Lopay – Privacy Policy

Introduction

Welcome to Lopay ("we," "our," or "us"). Lopay is a smart and flexible installment payment platform that enables parents and guardians to pay their child's school fees, tuition, and related educational expenses in manageable installments.

This Privacy Policy explains what personal information we collect from you ("parent/guardian") and from your child's educational institution, how we use and protect that information, and what choices you have regarding your data. By using the Lopay app or services, you agree to the terms of this Privacy Policy.

This policy applies to all Lopay mobile applications, websites, APIs, and related services. If you do not agree with this policy, please discontinue use of our services immediately.

Information We Collect

We collect only the data necessary to provide our installment payment services. Below is a breakdown of what we collect and why:

👤

Account Information

Full name, email address, phone number, and profile photo (optional) of the parent/guardian account holder.

💳

Payment Information

Bank account details, card numbers (tokenized), billing address, and transaction history.

🏫

Child & School Data

Child's name, school name, grade level, student ID, and fee schedule — to configure your installment plan.

📍

Location & Device

General location (country/region) for regulatory compliance, and device identifiers for security verification.

We do not collect biometric data, precise GPS location, or access your camera or microphone beyond what you explicitly grant for identity verification.

How We Use Your Data

We use the information we collect for specific, legitimate purposes:

To process and schedule your installment payments to educational institutions on your behalf
To verify your identity and prevent fraudulent transactions
To send payment reminders, receipts, and account notifications
To calculate installment plans, interest (if applicable), and payment schedules
To provide customer support and resolve disputes
To comply with applicable financial regulations and anti-money-laundering (AML) requirements
To improve our app features and user experience through anonymized analytics
To detect, investigate, and prevent security incidents

          Plain language promise: We use your data to make Lopay work for your family — nothing more. We will never use your child's information for advertising, profiling, or any commercial purpose unrelated to your payments.
        

Payment & Financial Data

Because Lopay processes financial transactions, we handle sensitive payment information with the highest level of care:

All card numbers are tokenized using industry-standard PCI-DSS Level 1 compliant processors — we never store your raw card numbers on our servers
Bank account information is encrypted using AES-256 encryption at rest and TLS 1.3 in transit
Payment history is retained for a minimum of 7 years for tax and regulatory compliance
Transaction data is processed through licensed and regulated payment gateways
You may request a complete export of your payment history at any time from your account settings

If you connect your bank account, we use a regulated open-banking or ACH integration and do not have ongoing access to your full account unless you authorize a specific transaction.

Device Data We Access

Lopay accesses certain device-level information to provide a secure and functional experience. Here is exactly what we access and what we do not:

Device ID & Model — Used for fraud prevention and session management
Operating System & Version — To ensure compatibility and security patch compliance
Network Type (Wi-Fi / cellular) — To optimize payment processing reliability
Push Notification Token — To deliver payment alerts and reminders (opt-in)
Biometric Hardware Presence — To offer Face ID / fingerprint login as an option; we never store biometric data

We do NOT access your contacts, photos, or media files
We do NOT access your microphone or camera (except during optional KYC identity verification)
We do NOT track your precise GPS location
We do NOT read your SMS or call history
We do NOT access any other apps installed on your device

Data Sharing & Third Parties

We share your information only when necessary, and only with trusted partners who are contractually obligated to protect it:

Educational Institutions — We share relevant payment confirmations and your child's enrollment data with the school you are paying. We share only what the school needs to apply your payment correctly.
Payment Processors — Licensed third-party processors (e.g., Stripe, Flutterwave, or similar) receive your payment data to execute transactions.
Identity Verification Providers — KYC/AML service providers to verify your identity as required by financial regulations.
Cloud Infrastructure — Secure cloud hosting providers (under strict data processing agreements) store encrypted data.
Legal Authorities — We may disclose data if required by law, court order, or to prevent harm.

We do not sell, rent, or trade your personal data — or your child's data — to any third party for marketing, advertising, or any commercial purpose.

Data Retention

We retain your data only as long as necessary for the purposes described in this policy:

Account data — Retained while your account is active and for 90 days after deletion request
Payment & transaction records — Retained for 7 years (financial/tax compliance)
Child enrollment data — Deleted within 30 days of account closure or upon your request
Device identifiers — Purged within 30 days of app uninstall or account deletion
KYC documents — Retained per regulatory requirements (typically 5 years), then permanently deleted
Usage analytics — Aggregated, anonymized, and retained indefinitely (not linked to your identity)

To request deletion of your data, contact us at [email protected] or use the in-app "Delete My Data" option in Settings.

