1. Who We Are and Our Privacy Commitment
[Company legal name] ("Adniverse", "we", "our") is committed to protecting the privacy, personal autonomy, and digital integrity of our creators, brands, and partners in Nigeria and beyond. We design our systems under the principle of data minimization and structural separation: we collect only the data we strictly need to operate our creator-marketing platform and fulfill our legal and financial responsibilities.
2. Identity Verification & Sensitive ID Data
We verify your BVN or NIN with our licensed verification partner (Monnify). We keep the partner's response in encrypted form and a one-way keyed fingerprint of your ID number so one identity can't open multiple accounts. Staff can't read your ID number in our systems.
We store your verified date of birth to confirm you're 18+ and to match campaigns by age band.
Authentication is handled securely via passwordless one-time passcodes (OTP) and OAuth 2.0 with Supabase Auth. Adniverse application databases never store passwords.
3. How We Use Artificial Intelligence
We use Google Gemini to suggest campaign targeting and to check posts against the brief and our content rules. For post checks this includes the caption, transcript and frames from the video you posted publicly. We don't send your name, email, phone number, ID numbers or bank details. AI results are advisory; a person makes every adverse decision.
4. Information We Process & Lawful Basis
Under the Nigeria Data Protection Act 2023 (NDPA), we process personal data only when a recognized lawful basis applies:
| Purpose | Data Categories | Lawful Basis |
|---|---|---|
| Authentication & Account Management | Email, phone number, OTP session tokens | Performance of Contract |
| Creator KYC & Age Verification | Verified legal name, verified date of birth, encrypted partner verification response, one-way keyed ID fingerprint | Legal Obligation & Performance of Contract |
| Campaign Targeting & Age-Band Matching | Verified date of birth (age band only), connected channel audience metrics | Performance of Contract & Legitimate Interest |
| Post Verification & Deliverable Review | Public post URL, caption, audio transcript, video frames, view counts | Performance of Contract & Legitimate Interest |
| Escrow Accounting & Creator Payouts | Bank account number, account name, bank code, double-entry ledger transactions | Performance of Contract & Legal Obligation |
| Platform Security & Error Diagnosis | IP address, client user-agent, error stack traces, audit logs | Legitimate Interest |
5. Third-Party Service Providers & International Data Transfers
We engage trusted third-party service providers who process data on our behalf to deliver platform capabilities:
- Supabase: User authentication, session management, and encrypted database infrastructure.
- Monnify: Regulated identity verification partner (BVN, NIN) and domestic creator bank payouts in Nigeria.
- Stripe: Payment gateway for international brand wallet funding and card transactions.
- Cloudinary: Storage for brand media assets only (brand logos and reference video files). Creator videos are never uploaded to Cloudinary.
- Resend: Transactional emails, account notifications, and verification messages.
- Google Gemini: AI engine for campaign targeting suggestions and post content compliance analysis.
- Sentry: Real-time application error tracking and stability monitoring.
Some of these service providers process and store data on servers located outside Nigeria (including in the United States and the European Union). Where cross-border data transfers occur, we implement recognized safeguards in compliance with the Nigeria Data Protection Act 2023, including contractual data-protection commitments, encryption in transit and at rest, and strict access controls.
6. Data Retention and Account Deletion
When you delete your account we remove or anonymise your profile. We keep payment, ledger, audit and identity-verification records for as long as the law requires, then delete them.
7. Your Rights under the Nigeria Data Protection Act (NDPA 2023)
Under the Nigeria Data Protection Act 2023, you have guaranteed legal rights regarding your personal data:
- Right of Access: You can view your profile, verification status, connected social accounts, and payout accounts at any time from your account settings.
- Right to Rectification: You may request correction of inaccurate profile data by submitting updated verification documentation.
- Right to Erasure: You may request account deletion at any time, subject to statutory retention obligations for financial and audit records.
- Right to Object: You have the right to object to processing based on legitimate interests.
8. Privacy Requests & Regulatory Complaints
For privacy requests, inquiries, or to exercise your statutory rights under the NDPA 2023, please contact our Data Protection Officer at [privacy email].
If you believe your personal data has been handled in breach of Nigerian law, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC), the national regulatory authority overseeing data protection in Nigeria (website: https://ndpc.gov.ng).