-follow suggestions, community suggestions, analytics, and platform improvement.

We may use aggregated or de-identified analytics to understand platform activity, including users, social engagement, messaging, academic access, vendors, financial activity, moderation, and daily snapshots. Aggregated analytics are not intended to identify individual users.

15. Reports, Moderation, Safety, and Admin Access

We process reports, reporter identity, reported content, reason text, moderation notes, assigned admins, admin actions, activity logs, IP address, user agent, and related evidence to investigate abuse, enforce rules, protect users, resolve disputes, and maintain platform safety.

Admins may access user records, posts, comments, statuses, communities, messages, wallets, transactions, withdrawals, rewards, boosts, push tokens, vendor records, school/course records, reports, and activity logs where necessary for authorised operations, safety, support, compliance, fraud prevention, moderation, and platform management.

Admin actions may be recorded in audit logs. Audit logs may be retained to preserve accountability and investigate misuse, disputes, or unauthorised access.

16. Files, Media, and Cloud Storage

Converge Socials allows uploads such as profile photos, post media, status media, message attachments, voice notes, documents, academic files, vendor logos, community images, screenshots, and other files.

Files may be stored using Cloudflare R2 or another S3-compatible object storage provider. Access may be controlled through storage keys, internal permissions, and time-limited presigned URLs. File metadata such as content type, size, owner, usage tag, upload date, and alt text may be stored in our systems.

You should not upload files that contain personal data, confidential information, illegal content, malware, or third-party materials unless you have the right and lawful basis to do so.

17. Third-Party Services and Data Sharing

We share personal data only where reasonably necessary to operate, secure, support, improve, or comply with the requirements of the App. Third-party services may process data under their own terms, privacy notices, and compliance obligations.

Current provider and sharing categories include:

We may also share data with professional advisers, auditors, legal advisers, compliance consultants, business partners, or corporate transaction parties where necessary and lawful.

App store privacy and data-safety disclosures. Our Apple App Store privacy details, Google Play Data Safety form, and in-app privacy disclosures should match this policy and the actual SDKs, providers, permissions, and data flows used in the App. Before store submission and whenever new SDKs or providers are added, we should audit the App's SDKs, permissions, and provider data practices and update the policy, App Store privacy labels, and Google Play Data Safety form where required.

18. International Transfers

Some third-party providers, cloud systems, email systems, notification systems, infrastructure providers, support tools, or analytics services may process or store data outside Nigeria.

Where personal data is transferred outside Nigeria, we will use lawful transfer safeguards required by applicable data protection law. These may include data processing agreements, Standard Contractual Clauses, provider security and privacy commitments, recognised adequacy mechanisms, contractual confidentiality obligations, technical safeguards, encryption in transit, access controls, and transfer-risk due diligence.

For example, Cloudflare R2, Resend, push notification providers, hosting providers, and analytics or infrastructure providers may process data internationally. Before launch and before adding new international providers, we should confirm the applicable Data Processing Agreement, transfer mechanism, and security commitments for each provider.

19. Data Retention

We retain personal data only for as long as necessary for the purposes described in this policy, including providing the App, maintaining account records, meeting legal obligations, resolving disputes, enforcing terms, preventing fraud, securing the platform, supporting financial audits, and maintaining moderation records.

Our current retention schedule is:

Data Category | Typical Retention Period

Account and profile data | While the account is active, then up to 12 months after deletion or deactivation unless longer retention is required for legal, security, fraud, dispute, or audit reasons.

Financial, wallet, transaction, gift, reward, boost, bank, withdrawal, ledger, and payment records | 7 years or any longer period required by applicable tax, accounting, financial, regulatory, anti-fraud, dispute, or audit obligations.

BVN verification metadata | Only as long as needed to prove wallet identity verification, comply with financial/regulatory obligations, prevent fraud, and support audit requirements. Full BVN is not retained by Converge Socials after the verification transaction is complete.

