HWFA Privacy Policy

Effective date: November 11, 2026.

1. Who we are

HWFA provides a mobile app and related website for accounts, conversations, social activities, wallet services and shopping. This policy explains how personal information is handled when you use the features available to you.

The company responsible for your information is HWFA LTD (RC 9952200), 16A Refinery Drive, NNPC Housing Estate, Warri, Delta State, Nigeria. Privacy and account-deletion requests: support@hwfapp.com.

2. Information we process

Depending on which features you use, we process:

• Account and profile information: phone number, full name, username, profile picture and whether an account is a business account.
• Phone verification information: the number you ask to verify, a short verification challenge, its expiry, verification status and a temporary identifier that connects the request to your app session.
• Content and interactions: information you choose to post, upload, share or send through available features, and information needed to deliver those interactions. How content is processed depends on the feature. Statuses are deleted after 24 hours and hangouts after they end. Messages between two people are end-to-end encrypted: HWFA relays them as ciphertext it cannot read and deletes each one once the recipient’s phone has received it (or after 30 days if it is never collected). Store chats with businesses are not end-to-end encrypted, because the business’s automatic replies need to read them.
• Follows, blocks and reports: who you follow, who follows you, who you block, and reports you make or that are made about your account or content, with the reason and any details the reporter chose to include.
• Push notifications: if you allow notifications, a push token for your phone, used only to send you HWFA notifications through Expo’s push service and Apple or Google. Notifications about messages never include the message text.
• Shopping and wallet records: listings, prices, orders, payment references, balances, transfers, withdrawal requests and related activity or security records, when you use these services.
• Product link purchases: if you buy through a product link, your name, phone number, email address and delivery details, the item you chose and your payment reference. These are shared with the seller so they can fulfil your order, and Paystack processes your payment. You do not need an HWFA account.
• Seller account numbers: if a business asks for an HWFA account number, its name, phone number, bank account and BVN are sent to Paystack to verify its identity and create the number. HWFA does not store the BVN.
• Technical and security information: session identifiers, device or browser information, request times, error information, network information processed by our hosting providers, and security events. Some HWFA security records use hashed IP addresses or hashed device information. Hosting providers may separately process connection information.
• Permissions-based information: photos or other media you select for upload. When you grant a device permission for an available feature, information needed for that feature may be processed. You can manage permissions in your device settings.

Please do not send identity documents, payment credentials or other sensitive information through a WhatsApp verification conversation.

3. How WhatsApp phone verification works

When you choose WhatsApp verification, HWFA generates a temporary code and opens a prepared message to HWFA's WhatsApp business number. You send that message from the WhatsApp account associated with the number you want to verify.

Meta/WhatsApp delivers the sender's WhatsApp number, message text and associated message information to HWFA's webhook. HWFA checks whether the sender and code match a pending request. Your app then checks for confirmation. This proves access to that WhatsApp number; it is not government identity verification.

The current verification challenge expires after 10 minutes. A separate temporary sign-up ticket may then be issued. Challenge expiry prevents use of the challenge; it does not mean every related record or provider log is immediately deleted. HWFA stores hashed challenge and session proofs in its verification table rather than storing the verification code as plaintext there.

This flow does not require HWFA to send you an authentication-template message. WhatsApp independently processes information under its own privacy policy and terms. We do not receive your WhatsApp password or your complete WhatsApp chat history through this verification flow.

4. Why we use information

We use information to create and manage accounts, verify phone access, maintain sessions, provide the features you request, process shopping and wallet activity, prevent misuse, investigate errors and security incidents, respond to requests and meet applicable obligations.

Where applicable law requires a lawful basis, the bases relevant to the activity are performance of our agreement with you for requested services, legitimate interests in running and securing the service where those interests are not overridden by your rights, consent for optional permissions or other activities requiring it, and compliance with legal obligations.

5. When information is shared

Information you choose to make public, or send to another user or business, is visible to the relevant audience. A transaction may require information to be shared with the other party, a payment provider or a service provider supporting that transaction.

The current service uses OpenAI Sites and Cloudflare infrastructure for hosting and storage, Meta/WhatsApp for WhatsApp verification, Paystack for supported payment processing, and Expo, Apple and Google to deliver push notifications. Call verification, where offered, can involve the configured telecom or messaging provider.

Service providers process information necessary for their role under their arrangements with HWFA and, where applicable, their own policies. We may also disclose information when required by applicable law, to protect rights and safety, or as part of a business transfer subject to appropriate safeguards and notice where required.

6. Storage, transfers and security

Our providers may process information outside Nigeria. Processing locations and protections depend on the provider and service. Applicable data protection requirements continue to apply to these transfers.

HWFA uses measures such as authenticated sessions, access checks, verification expiries, request limits and webhook signature verification to protect information. No online system can guarantee absolute security. You should protect your device and account and avoid sharing verification codes or session links.

7. How long information is kept

We keep information for the purposes described in this policy and for applicable legal, accounting, dispute-resolution and security needs. Different records may have different retention periods. Deleting or expiring an account credential does not automatically remove historical financial records or copies held independently by other users or providers.

You can contact support@hwfapp.com to ask about retention of your information or request deletion. Retention depends on the record, the feature used, whether your account remains active, and applicable obligations.

8. Your choices and rights

You can choose what information to share, manage available profile controls, and change device permissions in your operating system. Some features may not work without information or permissions they require.

Subject to applicable law and its conditions, you may request information about our processing, access to your personal information, correction, deletion, restriction, objection or portability, and withdraw consent for processing based on consent. Withdrawal does not affect processing already lawfully carried out. We may need to verify a requester's identity and may retain information where a lawful exception applies.

You can delete your account in the app under Settings, Delete account. This erases your name, phone number, username, profile picture, listings and sessions from HWFA's servers. Financial and security records are kept without those details where needed for legal, accounting, dispute-resolution and security purposes. Your wallet must be empty first.

You can also request account deletion or deletion of personal information by email at support@hwfapp.com with the subject “HWFA account deletion”. Identify the account using its phone number, including country code, or username, and describe your request. Do not include passwords, verification codes or payment credentials. We may need to verify that you control the account. Deletion is subject to applicable law and lawful retention requirements. Information held independently by other users or providers may require a separate request to them. You may also complain to the Nigeria Data Protection Commission at ndpc.gov.ng.

9. Children and age-restricted features

HWFA is intended for people aged 18 and older. You must be at least 18 to use HWFA. If you believe a person under 18 has provided personal information to HWFA, contact support@hwfapp.com so the matter can be investigated and appropriate action taken.

10. Changes and contact

Updates will be posted on this page with a revised effective date. Where required, material changes will be communicated through an appropriate channel. Contact HWFA LTD at support@hwfapp.com or 16A Refinery Drive, NNPC Housing Estate, Warri, Delta State, Nigeria for questions and requests. Our Terms of Service explain the rules for using HWFA.