Privacy Policy

Duomachina ("the Platform", "we", "us", or "our") is a cultural operating system connecting African creative culture through journalism, digital archives, film, media, and commerce. The Platform is owned and operated by **Pluggedspace LTD**, a company registered under the laws of the Federal Republic of Nigeria. This Privacy Policy applies to all users, creators, subscribers, and visitors worldwide who access or interact with Duomachina services, websites, applications, digital stores, and APIs. We act as the Data Controller under the **Nigeria Data Protection Act 2023 (NDPA)**, the **General Data Protection Regulation (EU/UK GDPR)**, and relevant global privacy legislations such as the **California Consumer Privacy Act (CCPA/CPRA)**.

We collect information necessary to deliver, safeguard, and personalize our cultural media platform. - **Account & Profile Data:** When you create an account, we collect your name, username, email address, password hash, profile avatar, biography, and social links. - **Creator & KYC Data:** For creators monetizing content or participating in Studio and Festival initiatives, we may collect government identification, Tax Identification Numbers (TIN), phone numbers, payout bank details, and business registration records. - **Financial & Transaction Data:** When you purchase magazine issues, subscriptions, digital media, or physical store items, transactions are processed via PCI-DSS certified payment processors (including Flutterwave). We do not store raw credit card numbers or banking passwords on our servers. We store transaction IDs, amount paid, currency, timestamp, and billing contact details. - **User-Generated Content & Interactions:** Comments, cultural reactions, playlist saves, forum submissions, media uploads, and communication with our editorial staff. - **Technical & Usage Information:** IP addresses, browser user agent, device characteristics, operating system, pages viewed, referring URLs, streaming telemetry, and cookie identifiers collected via Google Analytics and session managers.

Under the NDPA 2023 and GDPR, we only collect and process your personal data when we have a lawful basis: - **Contractual Necessity:** To provide access to Duomachina accounts, fulfill digital orders, stream subscribed media, and disburse creator earnings. - **Legitimate Interests:** To prevent platform abuse, maintain digital security, analyze cultural trends to improve editorial curation, and protect intellectual property. - **Consent:** For non-essential analytics, marketing cookies, newsletters, and optional creator promotional spotlights. You may revoke consent at any time. - **Legal & Regulatory Obligations:** To comply with tax reporting, anti-money laundering (AML) protocols, intellectual property takedowns, and court orders.

We never sell your personal data. We disclose data strictly to trusted infrastructure partners subject to strict confidentiality and security agreements: - **Cloud Infrastructure & Storage:** Supabase (PostgreSQL database & authentication) and Amazon Web Services (AWS S3) for secure media asset delivery. - **Payment Infrastructure:** Flutterwave for local (NGN) and international cross-border processing, settlement, and verification. - **Analytics & Performance:** Google Analytics (configured with IP anonymization and privacy consent controls). - **Legal & Regulatory Bodies:** Where mandated by lawful process under Nigerian law or international treaties.

As a platform rooted in Nigeria serving a global audience, your data may be stored or processed in servers located across Africa, the European Union, and the United States. We ensure international transfers comply with the NDPA 2023 cross-border guidelines, standard contractual clauses (SCCs) recognized under GDPR, and strict technical safeguards including end-to-end TLS encryption and database access restrictions.

We retain your personal data only as long as your account remains active or as needed to provide our cultural services, resolve disputes, and fulfill statutory accounting requirements (typically up to 6 years for financial transactions). We employ industry-standard administrative, technical, and physical protections, including bcrypt password hashing, role-based database permissions, Row Level Security (RLS), and SSL/TLS encryption for all data in transit.

Regardless of your geographic location, you retain robust rights regarding your personal information: - **Right to Access & Portability:** Request a copy of personal information we hold about you in a structured, commonly used digital format. - **Right to Rectification:** Update or correct inaccurate profile or billing information directly via your settings or by contacting us. - **Right to Erasure ("Right to Be Forgotten"):** Request deletion of your account and associated personal data, subject to statutory retention limits. - **Right to Restrict or Object:** Object to processing based on legitimate interests or revoke direct marketing consent. - **California Consumer Privacy Act (CCPA/CPRA) Rights:** California residents have the right to know what personal categories are collected, request non-discrimination, and opt out of any data sharing. - **Nigeria Data Protection Commission (NDPC) Recourse:** Nigerian citizens have the right to lodge a complaint directly with the NDPC if they believe their privacy rights have been infringed.

To exercise any privacy rights, request data deletion, or ask questions regarding this policy, please contact our Data Protection team at: - **Email:** privacy@duomachina.com - **Operating Entity:** Pluggedspace LTD - **Attention:** Data Protection Officer / Legal Affairs - **Response Timeline:** We respond to all verified data subject requests within thirty (30) business days.