1. Highlights
This section is a short, plain-language summary. It does not replace the full policy below.
- We collect account, device, location, wallet, and (for business/institutional users) business and banking information, described in full in Section 3.
- Important: NHBCoin is not a "non-custodial" wallet in the strict sense some crypto products use that term. Your PIN adds a layer of protection for everyday use on personal wallets, but NHBCoin's servers separately and independently hold the technical ability to decrypt the private key for every wallet on the platform - personal and business - gated by account-security checks rather than by a secret that only you hold. Section 5 explains exactly how this works and what it means for you.
- We do not sell your personal data, and we do not use third-party advertising or analytics trackers. The only outside companies we share data with are the service providers listed in Section 6 (payment processing, email delivery, push notifications, bot protection, and infrastructure), and only for the specific purposes described there.
- You can request access to, correction of, or deletion of your personal data by contacting us - see Section 9.
2. Scope of This Policy
This Policy applies to information collected through:
- The NHBCoin wallet and web portal (personal accounts and business/merchant accounts).
- The NHBCoin mobile app (Android, via our Capacitor-based app wrapper).
- Public-facing pages, including the chain explorer, payment-link and subscription pages, the validator directory, the retailer directory and application, the institutional partner application, the public bug tracker, and our developer documentation and API reference.
This Policy does not separately cover the internal admin console used by NHBCoin staff, which is not a customer-facing part of the Service, though data handled there is addressed throughout this Policy (for example, in Sections 3.8 and 5).
3. Information We Collect
3.1 Account Information
When you create an account, we collect your email address and a password. We never store your password in readable form - it is stored only as a one-way cryptographic hash. We also generate an internal hashed version of your email address, used for account lookups and security matching, not for readable storage of a second copy of your email.
3.2 Device, Location, and Activity Information
We automatically collect certain technical and location information when you sign up, log in, and use the Service, including:
- Your IP address, and an approximate location derived from it (country, region/state, city, postal code, and latitude/longitude), obtained through a third-party IP-lookup service (see Section 6).
- The date, time, and approximate location of your account signup and of each subsequent login.
- Ongoing activity information, such as when you were last active, what kind of activity it was, and your browser/device information ("user agent" string).
- An activity log of individual account events, each with a timestamp and the location/device details above.
- If you use our mobile app and enable push notifications, a device push token and your device platform (iOS/Android), so we can deliver notifications to your device.
- Session information (IP address and user agent) tied to each active login session, used to secure your account and detect suspicious logins.
We collect this information primarily for account security and fraud prevention - for example, to help us and you notice a login from an unfamiliar location or device. This data is stored in our own systems; it is not shared with any general-purpose advertising or analytics company (see Section 7).
3.3 Wallet and Financial Information
We collect and maintain information related to your use of the wallet and financial features of the Service, including:
- Wallet addresses (NHB, ZNHB, and supported stablecoins such as USDT/USDC).
- Encrypted private key material associated with your wallet(s) - see Section 5 for exactly what this means and who can access it.
- Transaction activity, much of which is recorded on the NHB blockchain itself and is therefore public and permanent by the nature of a blockchain (see Section 8).
- Records of activity in optional features you use, such as lending (wallet address, activity type, token, amount, and transaction hash), staking/validator activity, governance proposals and votes, peer-to-peer marketplace trades and disputes, subscription billing, point-of-sale transactions, and bulk/batch payouts - each tied to your account and/or wallet address.
- Saved addresses, including any external withdrawal addresses you add and any address-book entries (nicknames and addresses) you save for people you transact with.
3.4 Security Information
To help secure your account, we may also maintain:
- Your authenticator app (TOTP) secret, if you enable two-factor authentication.
- A history of past password hashes (not readable passwords), used only to prevent you from reusing a recent password.
- Short-lived verification codes and reset tokens used for email verification, password reset, and PIN reset. These are used only to complete the relevant security process and expire shortly afterward.
3.5 Business / Merchant Account Information
If you apply to open a business or merchant workspace ("Become a Merchant"), we collect: business name, contact email, support email and phone number, website, business type, country, industry, and business address (street, city, state, postal code).