Your Rights

Depending on your location, you have specific rights over your personal data. We honor these rights for all users:

Right to Access — Request a copy of all personal data we hold about you
Right to Correction — Update inaccurate or incomplete information
Right to Deletion — Request erasure of your data (subject to legal retention obligations)
Right to Portability — Receive your data in a machine-readable format (CSV, JSON)
Right to Object — Object to specific data processing activities
Right to Restrict Processing — Limit how we use your data in certain circumstances
Right to Withdraw Consent — Withdraw consent for optional data processing at any time

To exercise any of these rights, contact [email protected]. We will respond within 30 days.

Security Measures

Protecting your family's financial data is our highest technical priority. We implement multiple layers of security:

AES-256 encryption for all data at rest; TLS 1.3 for all data in transit
Multi-factor authentication (MFA) available and recommended for all accounts
PCI-DSS Level 1 compliant payment infrastructure — the highest standard in the industry
Regular third-party security audits and penetration testing
Real-time fraud monitoring and anomaly detection on all transactions
Automatic session timeouts after periods of inactivity
Role-based access control — only employees who need your data to serve you can access it

In the unlikely event of a data breach that affects your personal data, we will notify you within 72 hours as required by applicable law.

🧒 COPPA Compliance — Children Under 13

Children's Privacy (Under Age 13)

Lopay is an app designed for parents and guardians — not for children to use directly. However, because our service involves data about children (names, grade levels, student IDs), we comply fully with the Children's Online Privacy Protection Act (COPPA) and similar international children's privacy laws.

          Important: Lopay does not knowingly allow children under 13 to create accounts or directly use the Lopay app. All accounts must be created and managed by a parent or legal guardian aged 18 or older.
        

What child-related data we collect:

Child's first name and last name (to identify payment recipient)
Child's school name, grade level, and student/admission ID
Fee schedule and academic term information
Payment confirmation records tied to the child's enrollment

How we use child-related data:

Solely to route your installment payments to the correct school account and apply them to your child's fee balance
To generate payment receipts and records for your own use
To confirm enrollment status when required by the school

What we NEVER do with child data:

We never use a child's name, image, or any information to target advertising
We never share a child's data with third parties for commercial purposes
We never build behavioral profiles or track children's activities
We never retain a child's data longer than necessary for payment processing and legal compliance
We never allow children under 13 to interact directly with our platform

Parental Rights & Controls:

Right to review — Parents may request to review all data we hold relating to their child at any time by contacting [email protected]
Right to delete — Parents may request the deletion of their child's data. We will comply within 15 business days, subject to legal retention requirements
Right to refuse further collection — Parents may close their account and request cessation of all data processing related to their child
Right to correct — If any child-related data is inaccurate, parents may update it directly in the app or by contacting support

Report a concern: If you believe a child under 13 has accessed Lopay without parental consent, or if you have any concern about child data, please contact our Child Privacy Officer immediately at [email protected] or call our helpline at +1 (800) LO-PRIVACY. We will investigate and take appropriate action within 48 hours.

Cookies & Tracking

The Lopay app and website use limited tracking technologies:

Essential Cookies — Required for login sessions and security; cannot be disabled
Functional Cookies — Remember your preferences (language, currency); optional
Analytics (Anonymized) — Aggregate, non-identifiable usage data to improve the app; can be opted out in Settings

We do NOT use advertising or third-party tracking cookies
We do NOT participate in cross-site ad networks or interest-based advertising
We do NOT use tracking pixels from social media platforms

You can manage cookie preferences in your browser settings or via our in-app Privacy Settings panel.

Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or new features. When we do:

We will update the "Effective Date" at the top of this page
For material changes, we will notify you via in-app notification and email at least 14 days before the changes take effect
Changes affecting the collection or use of children's data will always require fresh parental consent
Your continued use of Lopay after the effective date constitutes acceptance of the updated policy

We encourage you to review this policy periodically. Previous versions are available upon request.

Contact Us

Questions about your privacy, data rights, or this policy? Our dedicated Privacy Team is here to help parents and guardians like you.

📧

General Privacy Inquiries

[email protected]

🧒

Child Privacy / COPPA Officer

[email protected]