Privacy Policy

1. Who We Are

kwayv Media operates kwayv — AfricaSoulCentral. We are the data controller under the Nigeria Data Protection Act 2023 (NDPA), GAID 2025, South Africa’s Protection of Personal Information Act (POPIA), and Ghana’s Data Protection Act 2012 (Act 843).

Privacy contact: privacy@kwayvapp.com

2. What Data We Collect

• Account data: Email address, display name, username, hashed password
• Content data: Videos, titles, descriptions, categories, thumbnails you upload
• Usage data: Views, likes, device type, browser, IP address, session duration
• Payment data: Transaction IDs via Paystack — we never store card numbers
• Audio fingerprints: Sent to ACRCloud at upload for copyright scanning only

We apply data minimisation — collecting only what is strictly necessary (NDPA s.24, POPIA s.10, Ghana DPA s.17).

3. Legal Basis for Processing

• Contract: Processing account data to deliver the service you signed up for
• Legitimate interests: Platform security, fraud prevention, service analytics
• Legal obligation: Copyright enforcement, law enforcement requests
• Consent: Marketing communications — you may withdraw at any time

4. How We Use Your Data

• To operate and continuously improve kwayv
• To authenticate your account and prevent fraud
• To display your uploaded content to other users
• To send platform notifications (opt out at any time in settings)
• To comply with copyright enforcement and legal obligations
• To process payments via Paystack

5. Data Storage & International Transfers

Your data is stored on Supabase infrastructure in the EU (Ireland). This constitutes a cross-border transfer under NDPA s.43, POPIA s.72, and Ghana DPA s.33. Supabase maintains GDPR compliance and a Data Processing Agreement is in place.

6. Your Rights

Under NDPA 2023, POPIA, and Ghana DPA 2012, you have the right to: access, correction, deletion, portability, objection, withdrawal of consent, and restriction of processing.

Email privacy@kwayvapp.com. We respond within 21 days (applying the strictest applicable timeline).

7. Data Retention

• Account & profile data: retained while account is active; deleted within 90 days of closure
• Uploaded videos: deleted within 30 days of account deletion
• Usage/analytics data: 24 months, then anonymised
• Payment records: 7 years (Nigerian FIRS tax compliance)
• IP address logs: 90 days for security purposes

8. Cookies & Tracking

Strictly necessary: Supabase session cookies for authentication — cannot be disabled. We do not use third-party advertising cookies without your explicit consent.

9. Third-Party Processors

• Supabase (EU/Ireland): Auth, database, file storage — GDPR compliant
• Paystack (Nigeria): Payment processing — PCI-DSS Level 1 certified
• ACRCloud: Audio copyright fingerprinting at upload only
• Cloudflare (USA): Hosting, CDN and DDoS protection

10. Data Breach Notification

In the event of a breach: NDPC notified within 72 hours (NDPA s.40); SA Information Regulator notified under POPIA s.22; Ghana DPC notified under Ghana DPA s.35. Affected users notified within 7 days where feasible.

11. Children’s Privacy

kwayv is strictly for users aged 18 and above. Accounts identified as belonging to minors are immediately deleted and reported where required by law.

12. Changes to This Policy

Material changes are notified via email or in-app notice with at least 14 days advance notice. Continued use after that period constitutes acceptance of the updated policy.