Privacy Policy

When you register and use STANCARD, we collect the following categories of personal data: • Identity data: First name, last name, date of birth, gender • Contact data: Phone number (with country code), email address • Government ID data: BVN and/or NIN (stored as encrypted, masked values — never in plain text) • Financial data: Wallet balance, transaction history, saved bank accounts • Usage data: Pages visited, features used, session timestamps • Device data: Browser type, operating system, IP address (for security and fraud prevention) • Location data: City-level location when you explicitly enable it for services like rides and deliveries • Profile data: Profile photo, bio, skills, portfolio, professional history (if you choose to add them) • Communications: Messages sent through the platform, support ticket content • Mission data: When you join or create a Mission, we collect the Mission name, description, purpose, your membership status, posts and updates you contribute to the Mission feed, and chat messages you send within the Mission group chat

STANCARD processes your personal data for the following lawful purposes: • Account creation and secure authentication (we never store passwords) • Identity verification (KYC) as required by Nigerian financial regulations • Processing payments, transfers, and bookings through your STANCARD wallet • Delivering marketplace services you request (rides, deliveries, artisan hire, etc.) • Enabling Mission features — feed, group chat, member directory, and leaderboard • Fraud prevention, dispute resolution, and platform security • Sending transactional notifications about your account, bookings, and Mission activity • Delivering One-Time Passwords (OTPs) to your registered email address for Two-Step Verification • Improving our platform features and service quality • Complying with applicable Nigerian laws including the Nigeria Data Protection Regulation (NDPR) We do not use your data for unsolicited marketing without your explicit consent.

STANCARD does not sell your personal data to third parties. We share data only in the following limited circumstances: • Payment processors: Flutterwave processes card payments on our behalf and receives the minimum data necessary (amount, reference, email if provided). Flutterwave's own privacy policy governs their data use. • Email delivery: We use a secure email provider to send OTPs and transactional notifications. Only your email address and the notification content are shared for this purpose. • Infrastructure providers: We use secure cloud infrastructure solely to deliver and run the platform. They process data under strict data processing agreements. • Legal compliance: We may disclose data when required by law, regulatory authority, or valid legal process under Nigerian law. • Fraud and security: We may share data with law enforcement or financial institutions in cases of confirmed fraud or financial crime. All third-party data processors are required to maintain appropriate technical and organisational security measures.

Under the Nigeria Data Protection Regulation (NDPR) and applicable law, you have the following rights: • Right of access: You may request a copy of all personal data we hold about you • Right to rectification: You may correct inaccurate or incomplete data in your profile • Right to erasure: You may request deletion of your account and associated personal data, subject to retention requirements (see Section 5) • Right to restrict processing: You may ask us to pause processing your data in certain circumstances • Right to data portability: You may request your transaction history and profile data in a structured, machine-readable format • Right to object: You may object to processing based on legitimate interests • Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting prior processing To exercise any of these rights, contact us at support@stancard.app or use the Help & Support section in the app.

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected: • Active accounts: Data retained for the lifetime of your account • Closed/deleted accounts: Profile and contact data deleted within 90 days of account closure • Financial records: Transaction records, wallet ledger entries, and payout history retained for 7 years to comply with Nigerian financial regulations (Central Bank of Nigeria guidelines) • KYC records: Retained for 5 years from the last transaction as required by NFIU compliance rules • Mission data: Mission membership and post history is retained while your account is active. If you leave a Mission, your name is removed from the member list but your past posts and chat messages within that Mission remain visible to other members unless you individually delete them before leaving. You may request deletion of specific Mission posts or chat messages. • Support tickets: Retained for 3 years from resolution • Audit logs: Retained for 5 years for security and compliance purposes Data that we are required to retain beyond your deletion request will be held in a restricted state and used only for legal compliance purposes.

