Naijacraft Privacy Policy

Effective date: 8 November 2026
Last updated: 8 November 2026

This Privacy Policy explains how Craft Concepts and Technology Nigeria Limited (“Naijacraft”, “we”, “us” or “our”) collects, uses, discloses, stores and protects personal data when you access or use:

• Naijacraft.com.
• Naijacraft mobile applications.
• Naijacraft accounts and public profiles.
• Music streaming, download and playlist services.
• Creator uploads and release-management tools.
• Artist claims and Artist-team management.
• Rights-holder invitations and royalty administration.
• Memberships, subscriptions and promotions.
• Advertising, analytics, Artist Support and payment services.
• Customer support, reports and related Naijacraft services.

These services are collectively referred to as the “Platform”.

This Privacy Policy is intended to comply with the Nigeria Data Protection Act 2023 and other applicable privacy and data-protection requirements.

By using the Platform, you acknowledge that your personal data will be processed as explained in this Privacy Policy. Where consent is legally required, Naijacraft will request it separately.

1. Data controller and contact

The data controller responsible for personal data processed through the Platform is:

Craft Concepts and Technology Nigeria Limited
Trading as Naijacraft
Federal Republic of Nigeria

Current business, support and privacy contact details are available through the official Contact or Support facility on Naijacraft.com.

Privacy enquiries and data-rights requests should be clearly marked “Privacy Request”.

Do not send passwords, PINs, complete card numbers, bank authentication details or one-time passwords to Naijacraft support.

2. Scope of this Privacy Policy

This Privacy Policy applies to personal data processed by Naijacraft in connection with the Platform.

It does not govern the independent privacy practices of third-party websites, payment providers, advertising services, social networks or applications that you may access through external links. Those organisations may act as separate data controllers and maintain their own privacy policies.

Where Naijacraft processes personal data solely on behalf of another organisation under a written agreement, the relevant organisation may be responsible for providing additional privacy information.

3. Data-protection principles

Naijacraft aims to process personal data in a manner that is:

• Fair, lawful and transparent.
• Limited to specified and legitimate purposes.
• Adequate, relevant and no more than reasonably necessary.
• Accurate and kept current where appropriate.
• Retained only for as long as reasonably necessary or legally required.
• Protected through appropriate technical and organisational safeguards.
• Subject to accountability, oversight and documented access controls.

4. Personal data we collect

The information collected depends on how you use the Platform.

Account and identity information

This may include:

• Username and display name.
• Email address.
• Telephone number.
• Password in securely hashed form.
• Profile photograph and cover image.
• Biography and public-profile information.
• Country or general location.
• Account registration date.
• Email and telephone-verification status.
• Account role, permissions and membership status.
• Login, recovery and authentication records.
• Identity-verification information where required.

Creator and Artist information

Where you use creator or Artist services, we may process:

• Creator-access requests and decisions.
• Artist names, biographies, photographs and catalogue information.
• Artist claims and supporting evidence.
• Artist-team membership and assigned roles.
• Management permissions and approval status.
• Label, manager, distributor and team relationships.
• Verification requests and decisions.
• Audit records concerning changes to Artist access.

Public Artist information may remain visible separately from the personal account that manages it.

Upload and catalogue information

This may include:

• Audio files.
• Cover artwork and individual track artwork.
• Track and release titles.
• Primary and featured Artist information.
• Songwriter, composer, producer and contributor information.
• Genre, country, language and release date.
• UPC, EAN, ISRC and other identifiers.
• Copyright declarations.
• Master and composition information.
• Distribution and download settings.
• Release submissions, revisions and review decisions.
• Content reports, takedowns and dispute records.

Rights and royalty information

Where rights-management or monetisation services are used, we may process:

• Master-rights and composition-rights schedules.
• Rights-holder names, roles and ownership percentages.
• Rights-holder invitation email addresses.
• Invitation tokens, expiry status and acceptance records.
• Evidence submitted in support of ownership.
• Rights-review decisions.
• Corrections, objections, disputes and overrides.
• Qualified-stream and eligible-download records.
• Royalty statements and allocation records.
• Available, pending, reserved, paid and reversed balances.
• Payout eligibility and threshold status.
• Permanent financial and rights audit records.

Artist-management authority and royalty ownership are treated as separate records.

Payment and payout information

This may include:

• Payment and transfer references.
• Transaction amounts, dates and currency.
• Payment status.
• Subscription or promotion purchased.
• Limited payment-method information returned by a payment provider.
• Billing email address.
• Bank name, account name and account number where required for payouts.
• Recipient codes and transfer references.
• Tax, identity and payout-verification records where legally or operationally required.
• Refund, reversal, chargeback and dispute information.

