Legal

Privacy notice

What we collect, why we collect it, who sees it, and how to get it back or have it deleted.

Draft — pending legal review. This document was prepared from how the platform actually works, but it has not been reviewed by a qualified Nigerian data-protection or commercial lawyer. It is not yet binding and must not be relied on. Placeholders in [square brackets] need the registered entity’s details before publication.

Last updated 2026-08-06

This notice explains how we handle personal data under the Nigeria Data Protection Act 2023. It covers the marketing site, the brand and creator web apps, and the Creator mobile app.

Who controls your data

[Registered company name] ([RC number]) of [registered address], Nigeria, is the data controller for the personal data described here. We are registered with the Nigeria Data Protection Commission (NDPC) under [registration reference].

Our Data Protection Officer can be reached at [dpo@example.com].

What we collect, and why

We collect only what the service needs to function. Each category below states the lawful basis we rely on under section 25 of the NDPA 2023.

Account details: Your email address, name and role (creator, brand or staff). Basis: performance of a contract — we cannot give you an account without them.
Identity verification (NIN, BVN): For creators who cash out, we verify identity through our KYC provider. We receive a verification result and reference; we do not retain the full BVN. Basis: legal obligation — CBN and anti-money-laundering rules require us to know who we pay.
Payout destination: Your bank or mobile-money account. We store only the last four digits plus a reference issued by our payments provider — never the full account number. Basis: performance of a contract.
Connected social accounts: When you connect Instagram, TikTok, YouTube or Facebook, we store an access token for that account, encrypted at rest. We use it to read public engagement figures on posts you publish for a campaign. We do not post on your behalf and we do not read your private messages. Basis: your consent, which you can withdraw at any time by disconnecting the account.
Campaign and content activity: Briefs you apply to, content you submit, review outcomes, and engagement figures (likes, comments, views) read from your published posts. Basis: performance of a contract.
Payments and ledger records: Amounts earned, withdrawn and pending, and the double-entry records behind them. Basis: legal obligation — these are financial records.
Security and device data: Sign-in events, passkey and authenticator-app credentials, IP address, and — if you enable notifications — a device push token. Basis: legitimate interest in keeping accounts and money secure.

What we do not do

We do not sell personal data, and we do not share it with advertisers or data brokers.
We do not post to your social accounts, or read your private messages or follower lists.
We do not use your data to train third-party AI models. Content moderation and authenticity scoring run on our own systems.
We do not send marketing to creators or brands who have not asked for it.

Who we share it with

We share personal data only with processors who help us run the service, each under a written agreement limiting them to our instructions:

Identity verification: Our KYC/AML provider, to confirm NIN/BVN and screen against sanctions lists.
Payments: Our licensed payment service provider and partner bank, to make transfers and hold escrowed campaign funds.
Social platforms: Meta, TikTok and Google, when you choose to connect an account. Their own privacy policies govern what they do.
Infrastructure: Our cloud hosting, object storage and transactional email providers.

Where your data is stored

Personal data is stored on servers in [region]. Where a processor operates outside Nigeria, the transfer is made under the safeguards permitted by Part VIII of the NDPA 2023, and we will name the mechanism relied on for each provider on request.

How long we keep it

Account and profile: For as long as your account is open, then [12] months.
KYC verification records: [5] years after the account closes, as anti-money-laundering rules require.
Financial and ledger records: [6] years, as tax and accounting law requires.
Social access tokens: Deleted immediately when you disconnect the account, or when the token is revoked by the platform.
Engagement figures: Kept with the campaign record for [24] months, then aggregated so they no longer identify a person.
Sign-in and security logs: [90] days.

How we protect it

Passwordless sign-in by default — passkeys, one-time links or your Google/Apple account. SMS codes are deliberately not used, because of SIM-swap risk.
A second factor is demanded before any money moves: funding a campaign, changing a payout destination, or withdrawing.
Social access tokens are encrypted at rest with AES-256-GCM.
Account numbers are never stored in full. Session tokens are held in cookies your browser will not expose to scripts.
Access to production data is limited to staff who need it, and is logged.

Your rights

Under the NDPA 2023 you may ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another service in a portable format. You may withdraw consent at any time where consent is the basis we relied on.

We answer within 30 days and do not charge for a first request. See the Your data rights page for how to make one.

Some rights have limits: we cannot delete records we are legally required to keep, such as verification and financial records, until their retention period ends.

If you are not satisfied with our response you may complain to the Nigeria Data Protection Commission at ndpc.gov.ng.

Children

The platform is not for anyone under 18. Creators must complete identity verification before they can be paid, and we delete any account we find belongs to a child.

Changes

If we change how we use personal data in a way that affects you, we will tell you by email and in the app before the change takes effect.