LOOPRAIL PRIVACY POLICY

1. Introduction

Looprail (“we”, “our”, or “us”) operates a financial services platform (the “Service”) that enables users to manage digital wallets, make deposits, and process withdrawals. Looprail is committed to protecting your privacy and handling your personal data with transparency, integrity, and in full compliance with applicable data protection laws, including but not limited to the Nigeria Data Protection Act 2023 (NDPA), the General Data Protection Regulation (GDPR) (where applicable), and Google Play’s User Data and Financial Services policies.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, how long we retain it, and what rights you have. It applies to all users of our mobile application (the “App”) and related services.

By creating an account and using the Looprail App, you confirm that you have read and understood this Privacy Policy and consent to the data practices described herein.

2. Data Controller & Contact Information

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact our Data Protection team at the address above. We will respond to all legitimate requests within 30 days.

3. Personal Data We Collect

We collect only the data necessary to provide our financial services. Below is a detailed breakdown of each category.

4. How We Use Your Personal Data

We process your personal data only for the purposes described below, and only where we have a valid legal basis to do so.

5. Third-Party Data Sharing

We share your personal data with trusted third-party service providers solely to operate and improve our services. We do not sell, rent, or trade your personal data to any third party for marketing or advertising purposes.

Each third-party provider is bound by a Data Processing Agreement (DPA) with Looprail and is required to handle your data in compliance with applicable data protection laws. We share only the minimum data necessary for each provider to perform their function.

International Transfers: Some of our service providers (Firebase, Resend) are based in the United States. When we transfer your data outside Nigeria or the European Economic Area (EEA), we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) and equivalent data protection mechanisms.

Legal Disclosures: We may disclose your personal data to law enforcement, regulatory authorities, or courts where required by applicable law or valid legal process, including requests under AML/CFT regulations.

6. Data Retention

We retain your personal data only for as long as is necessary for the purpose for which it was collected, or as required by law. The table below sets out our retention periods.

Upon account deletion, your personal data will be deactivated and restricted from further processing. Certain records will be retained for the periods specified above to comply with our legal obligations. At the end of all applicable retention periods, your data will be securely and permanently deleted or anonymised.

7. Data Security

We implement industry-standard and legally required security measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction. These include:

• Password & PIN hashing: All passwords and PINs are hashed using Argon2 and are never stored or transmitted in plain text.
• Biometric security: Biometric authentication uses public-key cryptography. Your biometric private key never leaves your device and is never transmitted to or stored on our servers.
• Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher (HTTPS).
• Session security: Sessions are invalidated immediately upon logout and can be remotely revoked at any time.
• Account lockout: Accounts are automatically locked after a defined number of consecutive failed authentication attempts.
• Email validation: Disposable email addresses are blocked at registration to prevent fraudulent account creation.
• Access controls: Internal access to personal data is restricted on a strict need-to-know basis, with all access logged and audited.

8. Your Rights

Depending on your jurisdiction, you have the following rights regarding your personal data:

• Right to Access: You may request a copy of the personal data we hold about you.
• Right to Rectification: You may request correction of inaccurate or incomplete data.
• Right to Erasure (“Right to be Forgotten”): You may request deletion of your account and associated personal data, subject to our legal retention obligations.
• Right to Restriction: You may request that we restrict processing of your data in certain circumstances.
• Right to Object: You may object to processing based on legitimate interests or for direct marketing purposes.
• Right to Data Portability: You may request your personal data in a structured, commonly used, and machine-readable format.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
• Right Not to Be Subject to Automated Decision-Making: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects concerning you.

To exercise any of these rights, please contact us at privacy@looprail.xyz. We will respond within 30 days. We may need to verify your identity before processing your request.

Right to Lodge a Complaint: If you are dissatisfied with our handling of your personal data, you have the right to lodge a complaint with your national data protection authority. For users in Nigeria, this is the Nigeria Data Protection Commission (NDPC): www.ndpc.gov.ng.

9. Automated Processing & Profiling

Our fraud prevention and security systems use automated processing to analyse login behaviour, device identifiers, geolocation signals, and transaction patterns. This processing may result in your account being automatically locked or a transaction being automatically flagged or declined where a high fraud risk is detected.

Where our systems make an automated decision that significantly affects you (e.g., account suspension), you have the right to:

• Request human review of the automated decision;
• Express your point of view and contest the decision;
• Receive an explanation of how the decision was made.

To exercise these rights, contact us at privacy@looprail.xyz.

10. Cookies & Session Management

Our backend API does not use browser cookies for session management. Sessions are managed exclusively via JSON Web Tokens (JWT) transmitted in secure HTTP request headers. No persistent tracking cookies are placed on your device through our mobile App.

Firebase Cloud Messaging (FCM) uses device-level tokens to deliver push notifications. These tokens are refreshed automatically by the Firebase SDK and are not used for advertising or tracking purposes.

11. Children's Privacy

Our services are not directed at, and are not intended for use by, individuals under the age of 18. We do not knowingly collect personal data from minors. If you are under 18, you must not use our services or provide us with any personal data.

If we become aware that we have inadvertently collected personal data from a person under 18, we will delete such data as soon as reasonably practicable. If you believe a minor has provided us with personal data, please contact us immediately at privacy@looprail.xyz.

12. California Residents — CCPA Rights

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including:

• The right to know what personal data we collect, use, disclose, and sell.
• The right to request deletion of your personal data.
• The right to opt out of the sale or sharing of personal data.
• The right to non-discrimination for exercising your CCPA rights.

Looprail does not sell or share your personal data with third parties for cross-context behavioural advertising or commercial purposes. To exercise your California rights, contact us at privacy@looprail.xyz.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Post the updated Privacy Policy on our website and within the App;
• Update the “Last Updated” date at the top of this document;
• Notify you via in-app notification and/or email at least 30 days before the changes take effect for material changes;
• Where required by law, obtain your renewed consent before the new processing begins.

If you do not agree to the updated Privacy Policy, you must stop using our services and may request deletion of your account. Continued use of the service after the effective date of the new policy constitutes acceptance of the updated terms.

14. Governing Law & Jurisdiction

This Privacy Policy is governed by and construed in accordance with the laws of the Federal Republic of Nigeria, including the Nigeria Data Protection Act 2023 (NDPA) and any regulations issued thereunder. Any disputes arising from or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of the Federal Republic of Nigeria.

For users accessing our services from outside Nigeria, we comply with applicable data protection laws of your jurisdiction to the extent required by law, including the GDPR for European Economic Area residents.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

This Privacy Policy was last updated on April 27, 2026 (Version 2.0).