3.6 Bank Account Information (Business Accounts)
If your business withdraws funds to a bank account, we collect the bank details needed to do so: account holder name, bank name, account number, routing number, SWIFT/BIC code, country, and currency. A snapshot of these details is retained with each withdrawal request so our treasury team can process and audit the transfer.
3.7 Institutional Partner Application Information
If you submit an application through our institutional partner program, we collect more extensive business and compliance information, including: your company's legal name, registration number, and headquarters country/city; the services you offer; for each jurisdiction you operate in, your regulator's name, license numbers, and authorized scopes; named contacts (name, title, email, phone); uploaded compliance documents; and an attestation naming an authorized signer (name and email). A subset of this information - legal name, registration number, headquarters location, jurisdiction and licensing details, and the authorized signer's name and email - is additionally stored in a compliance data warehouse hosted on Google Cloud (BigQuery); see Section 6. Submitting this application is also protected by Google reCAPTCHA, which receives your IP address, browser user-agent, and a verification token - see Section 6.
3.8 Compliance / Identity Verification ("KYC") Information
For legal and compliance purposes, we maintain internal records related to identity and business verification, including your verification status, the type and status of documents submitted for verification, internal compliance case notes, and account-level limits (such as deposit, withdrawal, or transaction limits) tied to your verification tier. This information is used and viewed by authorized NHBCoin compliance staff, not published or made customer-facing.
3.9 Bug Reports
If you submit a report through our public bug tracker, we collect the title and body of your report, along with any comments or votes you post, tied to your account. Submissions to the bug tracker are protected by Google reCAPTCHA Enterprise, which independently receives your IP address, browser information, and a verification token directly from Google - see Section 6.
3.10 Information from Third-Party Sign-In
If you choose to sign in using "Sign in with Google," Google shares basic profile information (such as your name and email address) with us to create or authenticate your account, subject to Google's own privacy practices and whatever permissions you grant during that sign-in.
4. How We Use Your Information
We use the information described above to:
- Provide and operate the Service - processing your transactions, sends and receives, swaps, staking, lending, escrow trades, governance participation, subscriptions, point-of-sale payments, and business payouts.
- Secure your account and prevent fraud or abuse - this is the primary reason we collect the device, location, and activity information in Section 3.2, and the reason behind the account-security checks described in Section 5.
- Communicate with you - sending verification codes, security alerts, transaction confirmations, customer support responses, and service or policy updates.
- Process business, merchant, and institutional applications - reviewing "Become a Merchant" and partner applications, and handling treasury withdrawal requests.
- Meet our legal and regulatory obligations - including identity/business verification ("KYC"/"KYB"), anti-money-laundering (AML) compliance, recordkeeping, and responding to lawful requests from regulators or law enforcement.
- Operate and moderate public, community-facing features, such as the bug tracker.
- Maintain and improve the reliability of the Service.
We do not use your personal data for third-party advertising, and we do not sell your personal data to anyone.
5. Private Keys and Custody: What NHBCoin Can and Cannot Access
This is the most important section of this Policy for understanding your relationship with NHBCoin. Please read it in full.
5.1 The short version
NHBCoin's servers hold an independent, company-controlled technical capability to decrypt the private key for every wallet on the platform - including your personal wallet and any business/merchant wallet. This capability exists separately from, and does not depend on, your PIN. It is protected by account-security controls (such as a recent email verification code, or, optionally, an authenticator-app code), not by a secret that only you possess. We do not describe NHBCoin as "non-custodial," and we do not claim that only you can access your funds or your private keys - that would not be an accurate description of how the Service works today.
5.2 How personal wallet keys are handled
When you create a personal wallet, your device generates a private key and protects it with your PIN, using industry-standard cryptography performed in your browser (your PIN is never sent to us). The resulting PIN-encrypted key bundle is stored both in your browser and, for backup and cross-device convenience, on our servers.
Separately, at the moment your personal wallet is created, your device also sends the raw, unencrypted private key to our servers one time, where we encrypt it ourselves using a security key that only NHBCoin controls. This has nothing to do with your PIN - it is a second, independent copy of your key, encrypted with a secret only we hold.
5.3 How business/merchant wallet keys are handled
Business and merchant workspace wallets are handled only the second way described above: they are encrypted using a key that only NHBCoin controls. There is no PIN-based layer for business wallets at all. Every business-wallet transaction - including point-of-sale payments, bulk payouts, and business swaps - is signed by our servers decrypting the key and signing on the wallet's behalf.
5.4 Can NHBCoin decrypt your wallet without your PIN?
Yes. Your PIN itself is never transmitted to or known by us, but we do not need it. Our systems can independently decrypt a wallet's private key when the request is authorized by:
- an active, logged-in session, and
- either (a) a valid email verification code you recently entered, or (b) a valid, unused, unexpired PIN-reset token, and
- if you have turned on the optional authenticator-app requirement for transactions, a valid code from that app.
None of these checks require or use your PIN. This is not a rare, emergency-only process: it is the routine mechanism our systems use to sign a personal-wallet transaction whenever your wallet isn't already unlocked in your current browser session (for example, right after you reload the page), and it is the only way business/merchant wallet transactions are ever signed, since business wallets have no PIN layer to fall back on.
5.5 What happens if you forget your PIN
If you forget your PIN, we verify your identity using a one-time verification code sent to your registered email address. Once verified, our servers decrypt your wallet's private key and let your device re-encrypt it under a new PIN you choose.
In practice, this means anyone who can complete that email verification step for your account - including you, but also anyone who has gained unauthorized access to your registered email inbox and your logged-in session - can cause our servers to produce your wallet's private key, without knowing your old PIN or any seed phrase. We do not offer a seed-phrase-based recovery method that is independent of this process.
5.6 What this means for you
Because of the above, the most meaningful protections for your wallet are the security of your account - a strong, unique password; keeping your registered email account secure; and enabling the optional authenticator-app (two-factor) protection for transactions - rather than your PIN alone. Your PIN provides a real, useful layer of client-side protection for day-to-day personal-wallet use, but it is not the sole barrier between your funds and anyone else, including NHBCoin.
6. Third-Party Service Providers
We work with a limited number of outside service providers to operate the Service. We share only the information necessary for each provider to perform its function, and we do not authorize any of them to use your information for their own advertising purposes.
- Payment processing (NOWPayments, via our internal payments gateway). When you buy or swap NHB/ZNHB using fiat currency or other crypto, your requested amount, asset, and destination wallet address are passed to our internal payments-processing service, which works with NOWPayments to complete the exchange. NOWPayments - not NHBCoin - holds custody of the swapped funds during this step and performs the actual on-chain transfer; you are responsible for NOWPayments' own fees on both directions of a swap, in addition to any NHBCoin service fee. If you are directed to a NOWPayments-hosted payment page, any information you enter there is collected by NOWPayments directly, under NOWPayments' own privacy policy.
- Email delivery (SendPulse). We use SendPulse to send verification codes, password-reset and PIN-reset emails, security notices, and general account/notification emails. This provider receives your email address and the content of the message we send.
- Push notifications (Google Firebase Cloud Messaging). If you enable push notifications in our mobile app, we use Firebase to deliver them. Firebase receives your device's push token and the content of the notification (which may include information like wallet activity amounts or event details).
- Bot and abuse protection (Google reCAPTCHA Enterprise). We use reCAPTCHA to protect our public bug-report form, our institutional partner application form, and bug-report comments. Google receives a verification token, your IP address, and your browser's user-agent information whenever you submit one of these.
- IP geolocation (IPinfo). We use IPinfo to translate an IP address into an approximate location (country, region, city, postal code, coordinates) for the account-security purposes described in Section 3.2.
- Compliance data warehouse (Google Cloud BigQuery). A subset of institutional partner application data - described in Section 3.7 - is stored in a BigQuery dataset for compliance review.
- Sign-in with Google. If you use this sign-in option, Google shares basic profile and email information with us as described in Section 3.10.
- Infrastructure and hosting. Our backend systems and database run on cloud infrastructure (Amazon Web Services). We are responsible for configuring and securing this infrastructure.
