Privacy Policy

Creators: email address, password (stored hashed by our authentication provider), name, username, bio, social links, profile picture, the content you upload, bank name, the last four digits of your account number, and Paystack payout identifiers. Your full account number is sent to Paystack to verify it and set up payouts and is not kept in our database. If you deliver campaign work we also keep your Google Drive link and the screenshots you upload; screenshots are stored privately and only seen by the administrator who verifies the delivery. If you apply to a campaign you may attach screenshots of your page (followers, engagement) and a video of similar work. These are stored privately and shown only to the brand that posted the campaign, through links that expire after an hour, and to administrators.

Buyers: your email address, the order reference, the product bought, the amount paid, and any refund request you send. Your card or bank details are entered on Paystack’s payment page; we never see or store them.

Advertisers: brand name, email address, website, the campaign brief, any files you upload, and payment details. Creators who apply see the brief and your brand name; your email address is not shown to creators.

Usage data: when someone views a storefront or product, or starts checkout, we record the event with an anonymous visitor code. The code is a one-way hash of the IP address and browser details that changes every day, so we can count visits without storing the IP address or following anyone from one day to the next. IP addresses are also used briefly to limit abusive traffic.

• To run the marketplace: process payments, deliver files, send receipts, and handle refunds and disputes.
• To pay creators and prevent fraud or misuse.
• To show creators how their storefront performs (views, checkouts, sales).
• To keep the service secure, diagnose errors, and meet legal obligations.

Our lawful bases are performing the contract with you, our legitimate interests in running and securing the service, and compliance with legal obligations. We do not sell personal data and do not use it for advertising.

We use trusted providers to run the service. They process data only on our behalf:

• Paystack: payment processing, bank account verification, payouts, and refunds.
• Supabase: database, authentication, and file storage.
• Cloudflare R2: storage and delivery of uploaded files.
• Resend: sending receipts, download links, and notifications.
• Sentry: error monitoring (technical details of failures; we avoid sending personal data).
• Upstash: temporary request counters used to limit abuse.

A creator sees the email address and order details of people who buy from them, so they can fulfil orders and answer refund requests. We also disclose data where the law requires it or to protect people from fraud or harm.

Some providers store or process data outside Nigeria. Where that happens we rely on the safeguards the NDPA allows, such as contractual commitments from the provider to protect the data to an equivalent standard.

We use only the cookies needed to keep creators signed in. We do not use advertising or cross-site tracking cookies. Buyers browsing and purchasing as guests do not need an account cookie.

• Order and payment records are kept for as long as needed for refunds, disputes, accounting, and tax rules, which is generally at least six years.
• Payment webhook logs are kept for as long as needed to investigate payment problems.
• Usage events are kept in a form that does not identify individuals; we may aggregate or delete them after 24 months.
• Creator account data is kept while the account is open and deleted or anonymised after closure, except records we must keep by law.

Under the NDPA you can ask us to:

• confirm whether we hold data about you and give you a copy,
• correct data that is wrong or incomplete,
• delete data we no longer need, or restrict or object to how we use it,
• give you your data in a portable format, and
• stop any processing that relies on your consent (this does not affect what we did before).

Use the request form and we will respond within 30 days. You can also complain to the Nigeria Data Protection Commission.

Data is encrypted in transit. Access to the database is restricted by row-level security, payment webhooks are signature-verified, paid files are only reachable through short-lived signed links, and server errors are monitored. No system is perfectly secure; if a breach affects your data we will notify you and the regulator as the NDPA requires.

The service is for people aged 18 and over. We do not knowingly collect data from children.

We will update this policy as the service changes; the date at the top shows the latest version. See also our Terms of Service.