Posts, comments, reposts, statuses, academic uploads, vendor content, and other user-generated content | While published or active, until deleted by the user or removed by us, subject to backups, reposts, reports, moderation records, legal holds, and records needed for disputes or safety.

Messages and group chat content | While the conversation/account remains active or until deleted where deletion is available, subject to recipient copies, reports, moderation records, backups, legal holds, and safety investigations.

Security logs, session metadata, IP address, user agent, device/session logs, admin audit logs, and activity logs | Up to 12 months, unless longer retention is required for fraud prevention, security investigation, legal compliance, or dispute handling.

Device push tokens | While active and associated with your account/session, then deleted or invalidated when you log out, revoke sessions, deactivate/delete your account, or the token becomes inactive.

Support, complaint, and contact form records | Up to 3 years after the matter is closed, unless a longer period is needed for legal, dispute, fraud, or compliance reasons.

Moderation reports, evidence, admin notes, enforcement records, and safety decisions | Up to 12 months after closure, unless longer retention is required for repeat-abuse monitoring, legal compliance, user safety, or dispute handling.

Backup data | Overwritten or deleted within a 90-day backup cycle, unless backup restoration, legal hold, incident response, fraud investigation, or disaster recovery requires longer retention.

Aggregated or de-identified analytics | May be retained for a longer period where it no longer reasonably identifies an individual user.

We may retain specific records for longer where required by law, court order, regulator request, financial compliance, dispute handling, fraud prevention, security investigation, or protection of users and the platform.

20. Security Measures

We use reasonable administrative, technical, and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration, disclosure, or destruction.

These measures may include password hashing, PIN hashing, OTP hashing, token rotation, session revocation, access controls, audit logs, rate limits, expiry rules, retry limits, restricted admin permissions, cloud access controls, presigned URLs, encryption in transit, infrastructure monitoring, backups, and fraud detection.

No system is completely secure. You are responsible for keeping your password, device, wallet PIN, email account, OTPs, and login sessions secure. You should notify us immediately if you suspect unauthorised access or suspicious activity.

21. Children and Minimum Age

Converge Socials is intended for users aged 18 and above. By creating an account or using the App, you confirm that you are at least 18 years old.

If we discover that a user under 18 has registered, we may suspend the account, restrict access, and delete or anonymise the account and related personal data, subject to legal, safety, fraud-prevention, moderation, backup, and recordkeeping requirements.

If Converge Socials later launches features intended for users under 18, including any JAMBite or secondary-school-focused feature, we will update this policy, provide any required child-friendly privacy notice, and implement parental or guardian consent where required by applicable law before processing children's data for those features.

22. Your Privacy Choices and Controls

Depending on feature availability, you may be able to control or update:

• profile fields, avatar, bio, username, and school selection;
• profile visibility: public, school-only, or private;
• profile discovery opt-in or opt-out;
• who can message you;
• follow, unfollow, block, and mute settings;
• notification preferences by channel or topic;
• saved bank accounts, primary payout account, and wallet security settings;
• post, status, community, and content visibility choices;

account deactivation and session revocation.

Some controls may be unavailable, limited, or subject to retention requirements where data is needed for security, legal, financial, moderation, support, or audit purposes.

23. Your Data Protection Rights

Subject to applicable law and verification of your identity, you may have rights to:

• be informed about how your personal data is processed;
• request access to your personal data;
• request correction of inaccurate or incomplete data;
• request deletion of personal data in certain circumstances;
• request restriction of processing in certain circumstances;
• object to processing in certain circumstances;
• withdraw consent where processing is based on consent;
• request data portability where applicable;
• object to certain automated decisions where applicable;

complain to the Nigeria Data Protection Commission or another competent data protection authority.

We may refuse, limit, or delay a request where permitted by law, including where we need to verify your identity, protect another person’s rights, preserve financial or audit records, prevent fraud, comply with legal obligations, maintain security logs, investigate disputes, or retain moderation records.

