Privacy Policy

At Foleio, we take your privacy seriously. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the Foleio platform. It is written in compliance with the Nigeria Data Protection Act, 2023 (NDPA) and applies to all users of Foleio, including creators, fans, and customers.

By using Foleio, you consent to the practices described in this Policy.

1. Who We Are (Data Controller)

Foleio is the data controller responsible for your personal data. We determine the purposes and means of processing your data.

Contact: legal@foleio.com

[Insert full registered business name and address once CAC registration is complete]

2. Data We Collect

Information you provide directly:

• Account registration: full name, email address, phone number
• Creator onboarding: business name, bank account details, social media handles
• Booking forms: customer name, email, phone number, address, booking notes
• Payment: payment card details (processed and stored securely by Paystack - Foleio does not store card data)
• Content uploads: video files, images, PDFs, and associated metadata
• Communications: messages sent to our support team

Information we collect automatically:

• Usage data: pages visited, features used, content viewed, time spent on Platform
• Device data: IP address, browser type, operating system, device identifiers
• Transaction data: payment references, amounts, transaction timestamps
• Cookies and similar tracking technologies (see Section 8)

Information from third parties:

• Paystack: payment verification status, transaction references, subscription status
• Mux / Cloudflare: video upload and streaming metadata
• Supabase: authentication session data

3. How We Use Your Data

• To create and manage your account - Legal basis: Contract performance
• To process payments and manage payouts - Legal basis: Contract performance
• To deliver content, bookings, and subscriptions you have purchased - Legal basis: Contract performance
• To send transactional emails (booking confirmations, purchase receipts, payout notifications) - Legal basis: Contract performance
• To send platform updates and product announcements - Legal basis: Legitimate interest (you may opt out at any time)
• To prevent fraud, abuse, and ensure platform security - Legal basis: Legitimate interest
• To comply with legal obligations under Nigerian law - Legal basis: Legal obligation
• To improve our Platform through aggregated, anonymised analytics - Legal basis: Legitimate interest

4. How We Share Your Data

We do not sell your personal data. We share data only in the following circumstances:

Service Providers: We share data with trusted third-party providers who process data on our behalf, including Paystack (payments), Mux (video hosting), Cloudflare (storage and CDN), Supabase (auth and database), Resend (email delivery), and Sentry (error monitoring). All providers are contractually bound to process data only as instructed by Foleio.

Between Creators and Fans: Certain information is necessarily shared - for example, a creator can see the name, email, and phone number of customers who book their services. By using the Platform, you consent to this limited sharing as necessary to deliver the services you have requested.

Legal Requirements: We may disclose your data where required by law, court order, or government authority, including the Nigeria Data Protection Commission (NDPC).

Business Transfers: In the event of a merger or acquisition, your data may be transferred as part of that transaction. We will notify you before your data is transferred.

5. Data Retention

• Account data: retained for the duration of your account and 2 years after closure
• Transaction and payment records: retained for 6 years (Nigerian financial regulations)
• Content uploads: retained until you delete them or close your account
• Booking records: retained for 3 years after the booking date
• Support communications: retained for 2 years

After these periods, data is securely deleted or anonymised.

6. Your Rights Under the NDPA 2023

• Right to access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your personal data, subject to our legal retention obligations.
• Right to restriction: Request that we limit how we process your data in certain circumstances.
• Right to data portability: Request a copy of your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interest at any time.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at legal@foleio.com. We will respond within 30 days.

7. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption of data in transit (HTTPS/TLS) and at rest, access controls, regular security assessments, and secure third-party infrastructure. In the event of a data breach that poses a risk to your rights, we will notify the NDPC within 72 hours and affected users without undue delay, as required by the NDPA 2023.

8. Cookies & Tracking

Foleio uses cookies to maintain your session and authentication state (essential), remember your preferences (functional - with your consent), and analyse Platform usage through anonymised analytics (with your consent). You can manage your cookie preferences at any time through our cookie banner or by contacting us.

9. Children's Privacy

Foleio is not directed at children under the age of 18. We do not knowingly collect personal data from minors. If we become aware that a child under 18 has provided us with personal data, we will delete such data promptly. Contact us at legal@foleio.com if you believe a minor has provided us with data.

10. Cross-Border Data Transfers

Some of our service providers (including Cloudflare, Mux, and Supabase) may process or store data outside Nigeria. Where we transfer data internationally, we ensure appropriate safeguards are in place in accordance with Section 42 of the NDPA 2023. We will not transfer your data to countries without adequate data protection laws without your explicit consent.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email and by posting a notice on the Platform. Your continued use of the Platform after the effective date constitutes acceptance of the updated Policy.

12. Contact & Complaints

Email: legal@foleio.com

Website: www.foleio.com

[Insert full address once CAC registration is complete]

If you are not satisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.