Privacy Policy

Last updated: 4 November 2026

This policy explains what personal data Almighty Pumps (“we”, “us”) collects when you use almightypumps.com, why we collect it, who we share it with and the choices you have. We follow the Nigeria Data Protection Act 2023 (NDPA). If anything here is unclear, email support@almightypumps.com.

1. Who we are

Almighty Pumps is an online platform based in Lagos, Nigeria. We are the data controller for the personal data described here. Contact: support@almightypumps.com.

2. What we collect

• Account: your name, email address, phone number (optional) and password. We store passwords only as a one-way hash; we can't read them.
• Wallet and payments: your Naira balance, top-ups, charges, refunds and withdrawals. Card and bank payments are processed by Flutterwave; we do not receive or store your full card number. For withdrawals we keep the bank name, account number and account name you give us.
• Orders: the details needed to deliver what you buy, e.g. the link or username for a social-growth order, the app you need a verification code for (and the SMS code we show you), gift-card or shop orders.
• eSIM orders: your phone's IMEI number and, if you keep an existing number, the transfer details (number, carrier, account number, transfer PIN, ZIP code and account holder's name). Transfer details are stored encrypted and deleted once your order is delivered or refunded.
• Sellers: shop name, contact phone, what you sell, payout bank details, ID type and ID number, and your shop picture. ID and full account numbers are visible only to our admins.
• P2P marketplace: your ads, purchases, trade messages, delivery proof, disputes and their outcome.
• Usage: which pages and sections of the site are visited, linked to a random cookie ID (and to your account if you are logged in). We do not store your IP address or device details for this.
• Security: to stop password guessing and abuse we count requests per network and per account. We email you a one-time code when you sign up and when you log in on a new device; we store only a scrambled copy of each code, and it stops working after 10 minutes. These counters are scrambled (hashed) so they don't contain your IP address or email, and are deleted after a day.
• Messages to us: anything you send to our email or support.

3. Why we use it (and our legal basis)

• To provide the services you ask for: your account, wallet, orders, eSIMs, the marketplace and escrow (performance of a contract).
• To keep the platform safe: preventing fraud, stolen-card top-ups, fake accounts, bots and abuse; resolving disputes (legitimate interests, and legal obligations).
• To meet legal duties: accounting, tax, anti-money-laundering and lawful requests from authorities (legal obligation).
• To improve the site: understanding which sections are used (legitimate interests).
• To contact you about your account, orders and important changes (performance of a contract; marketing only with your consent).

We do not sell your personal data.

4. Who we share it with

We share only what each service needs to do its job:

• Flutterwave: processes wallet
• Other users: in the P2P marketplace, buyers see the seller's shop name, picture, ratings and ad answers; sellers see what a buyer ordered and their trade messages.
• Authorities: when the law requires it, or to protect users from fraud.

Some of these providers process data outside Nigeria (for example in the EU or the United States). Where that happens we rely on the safeguards allowed by the NDPA, such as the provider's contractual data-protection commitments.

5. How long we keep it

• Account data: while your account is open, and for a reasonable period after you close it to settle any balance or dispute.
• Wallet, payment and order records: as long as the law requires for financial records (generally up to 6 years).
• eSIM number-transfer details: deleted as soon as the order is delivered or refunded.
• Security counters: deleted after one day.

6. Cookies and similar storage

• ap_session: keeps you logged in. With “Remember me” it lasts 30 days; otherwise it ends when you close your browser.
• ap_vid: a random ID used to count page visits (see “Usage” above).
• Your browser also remembers your settings on your device only: theme, ₦/$ display, hidden balance and, if you ticked “Remember me”, your email address (never your password).
• ap_device: a random code that marks this device as one you've confirmed with an email code, so you aren't asked again for 30 days.

7. How we protect it

Encrypted connections (https) everywhere, hashed passwords, encrypted storage for sensitive details such as eSIM transfer information and provider keys, limits on login attempts, email codes for new sign-ups and new devices, and admin-only access to ID and bank details. No system is perfectly secure; if a breach affects you, we will tell you and the regulator as the law requires.

8. Your rights

Under the NDPA you can ask us to: see a copy of your data; correct it; delete it (where we don't need to keep it by law); restrict or object to how we use it; receive it in a portable format; and withdraw consent you gave us. Email support@almightypumps.com from your account email and we will reply within 30 days. If you're unhappy with our answer you can complain to the Nigeria Data Protection Commission (NDPC).

9. Age

Almighty Pumps is for people aged 18 and over. We do not knowingly collect data from children.

10. Changes

We may update this policy. We will change the date at the top and, for important changes, tell you by email or on the site.