Full card details are normally collected and handled directly by an authorised payment provider such as Paystack. Naijacraft does not ordinarily receive or store your complete card number, PIN or card-security code.

Streaming, download and engagement data

We may process:

• Track and album plays.
• Playback start, progress and completion events.
• Qualified and rejected stream indicators.
• Download activity.
• Likes, follows, playlists and shares.
• Search activity.
• Queue and listening-history information.
• Referral source and playback source.
• Approximate country, device and browser information.
• Fraud, repetition and artificial-activity indicators.
• Artist and catalogue analytics.

Logged-in users and visitors may both generate usage events. Where possible, visitor analytics are measured using pseudonymous device, cookie, session or network information rather than a directly identified account.

Device, log and security information

This may include:

• Internet Protocol address.
• Browser and device type.
• Operating system.
• Application version.
• Language and time zone.
• Login time and session identifiers.
• Security and error logs.
• Failed-login records.
• Approximate location derived from an IP address.
• Cookie identifiers.
• Fraud and account-compromise indicators.
• Administrative actions and permission changes.
• Information required to investigate security incidents.

Advertising and promotional information

Where advertising or promotion services operate, we may process:

• Advertisement requests and impressions.
• Placement and campaign identifiers.
• Click and engagement events.
• Frequency-control information.
• Approximate reach.
• Device, session and cookie identifiers.
• Promoted content and campaign schedules.
• Campaign purchases and payment status.
• Fraud and invalid-traffic indicators.

Third-party advertising providers may independently process information in accordance with their own privacy policies.

Communications and support information

This may include:

• Messages sent through the Platform.
• Support requests.
• Complaint and report details.
• Email and notification delivery records.
• Survey responses.
• Rights disputes.
• Copyright notices.
• Communications with Artist teams, rights holders and administrators.
• Evidence and attachments voluntarily submitted to us.

Publicly available information

Information you intentionally publish may be visible to other users or the public, including:

• Display name.
• Profile photograph.
• Biography.
• Public playlists.
• Public posts or comments.
• Artist pages.
• Published tracks and releases.
• Public follower or following activity.
• Artist-team role where the Platform expressly displays it.

You should not publish private information that you do not want others to see.

Sensitive personal data

Naijacraft does not seek to collect sensitive personal data unless it is reasonably necessary and legally permitted.

Sensitive information may occasionally arise during identity verification, payment verification, legal disputes, rights claims, fraud investigations or support requests. Where required, Naijacraft will apply additional safeguards and an appropriate lawful basis.

5. How we collect personal data

We collect personal data:

• Directly from you when you register, upload content, purchase a service, submit a claim, configure a profile, contact support or complete a form.
• Automatically when you access or use the Platform.
• From payment providers, banks and transfer services.
• From Artist managers, labels, distributors or rights holders who identify or invite you.
• From users who report content or submit rights information.
• From service providers assisting with security, analytics, advertising or identity verification.
• From publicly available sources where lawful and reasonably necessary.
• From regulators, courts, law-enforcement authorities or professional advisers where appropriate.

If another person provides your information as part of a rights schedule or invitation, Naijacraft will use it only for legitimate rights-administration, contact, security and legal purposes.

6. Why we process personal data

Naijacraft may process personal data to:

• Create, secure and maintain accounts.
• Authenticate users and recover accounts.
• Provide music streaming and download services.
• Process uploads and catalogue submissions.
• Review and publish releases.
• Administer Artist claims and Artist-team access.
• Verify management authority.
• Administer master and composition rights.
• Send and manage rights-holder invitations.
• Calculate, allocate and report royalties.
• Process subscriptions, promotions, Artist Support and other payments.
• Verify payout profiles and process transfers.
• Record payment failures, reversals and disputes.
• Provide creator and Artist analytics.
• Count legitimate usage and reject artificial activity.
• Detect fraud, abuse, copyright infringement and security threats.
• Protect users, rights holders, advertisers and Naijacraft.
• Operate advertising and promotional services.
• Apply advertisement-frequency controls.
• Provide customer support.
• Investigate complaints and resolve disputes.
• Send transactional and security communications.
• Send marketing where consent or another lawful basis permits.
• Improve performance, reliability, accessibility and user experience.
• Conduct internal reporting, auditing and compliance.
• Establish, exercise or defend legal claims.
• Comply with legal, tax, regulatory and accounting obligations.

Naijacraft will not use personal data for an incompatible purpose without an appropriate lawful basis and, where required, additional notice or consent.

