Privacy Policy

Alvinn Tech Limited (“Alvinn”, “we”, “us”, “our”, or “Company”), is committed to protecting the confidentiality, integrity and security of personal data entrusted to us. Alvinn operates the Alvinn creator platform.

This Privacy Policy (the “Policy”) explains how we collect, use, store, disclose, and otherwise process your data when you access or use our services, website, profiles, creator arena, storefronts, checkout, payment links, customer libraries and other related services. Alvinn is the data controller for personal data where we determine the purposes and means of processing that personal data. Certain third-party service providers may process personal data on our behalf, while some third parties may independently determine how and why they process personal data under their own privacy notices.

We process personal data in accordance with applicable data protection laws, including the Nigeria Data Protection Act 2023 (“NDPA”), applicable regulations, guidelines and other binding requirements issued by the Nigeria Data Protection Commission (“NDPC”).

By using the Platform, you acknowledge that you have read and understood this Privacy Policy.

This Privacy Policy applies to personal data processed through or in connection with your use of the Platform, including where you:

• create or use an Alvinn account;
• create or interact with a Creator, Explorer or Brand profile;
• use a storefront;
• purchase or access a digital product;
• use a Customer Library;
• use or interact with a payment link;
• participate in a collaboration;
• receive or make payments through the Platform;
• connect a supported social account;
• use Creator Arena or other Platform features;
• contact us for support or other enquiries; or
• visit or interact with our website.

This Privacy Policy applies to: Creators, Explorers, Brands, customers, collaborators, website visitors, and other individuals whose personal data we process in connection the Platform.

This Privacy Policy does not apply to third-party websites, applications, social platforms, payment services or other services that operate independently of us, even where such services are accessible through links or integrations on our Platform.

When you visit, access, or interact with our Platform, we collect information about you or from third parties where permitted by applicable law. Depending on the nature of your interaction with us, this information may include:

• account and profile data such as your full name, username or display name, e-mail address, profile photograph, mailing address, user type, location, age, account credentials and authentication information and phone number;
• connected social-account data such as connected username, profile name, profile photograph, and follower count. We do not currently import your social-media posts or social-platform analytics through these connections.
• Creator content and commercial data, such as product files, product titles and descriptions, photographs, videos, audio and other media, links, storefront information, collaboration invitations and responses, spotlight content, agreed earning percentage, creator balances, refund and dispute records, payment-link details, withdrawal information, and other information you submit or generate through use of Platform;
• Checkout and customer library data such as email address; name, where supplied; item or offering purchased; payment and transaction details; transaction status; applicable fees; currency; originating storefront; and information provided in connection with customer support or a transaction dispute. For anonymous checkout, we still collect the customer’s email address because it may be necessary to provide and protect Customer Library access, prevent fraud, send transactional communications and provide customer support. The customer’s email address is not disclosed to the creator merely because the customer uses anonymous checkout.
• Payout data such as bank name; account number, account name, verification status, payout reference, withdrawal history, and related payment or payout information. A payment or payout provider may request additional identity or compliance information in connection with verification. Where reasonably possible, Alvinn will rely on the provider’s verification result and retain masked details or a verification status or reference rather than unnecessary copies of raw identity documents.
• Usage, Analytics and Device data such as profile visits, product views, link clicks, checkout activity, sales and transaction events, traffic sources, approximate location inferred from technical information, IP address, browser type, operating system, device information, session information, time spent interacting with Platform features, security signals, error information; and fraud-prevention signals. We use this information to operate, secure, maintain and improve the Platform and to provide analytics and audience insights.

We may use your email address to create and protect a Customer Library. Library access may be verified using an email one-time verification code (“OTP”). If you subsequently create an Alvinn account using the same email address, eligible Library items may be linked to that account.

We may collect personal data:

• directly from you when you create or use an account;
• when you create or update your profile or storefront;
• when you upload or publish Creator content;
• when you purchase a product or use a payment link;
• when you interact with a Customer Library;
• when another user invites you to participate in a collaboration;
• when you connect a supported social account;
• automatically when you use the Platform;
• when you contact our support team or otherwise communicate with us;
• from customers interacting with your storefront or payment link;
• from payment, payout, authentication, email, hosting, security and other service providers supporting the Platform; and
• from other sources where collection is lawful and reasonably necessary for the relevant purpose.

