Privacy Policy

Effective date: 15 September 2026
Version: 1.0

Mira IT Solution Nigeria Limited ("Mira", "we", "us" or "our") provides the Mira account, wallet, payment, bill-payment and ride-related services. This Privacy Policy explains how we collect, use, disclose, retain and protect personal data when you use our apps, websites, APIs, support channels and related services (the "Services").

Mira is the data controller for the personal data covered by this Policy. Questions and privacy requests may be sent to info@mis.ng.

1. Personal data we collect

Depending on the Services you use, we may collect:

• Account and profile data: name, username, email address, mobile number, date of birth, gender, nationality, profile image, language, time zone, address and emergency-contact details.
• Identity and verification data: Bank Verification Number (BVN), National Identification Number (NIN), identity-verification results, KYC status and information needed to meet legal, fraud-prevention and financial-services requirements.
• Wallet and payment data: wallet balances, virtual-account details, transaction amounts, recipients, bank account details, references, narrations, fees, provider charges, statutory levies, refunds, reversals and transaction history.
• Bill-payment data: service type, biller or provider, phone number, meter or customer number, package or item purchased, payment status, provider response, electricity token or PIN, units and receipt information.
• Ride data: rider or driver identifiers, pickup and destination information, trip status, fare, payment and settlement details, and location information supplied through Mira Ride when required to request, provide, monitor or support a trip.
• Contacts and counterparties: contacts you choose to save or use, including names and phone numbers, and limited information about people or businesses involved in your transactions.
• Device and communications data: device identifier, device model, operating system, app version, IP address, browser or user-agent information, push-notification token, notification preferences, SMS/email delivery information, and messages we send you.
• Security and usage data: login and session records, authentication events, transaction-PIN checks, fraud and risk signals, rate-limit records, audit logs, feature usage, errors and service performance information. We do not receive the fingerprint or face image used by your device for biometric login; your device confirms whether its local biometric check succeeded.
• Support and programme data: support requests and messages, complaint records, deletion requests, referrals, rewards and information you voluntarily provide to us.

We collect data directly from you, automatically from your device and use of the Services, from transaction counterparties, and from banks, payment networks, identity-verification providers, billers, Mira Bills, Mira Ride, communications providers and other service partners.

2. How we use personal data

We use personal data to create, verify, maintain and secure accounts; perform KYC and comply with lawful obligations; process wallet funding, transfers, bank withdrawals, refunds, fees and levies; fulfil bills and deliver tokens or PINs; coordinate and settle rides; authenticate users; send service notifications; provide support; prevent fraud and misuse; maintain records; improve reliability; and send marketing where permitted and consistent with user choices.

3. Lawful bases

We process personal data where necessary to perform our contract with you, comply with legal obligations, protect vital interests, pursue legitimate interests such as security and service improvement where those interests are not overridden by your rights, or where you have consented. You may withdraw consent at any time, without affecting earlier lawful processing. Some data, including KYC information, is required to operate financial features; those features may be unavailable if it is not provided.

4. How payments, bills and rides use data

Payments and wallets

We use identity, wallet, bank, device and transaction data to maintain your wallet, assign a virtual account, confirm recipients, authorise and settle transfers, calculate and record charges, provide receipts, prevent duplicate payments, investigate disputes and meet record-keeping duties. We may share the minimum necessary information with our banking partner, beneficiary banks, payment networks, identity providers and transaction counterparties.

Bills

When you pay a bill, we share the details needed to identify and fulfil the purchase with Mira Bills and the relevant biller, aggregator or provider. This may include your transaction reference, service type, meter/customer/account or phone number, package, amount and recipient details. We receive and retain fulfilment responses such as status, provider reference, token/PIN, units and receipt details so you can view proof of purchase and receive notifications.

Rides

When you use a ride service, Mira Core processes the identifiers, fare, payment request and settlement status needed to authorise and settle the trip. Mira Ride may provide trip, rider, driver and location details required for matching, safety, fulfilment, support and disputes. Relevant trip information may be shared between the rider and driver. Location permissions can be controlled in device settings, but disabling necessary access may prevent ride features from working.

5. When we share personal data

We may share the minimum necessary data with banking, identity/KYC, payment and fraud-prevention partners including Aella; banks and payment networks; Mira Bills, billers and utility or telecommunications providers; Mira Ride and participating riders or drivers; SMS, email and push-notification providers; cloud, storage, security, analytics, support and technology providers; professional advisers and auditors; and courts, regulators or law-enforcement agencies where required or permitted by law. We do not sell personal data. We require providers to use it only for authorised purposes and apply appropriate safeguards.

6. International processing

Some providers may process data outside Nigeria. Where personal data is transferred internationally, we use safeguards required by applicable Nigerian data-protection law, such as an adequacy basis, approved contractual protections or another lawful transfer mechanism. Contact us for more information.

7. Retention and account deletion

We keep data only as long as reasonably necessary to provide the Services, resolve disputes, prevent fraud and meet legal, tax, audit, anti-money-laundering and financial record-keeping obligations. Retention periods vary by data type and legal requirement.

You may request account deletion in the app. A 14-day grace period applies, during which an eligible pending request may be cancelled. You must first withdraw available wallet funds and allow pending holds or transactions to settle. After completion, we deactivate access and delete or anonymise data no longer required. We may retain transaction, KYC, security, complaint and audit records for the period required by law or to establish, exercise or defend legal claims. Backup copies may remain until securely overwritten under our normal cycle.

8. Security

We use measures designed to protect personal data, including access controls, restricted administrative permissions, secure authentication, session management, transaction-PIN checks, signed service communications, monitoring, audit trails and encryption where appropriate. No system is completely secure. Keep your login details, OTPs and transaction PIN confidential, protect your device, and contact us immediately if you suspect unauthorised activity.

9. Your rights and choices

Subject to applicable law, you may ask us to provide access to your data; correct it; delete it or restrict its use; provide eligible data in a portable format; accept an objection to legitimate-interest processing or direct marketing; record withdrawal of consent; or review a solely automated decision that significantly affects you, where applicable.

You can update certain profile, device and notification settings in the Services. To exercise another right, email info@mis.ng. We may verify your identity and may retain information where an exemption or legal duty applies. You may complain to the Nigeria Data Protection Commission if you believe your rights have been infringed.

10. Notifications and marketing

Essential security, transaction, bill and ride messages are part of the Services. You can manage optional categories through your settings and device controls. You may opt out of marketing at any time; we will not use OTP messages as marketing without an appropriate lawful basis.

11. Adults only

The Services are intended only for people aged 18 or older who can enter a binding agreement. We do not knowingly offer the Services to children. Contact us if you believe a child has provided personal data.

12. Changes to this Policy

We may update this Policy to reflect changes in the Services, law or our practices. We will publish the updated version and effective date and, where required, give additional notice or request consent.

13. Contact and complaints

Mira IT Solution Nigeria Limited
Email: info@mis.ng

Never send your password, OTP or transaction PIN. If we cannot resolve a privacy complaint, you may contact the Nigeria Data Protection Commission. Payment and financial-service complaints may also be escalated to the appropriate regulator where applicable.