7. Lawful bases

Depending on the activity, Naijacraft may rely on one or more of the following lawful bases:

Performance of a contract

Processing may be necessary to:

• Register and maintain your account.
• Provide streaming or creator services.
• Process an upload.
• Supply a purchased plan or promotion.
• Administer an Artist-team relationship.
• Process an authorised payment or payout.
• Provide support requested by you.

Legal obligation

Processing may be necessary to:

• Maintain financial and transaction records.
• Respond to lawful requests.
• Meet tax, accounting, consumer-protection and data-protection duties.
• Investigate fraud or unlawful activity.
• Preserve evidence required by law.

Legitimate interests

Naijacraft may process data where reasonably necessary to:

• Secure the Platform.
• Prevent fraud and artificial activity.
• Maintain accurate rights and financial records.
• Improve and measure services.
• Protect copyright and contractual rights.
• Resolve disputes.
• Understand Platform performance.
• Prevent abuse of trials, promotions or accounts.

Naijacraft will not rely on legitimate interests where those interests are overridden by your fundamental rights, freedoms or reasonable expectations.

Consent

Consent may be used for:

• Optional marketing.
• Certain cookies or tracking technologies.
• Processing that is not necessary to provide the requested service.
• Specific uses of sensitive personal data.
• Other activities where consent is legally required.

Consent must be affirmative. Silence, inactivity or a preselected option will not be treated as consent where the law requires consent.

You may withdraw consent for future processing. Withdrawal does not make processing that occurred before withdrawal unlawful.

Vital interests or public interest

In limited circumstances, processing may be necessary to protect someone’s vital interests or perform an applicable public-interest obligation.

8. Cookies and similar technologies

Naijacraft and authorised service providers may use cookies, local storage, pixels, software-development kits and similar technologies to:

• Keep users signed in.
• Maintain security.
• Remember preferences.
• Preserve playback or queue information.
• Measure performance.
• Count legitimate usage.
• Prevent fraud.
• Control advertising frequency.
• Provide analytics and advertising.
• Understand referrals and campaign performance.

Some technologies are necessary for the Platform to work. Other analytics or advertising technologies may be optional where consent is required.

Your browser or device may allow you to block or remove cookies. Blocking necessary technologies may prevent certain features from working correctly.

Third-party services, including advertising and analytics providers, may use their own technologies according to their privacy policies and available consent controls.

9. Advertising and analytics providers

Naijacraft may use advertising and analytics services, including Google services, to measure traffic, display advertisements and understand Platform performance.

These providers may process:

• Cookie or advertising identifiers.
• IP address.
• Browser and device information.
• Page or content viewed.
• Advertisement impressions and interactions.
• Approximate location.
• Referral and campaign information.

Depending on the service and context, a provider may act as Naijacraft’s processor or as a separate data controller.

Naijacraft does not authorise advertising partners to obtain passwords, complete payment credentials, private rights evidence or private payout information for advertising purposes.

10. When we share personal data

Naijacraft may share personal data only where reasonably necessary and legally permitted.

Service providers

Information may be shared with providers that support:

• Website and application hosting.
• Cloud storage.
• Email and notification delivery.
• Payment processing.
• Bank transfers and payouts.
• Security and fraud prevention.
• Analytics.
• Advertising.
• Identity verification.
• Customer support.
• Data backup and disaster recovery.
• Professional compliance services.

Service providers acting as processors are expected to use personal data only for authorised purposes and apply appropriate safeguards.

Artist teams and rights participants

Information may be shared with authorised Artist managers, labels, rights holders or royalty reviewers where necessary to:

• Verify Artist-team authority.
• Display rights schedules.
• Administer invitations.
• Resolve ownership disputes.
• Review royalty allocations.
• Process eligible payments.

Private contact, identity and payment information should not be exposed to ordinary users unless disclosure is authorised, necessary and lawful.

Payment providers and financial institutions

Transaction and payout information may be shared with Paystack, banks, card networks and other authorised financial-service providers to process or investigate payments, refunds, transfers, reversals and chargebacks.

Professional advisers

Information may be disclosed to lawyers, accountants, auditors, insurers and data-protection or security professionals where necessary and subject to confidentiality obligations.

Legal and regulatory disclosure

Naijacraft may disclose personal data where reasonably necessary to:

• Comply with a law, court order or lawful regulatory request.
• Respond to the Nigeria Data Protection Commission.
• Protect the rights, safety or property of users, rights holders or Naijacraft.
• Investigate fraud, infringement, security incidents or other unlawful conduct.
• Establish, exercise or defend a legal claim.

Naijacraft will review requests for disclosure and will not voluntarily provide more information than reasonably necessary.

