Privacy Policy

We collect only what we need to run Cinevoya, protect our filmmakers, and give you a smooth viewing experience:

• Account details — your name, email address, phone number, chosen role (Viewer or Filmmaker), and the password hash you set at sign-up.
• Payment information — when you rent a film or top up your wallet, our payment processors collect your card / bank details directly. Cinevoya never stores full card numbers or bank passwords. We do keep a transaction reference, the amount, the currency (NGN or USD), and the timestamp.
• Filmmaker content — for creators, we store your uploaded videos, posters, synopsis, cast/crew credits, bank-account routing information (used solely for payouts), and any festival-request forms you submit.
• Usage data — pages visited, films rented, the approximate country your IP resolves to (used to price in NGN for Nigeria vs USD for diaspora), device type, and any error logs that help us fix bugs.
• Communications — the content of emails you send our support desk and the RSVPs / film submissions you make through our event and submission forms.

We use your personal data for the following purposes:

• Account management — to create and secure your account, authenticate logins, reset forgotten passwords, verify your email, and enforce role-based access (Viewer, Filmmaker, Admin).
• Payment processing — to charge for rentals, credit your wallet, pay filmmaker earnings, refund cancelled transactions, and comply with Nigerian tax and anti-fraud obligations.
• Communications — to send transactional emails (rental receipts, password resets, event tickets, submission confirmations) and, only if you opt in, occasional updates about new films, launch events, and platform features.
• Curation & safety — to review filmmaker submissions, detect fraudulent uploads, protect the platform against abuse, and honour DMCA / copyright takedown requests.
• Platform improvement — to measure which films and features are popular so we can invest editorial and engineering effort where it matters.

Cinevoya relies on a small, carefully-chosen set of processors. Each one only receives the minimum data it needs to do its job, and each has its own privacy policy that we've reviewed:

• Paystack (Naira payments)
  Processes rentals and wallet top-ups paid in Nigerian Naira. Receives your name, email, phone number, and card / bank details entered on their secure checkout — never on Cinevoya servers. See paystack.com/privacy.
• Flutterwave (USD / diaspora payments)
  Processes rentals and wallet top-ups paid in US Dollars for viewers outside Nigeria. Receives the same minimum-necessary identity + payment details. See flutterwave.com/privacy-policy.
• Resend (transactional email)
  Sends transactional and event emails on our behalf. Receives your email address, name, and the content of the message being sent (e.g. a rental receipt or launch-night RSVP). See resend.com/legal/privacy-policy.

We do not sell your data to advertisers or data brokers. We do not share your data with any third party other than the processors listed above, except where required by Nigerian law or a valid court order.

Under the Nigeria Data Protection Act 2023 (and GDPR for diaspora viewers), you have the following rights over your personal data. To exercise any of them, email us at privacy@cinevoya.com from the address on your account — we respond within 30 days.

• Right of access — request a copy of the personal data we hold about you.
• Right to rectify — correct anything that's inaccurate or out of date. Most fields you can edit yourself from your profile page.
• Right to deletion — ask us to erase your account and personal data. We honour deletion within 30 days, except where we're legally required to keep records (e.g. financial transactions for tax audits, retained for up to 7 years).
• Right to opt out — unsubscribe from marketing emails any time via the link in every email footer, or reply STOP to any SMS. Transactional messages (receipts, security alerts, event tickets) cannot be opted out of while your account is active.
• Right to portability — receive your data in a machine-readable format so you can move it to another service.
• Right to complain — you may lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe we've mishandled your data.

Cinevoya uses a small number of first-party cookies and browser-local-storage entries — nothing is sold or shared with advertising networks:

• Session cookie — an HttpOnly, Secure cookie that keeps you logged in for 7 days. Strictly necessary; the site can't authenticate you without it.
• Preference storage — a lightweight localStorage entry that remembers whether you've dismissed install prompts, the launch-night banner, or the offline viewing snapshot. No personal data leaves your device.
• Payment processor cookies — Paystack and Flutterwave may set cookies on their own checkout domains for fraud prevention. These are governed by their own privacy policies.

You can clear cookies and local storage at any time from your browser settings. Doing so will log you out and reset your in-browser preferences.

We keep account data for as long as your account is active. If you delete your account, we erase your profile within 30 days, retaining only the minimum records needed to meet legal obligations (typically up to 7 years for financial transaction records under Nigerian tax law).

Passwords are hashed with bcrypt before storage — we never see your plaintext password. All traffic between your device and Cinevoya is encrypted in transit via TLS 1.2+. Our database access is restricted, credentials are rotated, and payment data is tokenised by Paystack / Flutterwave rather than stored on our infrastructure. No system is 100% secure — if we detect a breach affecting your data we will notify you within 72 hours in line with the NDPA.

Cinevoya is not directed at children under 13, and we do not knowingly collect data from anyone under 13. If you believe a child has created an account, email us at privacy@cinevoya.com and we will delete the account.

We may update this policy occasionally as the platform evolves or the law changes. When we do, we'll bump the effective date at the top of this page and, for material changes, notify you by email at least 14 days before the change takes effect.

For any privacy enquiry, data-rights request, or complaint, contact our data-protection team: