Privacy Policy

1. Who we are; scope of this policy

Crafya is a creator-and-business collaboration platform under development, beginning with a public website and waitlist and expanding, as features are launched, to creator discovery, brand campaigns, communications, performance analytics, commerce tools and AI assistance.

For the current unincorporated venture, the person responsible for Crafya's decisions about personal data is Paul Okonkwo, founder and promoter of Crafya, based in Nigeria ("Crafya", "we", "us"). We will update this notice to name the registered operating entity if and when it takes over the service. Contact: hello@crafya.com. Business correspondence address: House B1G, Admiralty Estate, Asokoro, Abuja, Nigeria.

This policy applies to the website, waitlist, research forms, invitations and any Crafya creator or business account, closed beta and activated feature. We distinguish below between data collected now and data that may be collected only when a future feature is actually introduced. Other third parties, including connected social networks and merchants, have their own privacy notices.

2. Information collected today: website and waitlist

When you join the waitlist, enquire about early access or respond to research, we may collect your name, email address, user type (creator/business), company or creator name, social handle/links that you choose to share, niche/industry, interests, responses, feedback, interview notes and communications.

When you browse the site, we may process limited technical information such as IP address, browser/device type, basic log events, pages visited, referrer and security signals. Optional analytics or advertising technologies are used only when actually deployed and with required choices/consent. We record your communications preferences and relevant consent timestamp and notice/version.

Please do not send government identity numbers, card details, passwords, sensitive personal data or private third-party records through the public waitlist.

3. Information collected when accounts and beta features launch

If you receive account access, we may process login identifiers, identity/contact details, profile photograph, city/country, creator categories and portfolio links, business name and representatives, user roles, verification status, notification settings and account support history.

For brand campaigns, we may collect campaign briefs, applications and invitations, agreed collaboration terms, deliverables, timelines, rate cards, usage-rights choices, approvals, submission links or files, communications and campaign status. Businesses and creators supply much of this information directly.

For any paid workflow that is activated, we may receive transaction identifiers, amount, currency, fee, status, invoice and payout reconciliation data from our payment partner. The payment provider may collect verification or bank details directly. We do not intend to store full payment-card numbers or card security codes.

Future commerce features may involve product listings, referral links/codes, qualifying conversion events, commission amounts and adjustment/refund records. Future AI tools may process the prompts and campaign context you choose to provide, along with AI responses and user-approved actions, subject to feature-specific notices.

4. Connected social accounts: permissions and data

Where Crafya offers official social integrations, you may choose to connect accounts such as Instagram/Meta, YouTube/Google, TikTok, X, Reddit or Twitch. Each integration will identify the social platform and permissions requested before you authorize access. Not every platform, metric or permission will be available at launch.

Depending on permission and platform capability, we may receive account ID, handle, profile link/image, follower or subscriber figures, post/media identifiers, publicly available or authorized content statistics (such as views, impressions, reach and engagement), selected aggregate audience demographics (such as age range or country), and token/connection metadata needed to maintain the link. We do not request your social-network password.

Crafya will not assume access to private messages, contacts, exact audience identities, or detailed demographic data merely because you connect an account. We will request additional permissions and provide notice if a specific feature requires such information. Platform terms, restricted categories, access quotas, retention rules and revocation mechanisms also apply.

You may disconnect through any provided Crafya control and/or revoke the integration in the social service's own settings. We will stop future access using the revoked authorization once technically effective, subject to the platform's processing and propagation delays. We remove stored tokens and eligible cached data on a defined deletion schedule, while retaining required campaign or legal records only where justified.

5. How we use personal information

We use relevant data to: (a) maintain the website and waitlist; (b) assess early-access interest and run user research; (c) create and secure accounts and respond to support; (d) display profiles and help brands discover creators; (e) administer campaigns, accepted terms, submissions, review, messaging and performance reporting; (f) facilitate enabled billing, payouts, referrals and commissions; (g) prevent abuse and inaccurate or fraudulent metrics; (h) improve reliability and product design; and (i) comply with law and enforce lawful agreements.

We do not sell personal information. We will not use creator social-account connections to post on their behalf, access undisclosed categories of private information, or conduct unrelated advertising without the necessary permissions and notices.

6. Lawful grounds for processing

Our lawful grounds under applicable data-protection law depend on the activity: consent for optional newsletters, direct marketing, optional non-essential tracking and certain social permissions; contract or steps requested before contract for account, campaign and transaction workflows; legitimate interests (balanced against your rights) for service security, basic operations, fraud prevention and product improvements; and legal obligations for compliance and record keeping.

Where we rely on consent, you may withdraw it without affecting processing already carried out lawfully. Withdrawal may mean we cannot provide a feature that depends on that permission. We will provide clear choices for uses that legally require separate consent.

7. Profiles, brand visibility and sharing in collaborations

Depending on the interface and privacy settings, creator profile information---including name, handle, niche, portfolio, offered services, location at the level provided, rate card, performance summaries and selected aggregate audience demographics---may be displayed to businesses or visitors for discovery.

When you apply for, are invited to or accept a campaign, the relevant business or creator may see the information necessary to assess and conduct that collaboration, including application materials, agreed terms, submissions, discussion and measurement reports. These recipients are independent participants and may have their own legal responsibilities for data they receive.

We aim to share aggregate audience information, not lists of individual followers. We will not publish raw OAuth access tokens, your private social credentials, bank details or personal contact information that a user has not authorized for disclosure. Be mindful that content you deliberately place on a public profile may be copied or indexed by third parties outside our control.

8. Communications, waitlist and marketing choices

Joining the waitlist may require necessary messages confirming your registration, access request or response to a specific enquiry. Optional newsletters, promotional emails, research invitations or launch marketing use a separate, unticked opt-in where consent is the relevant lawful basis. A person can join the waitlist without consenting to unrelated marketing messages.