Business reorganisation

If Naijacraft is involved in a merger, restructuring, financing, sale or transfer of business assets, relevant data may be disclosed under confidentiality safeguards. Users will be notified where required by law.

11. Sale of personal data

Naijacraft does not sell personal data as a commodity.

This does not prevent Naijacraft from:

• Using authorised service providers.
• Processing advertising events.
• Completing a lawful business transfer.
• Disclosing information with your direction or consent.
• Complying with a legal obligation.

12. International transfers

Some hosting, email, analytics, advertising, security, payment or support providers may process personal data outside Nigeria.

Before permitting a cross-border transfer, Naijacraft will use a lawful basis and assess the applicable safeguards. These may include:

• An adequate level of protection.
• Contractual data-protection obligations.
• Binding corporate rules.
• An approved certification or code.
• A transfer necessary to perform a contract.
• Your informed consent where legally appropriate.
• Another transfer basis permitted under Nigerian law.

Naijacraft will document the basis for material international transfers and apply reasonable technical and organisational safeguards.

13. Data retention

Naijacraft retains personal data only for as long as reasonably necessary for the purpose for which it was collected and any applicable legal, security, accounting, rights-management or dispute-resolution requirement.

Retention is generally determined as follows:

• Account and profile information is retained while an account remains active and for a reasonable period following closure.
• Public content may remain available until it is removed, withdrawn or lawfully archived.
• Security and access logs are retained for a limited period appropriate to fraud prevention, incident investigation and system security.
• Support and complaint records may be retained until the matter is resolved and for a reasonable legal-defence period.
• Payment, payout, refund, tax and accounting records are retained for the period required by applicable financial and legal obligations.
• Artist claims and Artist-team audit records may be retained while the relationship remains active and afterwards where needed to prove historical authority.
• Rights schedules, royalty allocations, ownership corrections and financial audit records may be retained for extended periods because they establish ownership, earnings, payment and dispute history.
• Consent and acceptance records may be retained as evidence of compliance.
• Deleted information may remain temporarily in restricted backups until the applicable backup cycle expires.
• Information involved in litigation, fraud, copyright disputes, regulatory inquiries or legal holds may be retained until the matter is finally resolved.

When personal data is no longer reasonably required, it will be deleted, anonymised or securely isolated.

Closing an account does not require Naijacraft to delete financial, rights, security or legal records that must lawfully be retained.

14. Your data-protection rights

Subject to applicable law and relevant exemptions, you may have the right to:

• Be informed about the processing of your personal data.
• Ask whether Naijacraft processes your personal data.
• Request access to your personal data.
• Request a copy in a commonly used electronic format.
• Correct inaccurate, incomplete, outdated or misleading information.
• Request deletion where there is no lawful reason to retain the information.
• Request restriction of processing while a dispute or request is being considered.
• Object to processing based on legitimate interests.
• Object to direct marketing.
• Withdraw consent where consent is the applicable basis.
• Request data portability where legally applicable.
• Obtain information about the source of data not collected directly from you.
• Obtain information about relevant international recipients.
• Object to and challenge qualifying automated decisions.
• Request human review where an automated decision produces a significant effect.
• Lodge a complaint with the Nigeria Data Protection Commission.
• Seek other remedies available under applicable law.

These rights are not absolute. For example, Naijacraft may retain information needed to:

• Complete a transaction.
• Maintain accurate royalty or rights records.
• Protect another person’s privacy.
• Prevent fraud.
• Comply with legal obligations.
• Establish or defend legal claims.

15. How to exercise your rights

Submit a request through the official Contact or Support facility on Naijacraft.com and mark it “Privacy Request”.

Your request should identify:

• The account concerned.
• The right you wish to exercise.
• The information or processing involved.
• Any relevant transaction, Artist, track or case reference.

Naijacraft may request proportionate information to verify your identity and protect the account from unauthorised disclosure.

Naijacraft will respond without unreasonable delay and will ordinarily aim to respond within 30 days after receiving a complete and verified request. If additional time is lawfully required because of complexity or volume, Naijacraft will explain the delay.

Naijacraft will not ordinarily charge for a reasonable request. A permitted fee may apply where fulfilling a request would impose unreasonable costs or where the law otherwise allows it.

16. Automated processing and human review

Naijacraft may use automated or semi-automated tools to:

• Recommend music or content.
• Rank catalogue content.
• Detect suspicious logins.
• Identify artificial streams or engagement.
• Apply advertising-frequency controls.
• Detect repeated trials or promotions.
• Assess payment and payout risk.
• Identify possible duplicate or infringing uploads where such technology is enabled.
• Calculate usage statistics and provisional royalty information.

Automated indicators do not by themselves establish copyright ownership.