We do not use any general-purpose advertising or analytics tracking service (for example, we do not use Google Analytics, Meta/Facebook Pixel, or similar tools) anywhere in the Service.
8. Data Retention
We retain personal data for as long as your account is active, plus an additional period afterward as needed for the purposes described in this Policy, including:
- Account and security data is generally retained while your account is active and for [X] after account closure, to support fraud investigations and account-recovery requests.
- Financial, transaction, and compliance records (including KYC/KYB and treasury withdrawal records) may be retained for longer periods where required by applicable financial recordkeeping or anti-money-laundering laws - typically up to [X years], depending on the record type and applicable law.
- Blockchain transaction data is recorded on the NHB blockchain itself, which is public and immutable by design. We cannot alter or delete this data, on your request or otherwise, because it does not reside in a system we control.
- Bug reports and related support communications are retained for as long as reasonably needed for product and community purposes, or until you request removal (subject to Section 9).
When personal data is no longer needed for the purposes described in this Policy and we are not required to retain it by law, we will delete it or render it anonymous.
9. Your Privacy Rights and Choices
Depending on where you live, you may have rights to access the personal data we hold about you, correct inaccurate data, request deletion, restrict or object to certain processing, or receive a copy of your data.
How to exercise these rights: At this time, these requests are handled directly by our team rather than through an automated self-service tool. To make a request, contact us at [email protected] with a description of what you're requesting. We may ask you to verify your identity and account ownership before acting on the request, to protect your data from being accessed or altered by someone else. We aim to respond within [X days], or sooner where required by applicable law.
Limits on these rights: We may not be able to fully delete or alter certain data where:
- it is required to satisfy legal, tax, or anti-money-laundering recordkeeping obligations;
- it relates to an active dispute, investigation, or fraud-prevention matter; or
- it is recorded on the NHB blockchain itself, which - as a public, immutable ledger - cannot be altered or deleted by us or by anyone else once a transaction is confirmed.
10. Security Measures
We use a combination of technical and organizational measures to protect your information, including:
- Encryption in transit - connections to the Service are encrypted using HTTPS/TLS.
- Encryption at rest - private key material and other sensitive data are stored in encrypted form; passwords are stored only as one-way cryptographic hashes, never in reversible or plain-text form.
- PIN-based client-side encryption for personal wallets - an additional protective layer, described fully in Section 5, that is layered on top of (not a replacement for) our own server-side encryption of your key.
- Access gating on sensitive actions - private key export, PIN reset, and similar operations require a recent email verification code and, if enabled, a valid authenticator-app code, along with rate limiting to slow down abuse attempts.
- Optional two-factor protection - you can enable an authenticator app (TOTP) for an extra layer of security on transactions.
- Internal controls - access to decrypted key material and sensitive user data is restricted to authorized systems and personnel and is subject to internal monitoring.
No online service can guarantee absolute security. We work to protect your information using the measures above, but we cannot promise that unauthorized access, loss, or misuse will never occur.
11. Children's Privacy
The Service is a financial product intended for use by adults. You must be at least 18 years old (or the age of legal majority where you live, if higher) to create an account or use the Service. We do not knowingly collect personal information from anyone under this age. If we learn that we have collected personal data from someone under the required age, we will take steps to delete it.
If you believe a minor has provided us with personal data, please contact us at [email protected].
12. International Data Transfers
NHBCoin and the service providers listed in Section 6 may process and store information in countries other than the one you live in, including Maryland, United States, where our infrastructure and some of our service providers are located. Where required by applicable law, we take steps intended to provide an appropriate level of protection for personal data transferred internationally.
13. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. If we make material changes, we will provide notice - such as by email or a prominent notice on the website or in the app - before the changes take effect. The "Last Updated" date at the top of this Policy always reflects the most recent version. Your continued use of the Service after a change takes effect means you accept the updated Policy.
14. Contact Us
If you have questions about this Privacy Policy, or want to exercise any of the rights described in Section 9, contact us at:
Nwudu Inc
Nwudu Inc, Maryland, United States