Every promotional email we control will explain how to unsubscribe, or you may opt out by contacting hello@crafya.com. Opting out does not prevent essential transactional, account security or directly requested messages. We retain a limited suppression record to honor opt-outs.

9. Analytics, cookies and advertising technologies

Necessary technologies may keep the site secure, remember a session or enable core functions. If we use optional analytics, advertising pixels or behavioral measurement tools, we will describe their purposes and providers through a cookie/settings notice and obtain consent where required before activating them.

You may reject non-essential cookies without losing access to essential website content. You can adjust choices through a cookie-preferences interface if deployed, as well as relevant browser controls. We will not treat closing a banner or merely browsing as broad consent for non-essential marketing cookies.

10. AI tools and automated decisions --- only if enabled

If we launch AI-powered campaign drafting, matching or recommendations, we may process the prompts, campaign specifications and limited account information you submit or authorize for the feature. Outputs may be reviewed by authorized staff for support, safety or quality subject to appropriate controls.

We will not use non-public messages, private creator content or connected-platform data to train third-party general-purpose AI models without specific notice and an appropriate lawful basis. We will explain any new provider categories and material uses before activation.

Where an automated process would make a decision producing legal or similarly significant effects on an individual, we will implement applicable safeguards and rights, including human review where required, rather than assuming a recommendation is definitive.

11. Who may receive information

We may share limited data with: (a) creators and businesses involved in a requested collaboration; (b) hosting, database, email, forms, security and support vendors acting for us; (c) connected social-network providers and approved integration services; (d) authorized payment providers and, if activated, commerce or affiliate partners; (e) professional advisers or auditors under confidentiality where appropriate; and (f) regulators, courts or lawful authorities when legally required.

Where providers act on our instructions, we seek contractual and security protections proportionate to their processing. Where another company independently determines how to process data (for example, a merchant, social network or payment provider), its privacy notice also applies.

We will disclose material changes to categories of recipients or uses as the product develops. We do not permit vendors to use our users' personal data for their unrelated advertising simply because they provide us a service.

12. International processing and transfers

Crafya may use infrastructure or service providers outside Nigeria as its technology develops. When personal data is transferred internationally, we will assess the transfer and rely on a permitted basis under the Nigeria Data Protection Act 2023, including appropriate protections, approved instruments, an adequacy mechanism or a lawful exception where applicable.

If consent is required for a particular transfer, we will inform you of relevant risks and ask for that consent. This policy is not itself a blanket consent to transfer information to any country.

13. Retention and deletion

We keep information for the shortest reasonably necessary period for the stated purpose and may retain limited records where required by law, for fraud prevention, outstanding payments or genuine disputes. For the pre-launch waitlist, our intended maximum is 24 months after the last meaningful interaction unless you renew your interest, a shorter period is necessary, or law requires otherwise. Marketing subscriptions end on opt-out, except a minimal suppression record.

If a connected social account is revoked, we intend to delete active access tokens and data cached solely for that connection within 30 days of confirmed revocation, subject to provider requirements and justified retention of existing collaboration evidence. If a user account is closed, we intend to remove ordinary profile data from active systems within 30 days and routine backups within 90 days, except where an identified lawful retention obligation applies.

Campaign agreements, payments and associated records may need to be kept for a longer period to meet accounting, tax, evidentiary or legal obligations; they will not be retained indefinitely without a continuing lawful reason. We will implement and regularly review internal schedules so our actual deletion processes match these commitments. You may request details about a specific category of your data.

14. Security and incident response

We apply measures proportionate to the data and risks, such as access restrictions, authorization controls, secure transmission, vendor review, monitored systems and appropriate incident-response processes. No service can guarantee absolute security. Please use a strong password if an account is offered and tell us promptly if you suspect unauthorized access.

Where a personal-data incident triggers a legal duty to notify affected individuals or the regulator, we will follow applicable notification requirements.

15. Your data-protection rights

Subject to applicable law and any lawful exceptions, you can ask to be informed about processing, access personal data, correct inaccurate records, delete eligible data, restrict or object to certain uses, withdraw consent, seek portability and challenge qualifying solely automated decisions. You can also complain to the Nigeria Data Protection Commission (NDPC).

To exercise a right, contact hello@crafya.com with enough information to locate your record. We may need to verify your identity before disclosing personal information. We will respond in accordance with applicable legal time limits and explain if a lawful exception applies. We will not require you to consent to unrelated marketing to exercise a right.

16. Children and sensitive information

Crafya's account services and commercial collaborations are intended for adults aged 18 and over, and the current waitlist is not directed at children. We do not knowingly seek children's personal information for this service. If we discover ineligible information, we will review it and delete it or apply any legally required protections.

Please do not provide sensitive personal data (such as medical, biometric, religious or political information), government identifiers or another person's private audience data unless a specific secure process clearly requests it and a lawful basis exists.

17. Changes to this notice

We may update this notice as the website becomes an active platform or new integrations, payment tools, commerce features or AI functions are introduced. We will identify the revision date and, where changes materially affect your choices or data uses, provide appropriate notice or obtain fresh consent as required. Previous lawful processing is not retroactively changed by an updated notice.

18. Contact and complaints

Privacy requests and complaints: hello@crafya.com. Data controller/operator (current stage): Paul Okonkwo, founder/promoter of Crafya, Nigeria. Business correspondence address: House B1G, Admiralty Estate, Asokoro, Abuja, Nigeria.

If you are dissatisfied with our response, you may contact the Nigeria Data Protection Commission via its official website, https://ndpc.gov.ng/. You may also have other remedies under applicable law.