Privacy
Last updated 21 October 2026
This explains what OTPBox ("OTPBox", "we") collects when you use otpbox.ng, why, who helps us process it, and your choices. We collect as little as we can to run the service and keep it safe.
1. What we collect
Account: your email address, and your name if you sign in with Google. We don't use passwords.
Use of the service: the numbers you buy, the texts they receive, your wallet and top-up history, and your chats with our assistant and team.
Payments: the amount, method and status of each top-up. Card and bank details go straight to our payment provider; we never see or store them.
Technical: your IP address and the country it comes from (to show the right ways to pay and stop abuse), your browser type, and when you were last active.
2. Why we use it
To run your account and wallet, deliver your codes, take payments and refund automatically when no code comes.
To answer you in support, and to send emails you need: sign-in codes, receipts, refund notices and answers to your questions. With your account we may also send a few product emails (for example a welcome, or a reminder about an unfinished top-up); every one has a link to stop them.
To keep OTPBox safe: preventing fraud, payment disputes and misuse, and meeting our legal duties, including anti-money-laundering checks where they apply.
3. Who helps us
We share only what each one needs, with companies that work for us under contract: payment processors (for top-ups and payouts), an email delivery service, our hosting and database provider, a network and security provider, Google (only if you choose to sign in with Google), and an AI provider that helps write our support answers and some emails. The AI provider processes a conversation to answer it and doesn't use it to train its models.
You can ask us for the names of these companies at support@otpbox.ng.
The numbers themselves come from telecom suppliers. We don't send them your name or email.
We don't sell your personal data. If you came to OTPBox by clicking a Google ad, we tell Google that the click led to a sign-up, and later to a first top-up and its amount, so we can see which ads work. Google gets only its own click reference, never your name, email or phone number.
Some of these providers process data outside Nigeria. Where they do, we use providers with appropriate safeguards for international transfers.
4. How long we keep it
Account and wallet records are kept while your account is open and for as long as the law requires afterwards for financial records (typically 6 years). Texts received by numbers and chat messages are kept for up to 12 months, then deleted unless they're part of an open dispute.
5. Your rights
You can ask to see the personal data we hold about you, to correct it, to delete your account, or to object to product emails. Under the Nigeria Data Protection Act 2023 you can also complain to the Nigeria Data Protection Commission. Email support@otpbox.ng and we'll answer within 30 days.
If you delete your account, we close the wallet (after returning any balance) and remove your personal data, except records we must keep by law.
6. Cookies
We use only the cookies the service needs: one to keep you signed in, and short-lived ones during sign-in and to bring you back to the page you were on. If you arrive from a Google ad, one more cookie keeps the ad's click reference for up to 90 days so a sign-up can be matched to the ad. We don't use third-party advertising or tracking cookies.
7. Children
OTPBox is for people aged 18 and over. We don't knowingly collect data from children.
8. Changes
If we change this policy in a way that matters, we'll tell you by email or in the app first.
9. Contact
support@otpbox.ng