Where we collect personal data from a third party, we will take reasonable steps to ensure that such collection and subsequent processing is lawful and appropriate in the circumstances.

We process your personal data only where a lawful basis exists under the applicable laws, which may include:

• Consent: When you give explicit consent to receive communications or use certain features.
• Contractual Obligation: To fulfill a contract or provide requested services.
• Legal Compliance: To comply with applicable laws and regulations.
• Legitimate Interests: To improve our services, maintain security, protect our rights and prevent fraud and abuse.
• Vital Interests: To protect your interests and rights as well as the interests of other persons.
• Public interests permitted by law.

We will only use the personal data provided for the purpose of the following:

• To create and manage accounts and profiles, provide access to Platform features, maintain secure authentication and account sessions, send OTPs and account-security communications, and administer our services;
• To provide, operate, maintain, and improve our Platform, publish profiles, storefronts, products, links and spotlights, facilitate collaborations, provide digital products and customer libraries, improve, test and develop the Platform;
• To process checkout transactions, maintain transaction records, record and allocate creator earnings, administer refunds and disputes, connect eligible payout accounts and process creator-initiated withdrawals;
• To respond to your enquiries, feedback, and other communications;
• To provide newsletters, updates, marketing communications, and other information you have requested or consented to receive;
• To personalize and improve your experience on our Platform;
• To manage risk, or to detect, prevent, and/or remediate fraud or other potentially prohibited or illegal activities; and
• To comply with applicable legal, regulatory, and reporting obligations.

We use the information we collect for internal operational purposes such as spam and abuse prevention and enforcing our content license restrictions and providing and improving the service.

We do not allow you to share personal information with third parties or make it publicly available.

Prior to and at the point of any data collection, you will be informed through a clear and accessible privacy notice. The notice will specify the types of personal data collected, the purpose for which the data is collected, the lawful basis underpinning the processing, and any recipients or categories of recipients with whom data may be shared, including external entities and authorized subcontractors.

Your personal data will be processed solely with your informed, freely given, and explicit consent, unless alternative legal grounds for processing apply as permitted by law. You will be given a straightforward mechanism to grant, withhold, or withdraw consent at any time.

We collect and process only the personal data that is strictly necessary for the specified and legitimate purposes disclosed in the privacy notice. We will not further process your personal data in a manner that is incompatible with those purposes.

Alvinn allows users to create profiles and, where available, public storefronts. Information that you deliberately choose to make public may be visible to other users or visitors to the Platform. Depending on the features you use, this may include profile name or display name; username; profile photograph; biography; links; products; collaborations; Spotlights; and other information you choose to publish.

You are responsible for deciding what information you make publicly available and should avoid publishing personal information that you do not want to be publicly accessible.

Where you participate in a collaboration, information identifying you as a collaborator may appear publicly in connection with the relevant item.

During the public beta, raw customer email addresses are not visible to creators or collaborators merely because a customer purchases or interacts with their content. Depending on the Platform feature and information available, a creator may see: a customer’s profile name, where available; a masked email address or other masked identifier; transaction amount; transaction date; transaction status; purchased item; and the storefront through which the interaction occurred.

A customer may be attributed to the storefront through which the customer interacted with the Platform and may appear within the relevant creator’s Audience information. Other collaborators may receive information about a transaction relevant to their collaboration and their own earnings allocation, but they do not receive the originating creator’s full audience record or the customer’s raw email address merely because of the collaboration.

We do not currently require checkout customers to opt in to marketing communications from individual creators. If future communication tools allow creators to communicate with an audience through Alvinn, we will implement appropriate privacy controls and update this Policy where necessary.

Anonymous checkout is designed to limit the information about a customer that is visible to the creator. Anonymous checkout does not mean that Alvinn receives no personal data. We may still process the customer’s email address and transaction information to: provide Customer Library access; process and record the transaction; detect and prevent fraud; comply with payment and legal obligations; send necessary transactional communications; and respond to customer-support requests or disputes.

The creator receives only the information made available through the relevant Platform functionality, which may include masked or anonymous transaction information.

We may disclose personal data where reasonably necessary for the purposes described in this Privacy Policy. This may include sharing relevant information with payment processors, payout providers, banking partners and fraud-prevention providers to process transactions, withdrawals, verification and payment-related security checks.

We may also share personal data with providers that host, store, secure or authenticate Platform services, as well as providers that assist us with sending OTPs, receipts, Customer Library access messages, transactional notifications and other communications. Where analytics, performance or error-monitoring providers are deployed, we may share relevant technical or usage information with those providers to assist us in monitoring, maintaining and improving the Platform.

We may disclose personal data to professional advisers, auditors, insurers and other persons where reasonably necessary for our business operations or to protect our rights. We may also disclose personal data to parties involved in a merger, acquisition, restructuring, financing or sale of assets, subject to appropriate safeguards and applicable law.

We may disclose personal data to courts, regulators, law-enforcement authorities or other competent bodies where required or permitted by law, including where disclosure is necessary to comply with a lawful request, order or regulatory requirement.

We may also disclose personal data where you direct us to do so or where you have provided valid consent and consent is the applicable lawful basis.

We do not sell personal data.

Where a third-party service provider processes personal data on our behalf, we will take reasonable steps to ensure that appropriate contractual, confidentiality and security measures are in place as required by applicable law.

The Platform may contain links to or integrations with third-party websites, applications, social media platforms, payment providers, and other services. Where you interact directly with an independently operated third-party service, that third party may collect and process your personal data under its own terms and privacy policy. We do not control the privacy practices of third parties that operate independently of us. Your use of those services is subject to the terms and privacy policies of the relevant third party, and you should review those policies before providing personal data to them or connecting them to your Platform account.

Some of our service providers may process personal data outside Nigeria. Where personal data is transferred outside Nigeria, Alvinn will implement an appropriate transfer mechanism or other safeguard where required by applicable Nigerian data-protection law. Depending on the circumstances, we may assess whether the destination provides an adequate level of protection and may implement contractual, technical or other measures required by applicable law to protect personal data transferred outside Nigeria.

Alvinn currently uses a first party, strictly necessary session cookie known as alvinn_session. This cookie is used to maintain secure authenticated sessions and support the operation and security of authenticated Platform features. It may contain securely signed authentication information and is configured with appropriate security attributes.

The current cookie is retained for a period of up to 30 days, subject to the applicable session and authentication requirements. Alvinn does not currently use preference cookies, advertising cookies, marketing pixels or analytics cookies such as Google Analytics or PostHog.

Our separate Cookie Policy provides further information about the cookies and similar technologies currently used by Alvinn. If we introduce additional non-essential cookies or similar technologies in the future, we will update our Cookie Policy and obtain consent where required by applicable law. You may manage or delete cookies through your browser settings. Blocking or deleting the Alvinn session cookie may sign you out of the Platform or prevent certain authenticated features from operating properly.

We may send transactional communications where necessary to provide, maintain or protect the Platform. These may include OTPs, receipts, Customer Library access messages, sale and transaction notices, collaboration notifications, withdrawal updates, dispute communications and security notices. These communications are necessary service communications and are not treated as promotional communications merely because they are sent electronically.

Where permitted by applicable law, we may send newsletters or promotional communications where you have opted in or where another lawful basis permits us to do so. You may unsubscribe from promotional communications at any time using the available unsubscribe mechanism or by contacting us.

Where necessary to ensure that we respect your marketing preferences, we may retain a minimal suppression record confirming that you have opted out of promotional communications.

We retain your personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy and to comply with applicable legal, regulatory, accounting, tax and other obligations. While your account remains active, we may retain account, transaction, analytics and other relevant information where necessary to provide and secure the Platform. Following closure of an account, we aim to delete or anonymise ordinary account and analytics data within 30 days, subject to the exceptions described below.

We may retain certain information for longer where necessary for payment and payout processing, accounting or tax obligations, fraud prevention, chargeback management, dispute resolution, legal or regulatory obligations, security purposes, enforcement of agreements or legitimate record-keeping requirements.