To exercise your rights, contact us at info@convergesocials.com We may ask you to verify your identity before acting on your request.

24. Account Deactivation, Deletion, and Content Removal

You may deactivate your account through an OTP-confirmed process where this feature is available. Deactivation may revoke sessions and push tokens and restrict account access, but deactivation is not the same as permanent account deletion.

You may request permanent account deletion through Settings > Delete Account within the App, or by emailing info@convergesocials.com. We may require identity verification, OTP confirmation, or other reasonable checks before processing the deletion request.

After a verified deletion request, we aim to delete or anonymise personal data associated with your account within 30 days, except where retention is required or permitted for legal, financial, tax, accounting, fraud-prevention, security, dispute, moderation, backup, or regulatory reasons.

Some data may remain where necessary, including financial records retained for 7 years, moderation/report records retained for up to 12 months, security and audit logs retained for up to 12 months, backup copies overwritten within our backup cycle, and content that other users have saved, copied, screenshotted, quoted, reposted, received in messages, or are legally entitled to retain.

If deletion is requested while a wallet, payment, withdrawal, dispute, investigation, fraud review, or legal issue is pending, we may delay deletion of relevant records until the issue is resolved or until retention is no longer required.

25. Automated Processing, Recommendations, and Metrics

Converge Socials may use automated or semi-automated systems to support feeds, explore, trending hashtags, suggestions, engagement metrics, rewards, fraud detection, boost tracking, search ranking, notifications, spam detection, and moderation workflows.

The current version of Converge Socials does not use third-party AI tools to process personal data. If we introduce AI or machine-learning tools that process personal data, including third-party AI tools for feed recommendations, fraud detection, content moderation, study suggestions, AI study support, or similar features, we will clearly disclose the tool, purpose, data involved, and obtain explicit permission where required before the feature is used.

We do not intend to make legally significant decisions solely by automated processing without appropriate safeguards where applicable law requires such safeguards. Human admins may review reports, wallet issues, verification failures, withdrawals, academic uploads, content moderation decisions, suspicious activity, and support escalations.

26. Data Breach and Incident Handling

If we become aware of a personal data breach or security incident that affects personal data, we will investigate and take reasonable steps to contain, assess, and remediate the issue.

Where required by applicable law, we will notify the Nigeria Data Protection Commission, affected users, or other relevant parties within the required timeframe and with the required information.

27. Cookies, Local Storage, and Similar Technologies

Where Converge Socials operates through a website, dashboard, admin panel, or browser-based interface, we may use cookies, local storage, device identifiers, or similar technologies for login, session management, security, preferences, analytics, and performance.

Mobile app usage may also involve device identifiers, push tokens, app analytics, crash logs, and local app storage. You may control some permissions through your device settings, but disabling certain permissions may affect app functionality.

28. Third-Party Links and External Content

The App may contain links, previews, vendor information, user-submitted links, academic files, external websites, or third-party content. We are not responsible for the privacy practices, security, content, or policies of third-party websites or services that we do not control.

You should review the privacy policy and terms of any third-party service before using it or sharing personal data with it.

29. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect product changes, legal requirements, operational changes, provider changes, or improvements to our privacy practices.

We may notify you of material changes through the App, website, email, in-app notice, push notification, or another reasonable method. The updated policy will take effect from the date stated in the policy or notice.

Your continued use of Converge Socials after the updated policy takes effect means you acknowledge the updated policy.

30. Contact Us

If you have questions, requests, complaints, or concerns about this Privacy Policy or how we process personal data, contact us at:

Converge Socials

Owned and operated by: CONVERGE SOCIALS NIG LTD

Registered Address: 1, GRANVILLE DRIVE, CASTLE AND GREEN, ESTATE, OFF ENEKA LINK ROAD, PORT, HARCOURT , RIVERS STATE, NIGERIA

Support Email: info@convergesocials.com

Privacy Contact / Data Protection Contact: info@convergesocials.com

Website: convergesocials.com