Mayor Exchange

1.1 Personal Information You Provide

When you create an account, verify your identity, or use our services, we may collect:

1.2 Information Collected Automatically

• Device Information: Device model, operating system, unique device identifiers
• Usage Data: Features accessed, transaction history, timestamps
• Authentication Data: Login sessions, two-factor authentication status, biometric authentication preferences (stored locally on your device only)

1.3 Camera & Photo Library

We request access to your device's camera and photo library solely for the following purposes:

• Taking or selecting a profile picture
• Capturing identity documents for KYC verification
• Taking a selfie for identity verification
• Uploading proof of gift card ownership for trade transactions

We do not access your camera or photos for any other purpose, and we do not scan or analyze your photo library.

We use the information we collect to:

• Create and manage your Mayor Exchange account
• Verify your identity in accordance with Know Your Customer (KYC) and Anti-Money Laundering (AML) regulations
• Process cryptocurrency purchases, sales, and transfers
• Process gift card exchange transactions
• Process fiat currency (NGN) withdrawals to your bank account
• Process USDT withdrawals to your crypto wallet
• Send transactional emails (account verification codes, password resets, transaction confirmations)
• Provide customer support through our in-app support system
• Detect and prevent fraud, unauthorized access, and illegal activity
• Comply with legal and regulatory obligations

We do not sell, rent, or trade your personal information to third parties for marketing purposes. We may share your information only in the following circumstances:

• Service Providers: We use Supabase (database and authentication), Google Sign-In (optional social login), and CoinGecko/CoinCap (cryptocurrency price data). These services process data on our behalf under strict confidentiality agreements.
• Legal Requirements: We may disclose your information to law enforcement or regulatory authorities if required by law, court order, or governmental regulation.
• Fraud Prevention: We may share information with financial institutions to prevent fraud or investigate suspicious activity.
• With Your Consent: We may share information for purposes not described in this policy with your explicit consent.

We implement industry-standard security measures to protect your personal information:

• End-to-end encryption for data in transit (TLS/SSL)
• Encrypted database storage for sensitive user data
• Secure authentication using Supabase Auth with email verification
• Optional two-factor authentication (2FA) via one-time passwords
• Optional biometric authentication (Face ID / fingerprint) — biometric data is stored locally on your device and never transmitted to our servers
• Secure storage of sensitive tokens using device-level encrypted keychain/keystore

While we strive to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

We retain your personal information for as long as your account is active or as needed to provide you with our services. Specifically:

• Account Data: Retained while your account is active. Deleted upon account deletion request.
• KYC Documents: Retained for a minimum of 5 years after account closure, as required by Anti-Money Laundering regulations.
• Transaction Records: Retained for a minimum of 7 years for financial regulatory compliance.
• Support Chat History: Retained for 2 years after last interaction.

You have the following rights regarding your personal data:

• Access: You can view your personal information within the App under Settings → Personal Details.
• Correction: You can update your personal details at any time within the App.
• Deletion: You can permanently delete your account and associated data through Settings → Delete Account. Note: Certain data may be retained as required by law (see Section 5).
• Portability: You may request a copy of your data by contacting us.
• Withdraw Consent: You can withdraw consent for optional data processing at any time by adjusting your settings or contacting us.

Mayor Exchange is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from individuals under 18. If we become aware that we have collected data from a minor, we will take steps to delete that information immediately. If you believe a minor has provided us with personal information, please contact us.

Your information may be processed and stored on servers located outside your country of residence, including in jurisdictions where data protection laws may differ. By using Mayor Exchange, you consent to the transfer of your information to these jurisdictions. We ensure appropriate safeguards are in place for all data transfers.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top of this page and notify you through the App. Your continued use of Mayor Exchange after any changes indicates your acceptance of the updated policy.