If you inform us that you no longer wish to be contacted, we will retain only the minimum information necessary to ensure no further contact is made. We will regularly review the personal data we hold and will securely delete or anonymize it when it is no longer required for any legal, business, or user-related purpose.

You have the right to:

• request access to and a copy of your personal data;
• request correction of inaccurate or incomplete personal data;
• request erasure or deletion of your personal data in appropriate circumstances;
• object to certain processing of your personal data, request restriction of certain processing and request portability of eligible personal data;
• withdraw consent where processing is based on consent;
• object to direct marketing;
• request information about our processing activities; and
• lodge a complaint with the relevant data protection authority.

If you wish to exercise any of your rights, you may contact us using the details provided in the “Contact Us” section of this Privacy Policy.

Alvinn implements reasonable technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss, destruction, misuse and other unlawful processing. Depending on the nature of the information and the Platform feature involved, our security measures may include access controls, encrypted communications, secure email-based authentication and OTPs, secure session cookies, service-provider security controls, monitoring, fraud-prevention measures and incident-response procedures.

Access to personal data is limited to personnel, contractors and service providers who require such access for legitimate business or Platform purposes and who are subject to appropriate confidentiality and security obligations.

No method of transmission, storage or electronic security can be guaranteed to be completely secure. You also have a role in protecting your personal data. You should protect access to the email account associated with your Alvinn account and should never share an OTP sent to you with another person.

The Platform is intended for persons aged 18 and above. A person under 18 may only use Alvinn through an account managed by a parent or legal guardian, where permitted by applicable law. If we become aware that personal data relating to a person under 18 has been provided in circumstances that do not comply with this requirement, we may restrict the relevant account and take reasonable steps to delete the information, subject to any legal or regulatory obligation requiring us to retain it.

Where we become aware of an actual or suspected personal data breach, we will take appropriate steps to investigate and manage the incident.

Our incident-management process may include assessing the nature and scope of the incident, securing affected systems, addressing identified vulnerabilities, documenting the incident and implementing measures designed to prevent recurrence.

Where notification is required by applicable law, Alvinn will notify the relevant regulatory authority and affected individuals within the applicable timeframe and in accordance with applicable legal requirements.

We are committed to maintaining robust data governance practices to ensure integrity, security and lawful handling of all personal data. We maintain and regularly review our data protection framework, which is fully aligned with the Nigeria Data Protection Commission General Application and Implementation Directive 2025 (GAID 2025), the Nigerian Data Protection Act, 2023 and all other data protection frameworks in Nigeria. This governs all our data processing activities and is reviewed periodically to adapt to regulatory changes and evolving best practices.

All our personnel receive regular, documented training on data protection principles, internal policies, and procedures relevant to their roles. This consistent education ensures that all staff members understand their responsibilities and are equipped to handle personal data in a secure, compliant, and ethical manner.

If you have a concern about how Alvinn collects, uses or otherwise processes your personal data, you may contact us using the contact details provided below. Where possible, you should provide sufficient information to enable us to investigate your concern, including your name and contact information, a description of the issue, details of the relevant processing or personal data and any supporting information that may assist our investigation.

We will review and investigate privacy complaints within a reasonable period and may request additional information where necessary to understand or resolve the complaint. If you are dissatisfied with our response or believe that your concern has not been adequately addressed, you may have the right to lodge a complaint with the Nigeria Data Protection Commission through its applicable complaint channels.

We may amend this Privacy Policy from time to time to reflect:

• changes to our Platform;
• new products or services;
• changes in our data-processing practices;
• changes in applicable law or regulatory requirements; or
• improvements to our privacy and security practices.

Where appropriate, we will notify users of material changes through the Platform, email or another appropriate communication channel.

The “Last Updated” date at the beginning of this Privacy Policy indicates when it was most recently revised. Your continued use of the Platform after an updated Privacy Policy takes effect will be subject to the updated Policy, to the extent permitted by applicable law.

If you have any questions about this Privacy Policy, wish to exercise a data-protection right or have a privacy-related concern, you may contact:

Alvinn Tech Limited
Lagos State, Nigeria

Privacy enquiries and data-protection requests: privacy@alvinn.app
General support: support@alvinn.app
Website: https://alvinn.app