Updated 30 October 2026
Privacy
What guap collects while you use it, why, who else sees it, and how long it is kept. Written to be read, so it says the specific things rather than the general ones.
In short
- We never see your wallet's keys, and there is no password.
- Our payment partner receives what it needs to move naira: your email, the bank account, the amount, and your wallet address.
- Your BVN and selfie, if you verify, go to our partner for the check. We never store them.
- Purchases and cash outs are kept for seven years, as financial records must be. Nothing is sold.
Your account
When you sign in with Google, we keep:
- Your name, email address and profile picture, as Google provides them.
- Your wallet addresses.
- Settings you choose, such as your preferred network, avatar and savings goal.
- When you signed in and were last active, with the IP address, approximate location and browser of each sign-in.
- Your account level and what you have used of your limits.
Your activity
Transfers to and from your addresses are public on the blockchain. We read them and keep a copy so your activity shows up quickly. Your balance is read from the blockchain and is not something we hold.
Buying and cashing out
For each purchase and cash out we keep a record of:
- The amounts in dollars and naira, the rate, and every fee as charged.
- For a cash out, the bank account paid into (bank, account number and the name the bank returns). For a purchase, the wallet address the dollars went to.
- The transactions on the blockchain, and the references our payment partner and the bank give.
- Each step and its time: when the order was made, when your money arrived, when it was paid out, by our clock, by our partner's and by the blockchain's.
- Your IP address, the approximate location it resolves to, your browser and the time, for every order and for attempts that were refused.
These records cannot be edited afterwards. A correction is added as a new entry beside the original, so the record always shows what happened and when.
Checking your identity
To raise your limits you can verify your identity with your BVN and a selfie. They are sent once, directly to our payment partner, which checks the BVN and matches your selfie to the photo on it. We do not store your BVN, your selfie or any document. We keep only the result, when and from where you asked, and a one-way code made from your BVN, which cannot be turned back into it and only lets us stop one identity being used to raise the limits of a second account.
Statements
When you ask for a statement, it is made at that moment and emailed to the address on your account. We keep a note that it was sent, when, for which period and to which address, but not the statement itself.
Why IP address and location
Fraud prevention and audit. Moving money between crypto and bank accounts attracts attempts to launder funds or to test stolen bank details, and the patterns that reveal it, such as one account paying into many unrelated bank accounts, or many refused attempts from one place, are only visible if the origin is recorded. Under the Nigeria Data Protection Act 2023 the lawful basis is our legitimate interest in preventing fraud, and our obligations as a business handling payments.
Analytics
We count page views to see which parts of guap people reach: the page, the referrer, and coarse details like country and device type. It sets no cookies, assigns no identifier that follows you, and is not connected to your account or your orders. There is no advertising.
Who else sees it
| Who | What they receive, and why |
|---|---|
| Dynamic | Handles sign-in and secures your wallet's keys. Receives what Google shares when you sign in. |
| Daya and Minisend | Our naira payment partners. To open and pay your orders: your email and name, the bank account and amount of a cash out, the amount and destination wallet of a purchase, and your BVN and selfie if you verify. Not your IP address or location. |
| Relay | Converts and swaps. Receives your wallet address and the amount. Not your bank details. |
| Resend | Sends our emails, including statements. Receives your email address and the email. |
| Neon and Vercel | Store our records and run the site on our behalf. Vercel sees the IP address of each request, as any host does. |
| Telegram | When something needs a person, such as a failed payout or an order under review, its details are sent to the people who run guap in a private message. |
Nothing is sold, and nothing is shared for marketing. Records may be disclosed to a payment partner, a bank, a regulator or law enforcement where we are required to.
Who at guap can see it
Only the people who run guap, signing in with a Google account on our admin list. Every change they make, such as pausing an account or adding a note to an order, is recorded with who made it.
How long it is kept
| What | How long |
|---|---|
| Purchases, cash outs and everything recorded with them | Seven years, as financial records in Nigeria must be |
| Statements sent, and changes made by our team | Seven years |
| Refused attempts that never became an order | Twelve months |
| Your account details | While you use guap, and deleted when you ask, except where they are part of a record above |
The one time we hold funds
Your rights
You can ask for a copy of what we hold about you, ask for it to be corrected, or ask for it to be deleted. A statement in the app is a copy of your orders at any time. Deletion is limited by the retention periods above: a completed purchase or cash out is a financial record and cannot be erased on request. Deleting your account does not touch your wallet, because the money in it was never ours. You can also complain to the Nigeria Data Protection Commission.