Privacy Policy
Last updated 16 September 2026 · Version 2026-09-16
TuckPay is operated by Thrive XYZ Limited. This policy explains what information we collect, why we collect it, who can see it, and the choices you have. It is written in plain English on purpose.
Who we are
- TuckPay is a school payment platform operated by Thrive XYZ Limited in Nigeria. Schools use it to collect school fees, activity and excursion payments, and canteen purchases through a single student wallet. You can reach us at any time at admin@thrivexyz.xyz.
- Your school decides to use TuckPay for its fees, activities and canteen. For information about students, the school is responsible for the decision to use TuckPay, and we handle that information on the school's instruction.
What we collect
- From parents and staff: your name, email address, phone number, the school you belong to, and a record of your top-ups and your child's purchases.
- About students: the child's name, class or grade, the school they attend, an optional photo used to identify them at the canteen, their wallet balance, and their purchase history.
- From school staff and shopkeepers: name, email, phone, role, and a profile photo used to verify identity at the till.
- Payment information: the amount transferred, the date and time, the bank reference from your transfer, and the account number the money arrived into. We never see or store your card details, bank password, PIN or OTP.
- Technical information needed to keep the service working and secure, such as sign-in times and error records.
Why we collect it
- To create and run wallets for students, parents and staff.
- To credit money you transfer to the right child, and to let the canteen charge the right wallet.
- To show you what your child bought, and to apply the daily limits and item restrictions you set.
- To settle the school's canteen earnings and keep accurate financial records.
- To detect and prevent fraud, misuse, and mistakes, and to support you when something goes wrong.
- To meet Nigerian legal, tax and financial record-keeping obligations.
Who can see what
- You see your own account, your children, their balances and their full purchase history.
- The canteen shopkeeper sees only what is needed to complete a sale: the student's name, photo and whether the purchase is allowed. Shopkeepers do not see wallet balances.
- School staff and school administrators see the students of their own school and the canteen's sales and earnings. They do not see other schools.
- Our own support team can access records only where needed to run the service, investigate a problem or meet a legal obligation.
- We never sell your information, and we do not use children's information for advertising.
Where information is stored
- Information is stored in secure managed cloud databases with access controls, encryption in transit, and per-user access rules enforced at the database level.
- Some of our service providers, including our banking partner and our hosting provider, store or process data outside Nigeria. Where that happens we use providers that apply recognised security standards.
How long we keep it
- Account information is kept while your account is active.
- Transaction and settlement records are kept for at least seven years, because Nigerian financial and tax record-keeping rules require it. This applies even after an account is closed.
- Student photos are deleted when the student leaves the school or when the school or parent asks us to remove them.
Children's information
- We only collect the minimum needed to let a child buy from the canteen safely: name, class, school, an optional photo, and purchase records.
- Children do not create accounts, receive marketing, or use the app themselves. At the canteen the shopkeeper looks the child up — there is no card and no cash.
- A parent or guardian can review everything recorded about their child, and can ask us to correct or delete it.
Your rights
- You can ask for a copy of the information we hold about you and your child.
- You can ask us to correct anything that is wrong.
- You can ask us to delete your information, subject to the financial records we are legally required to keep.
- You can withdraw from the service at any time by asking your school to remove your child, or by writing to us.
- To exercise any of these rights, use the data deletion page in the app or email admin@thrivexyz.xyz. We respond within 30 days.
Security
- Access to data is restricted per account and enforced by the database itself, not just by the app screens.
- Passwords are stored in hashed form by our authentication provider — nobody at TuckPay can read your password.
- If a breach affects your information, we will tell you and the relevant authorities without undue delay.
Changes to this policy
- We may update this policy. The version in force is shown at the top of this page. If a change materially affects you, we will notify you in the app or by email. Questions: admin@thrivexyz.xyz.