STANCARD is built on secure cloud infrastructure with multiple layers of protection: • All authentication is passwordless — your device handles identity verification, nothing sensitive is stored on our servers • Transaction PIN (set by you) required for financial operations — stored as an encrypted value, never in plain text • BVN and NIN stored as encrypted, masked values — the full numbers are never recoverable from our system • All data stored in secure cloud storage — protected by industry-standard encryption at rest • HTTPS enforced for all data in transit • Session tokens stored in your device's local storage with automatic expiry • Transaction security settings (PIN, Two-Step Verification, transaction alerts, wallet freeze) are stored securely and applied to every transaction

STANCARD Missions are groups of ambassadors united by a common purpose. When you participate in Missions, the following applies: • What is collected: Mission name, description, purpose, your membership status, your posts and updates in the Mission feed, and chat messages you send in the Mission group chat • Who can see Mission content: The Mission feed, member list, and member profiles are visible to all members of that Mission. Mission group chat is visible to all current Mission members. • Leaving a Mission: You can leave a Mission at any time. When you do, your name is removed from the active member list. However, posts and messages you contributed while a member remain visible to other members unless you delete them individually before leaving. • Deleting your content: You may delete your own posts and chat messages from within a Mission at any time. To request bulk deletion, contact support@stancard.app. • Official Missions: Some Missions are created and verified by the STANCARD team. These carry a verified badge and may have moderation policies of their own. • Mission data and account deletion: If you delete your STANCARD account, your Mission memberships are removed and your Mission posts and messages are anonymised within 90 days.

STANCARD offers a Privacy Mode feature that lets you control what is visible on your screen while using the app: • What Privacy Mode does: When enabled, Privacy Mode masks sensitive information on-screen — including your wallet balance, account numbers, transaction amounts, personal contact details, and other financial data. A masked field shows as hidden characters (e.g. ••••••) until you tap the eye icon to reveal it temporarily. • What Privacy Mode does NOT do: Privacy Mode is a display-only feature. It does not change how your data is stored or transmitted. Your data is always stored securely on our platform servers regardless of whether Privacy Mode is on or off. • Auto-hide: When you tap to reveal a masked field, it automatically hides again after 30 seconds for your protection. • Where to enable it: Privacy Mode can be toggled from Settings > Privacy & Security, or using the quick eye icon next to your wallet balance on the Wallet screen. • Persistence: Your Privacy Mode preference is saved to your device and remembered across sessions.

STANCARD provides additional security features for your wallet and transactions: Two-Step Verification • When enabled, high-value transactions require a One-Time Password (OTP) before they are processed. • The OTP is a 6-digit code sent to your registered email address at the time of the transaction. • Each OTP is single-use and expires 10 minutes after it is generated. If it expires, you can request a new one. • We will never ask for your OTP over the phone, via chat, or through any channel other than your registered email. Transaction Security features • Transaction PIN: A numeric PIN you set to authorise financial operations. Stored as an encrypted value — we cannot see or recover it. • Transaction alerts: You can configure the platform to notify you for every transaction, for large transactions only, or for any unusual activity. • Wallet freeze: You can temporarily freeze your wallet to block all outgoing transactions without closing your account. You can unfreeze at any time from Settings > Transaction Security. • These security preferences are stored securely on our platform servers and applied to every transaction on your account.

STANCARD uses your browser's local storage (not cookies) for the following purposes: • Session token (key: stancard_session): Keeps you logged in between visits • Geographic preference (key: stancard_geo): Remembers your city preference for nearby services • Theme and display preferences: Remembers your chosen theme and Privacy Mode setting We do not use third-party tracking cookies or advertising pixels.

If you have questions about this Privacy Policy, wish to exercise your data rights, or need to report a privacy concern, contact us: • Email: privacy@stancard.app • Support: Use Help & Support in the app Profile tab • Postal address: STANCARD Nigeria, Lagos, Nigeria We aim to respond to all privacy requests within 14 business days. For urgent security matters, please include "URGENT" in your subject line. This Privacy Policy was last updated: May 2026. We will notify you of material changes via in-app notification.