Where an automated decision could materially affect account access, monetisation, rights, royalties or payments, Naijacraft will provide human review where required by law or appropriate under the circumstances.

You may contact Naijacraft to challenge a qualifying automated decision and provide relevant evidence.

17. Children’s privacy

Naijacraft is principally intended for users aged 18 or older.

A person under 18 must not independently authorise a payment or provide consent that legally requires a parent or guardian.

Where Naijacraft permits a minor to use an appropriate service, the parent or legal guardian must provide any legally required consent and remain responsible for the minor’s use of the Platform.

Naijacraft may use appropriate age and guardian-verification measures. We do not knowingly collect a child’s personal data in reliance on the child’s consent where parental or guardian consent is legally required.

If you believe that a child’s personal data has been submitted without proper authority, contact Naijacraft so the matter can be investigated and appropriate action taken.

18. Security

Naijacraft uses reasonable technical and organisational measures intended to protect personal data. Depending on the information and risk, these may include:

• Access controls.
• Role-based permissions.
• Least-privilege access.
• Password hashing.
• Encryption where appropriate.
• Secure payment-provider integrations.
• Activity and audit logging.
• Database and file backups.
• Security monitoring.
• Fraud-prevention controls.
• Staff or contractor confidentiality requirements.
• Incident-response procedures.
• Separation of management, rights-review and financial permissions where appropriate.

No internet service, transmission method or storage system is completely secure. Users must protect their passwords, devices and registered email accounts and should promptly report suspected compromise.

19. Personal data breaches

Naijacraft will investigate suspected personal data breaches and maintain appropriate incident records.

Where a breach is likely to result in a risk to affected individuals, Naijacraft will notify the Nigeria Data Protection Commission within the period required by law.

Where a breach is likely to create a high risk to an affected person, Naijacraft will also provide appropriate notification to that person unless a lawful exception applies.

Notifications may explain:

• The nature of the incident.
• The information affected.
• Likely consequences.
• Measures already taken.
• Recommended protective steps.
• How to contact Naijacraft.

20. Marketing communications

Naijacraft may send service messages concerning:

• Account activity.
• Security.
• Uploads and release reviews.
• Artist claims.
• Rights invitations.
• Payments and payouts.
• Subscription status.
• Policy or service changes.
• Support cases.

These messages may be necessary to provide the service and may not include an unsubscribe option.

Promotional marketing will be sent where permitted by law. You may opt out using the unsubscribe facility in the message or an available account setting.

Opting out of marketing does not stop essential account, security, payment, rights or legal communications.

21. Third-party links and services

The Platform may link to third-party websites, social networks, payment providers or embedded services.

Naijacraft is not responsible for the independent privacy practices of those services. You should review their privacy notices before providing information.

A link or integration does not mean that Naijacraft controls all data processing performed by the third party.

22. Account closure and deletion

You may request account closure through an available account or support process.

Before closing an account, Naijacraft may need to:

• Verify the requester.
• Resolve unpaid balances.
• Preserve rights and royalty records.
• Complete pending payments or refunds.
• Protect other rights holders.
• Retain evidence of disputes or infringements.
• Comply with legal or regulatory obligations.

Closing an account does not automatically delete published Artist pages, catalogue metadata, financial history or ownership records where those records must remain for other users, rights holders, public catalogue integrity or legal compliance.

Where appropriate, the personal account may be disconnected, deactivated or pseudonymised while necessary historical records are preserved.

23. Complaints

If you believe Naijacraft has not handled your personal data properly, contact Naijacraft first through the official Contact or Support facility so the matter can be investigated.

You also have the right to lodge a complaint with the Nigeria Data Protection Commission through its official complaint channels.

Using Naijacraft’s internal process does not remove any right to complain to the Commission or seek another remedy available under law.

24. Changes to this Privacy Policy

Naijacraft may update this Privacy Policy to reflect changes in:

• Services and features.
• Technology.
• Service providers.
• Data-processing activities.
• Legal and regulatory requirements.
• Security or operational practices.

The revised policy will display a new “Last updated” date.

Where a change materially affects your rights or how personal data is used, Naijacraft will provide reasonable notice through the Platform, your account, email or another appropriate channel.

Where new consent is legally required, the change will not take effect for the relevant processing until valid consent is obtained.

Earlier versions and approval records may be retained for accountability.

25. Contacting Naijacraft

For privacy questions, complaints or data-rights requests, use the official Contact or Support facility on Naijacraft.comand mark the request:

Privacy Request — Craft Concepts and Technology Nigeria Limited

Include sufficient information to identify your account and request, but never provide your password, PIN, complete card number or one-time password.