Paayh Privacy & Data Protection Policy

I. Data Controller & Scope

Paayh ("we," "us," or "our") operates an attention exchange and digital content platform. We are committed to processing your personal data lawfully, transparently, and securely. This policy applies to all registered listeners, creators, businesses, and platform visitors.

II. Information We Collect

1. Authentication Data: When you sign up or log in via Google OAuth through Auth0, we receive basic identity attributes: your verified email address and display name. Paayh does not import or store your external Google profile photo URL; profile images and business logos are uploaded manually by users directly to their profile settings if they choose. We do not access your Gmail inbox, Google Drive files, calendar, or private Google account data.
2. Profile & Demographic Preferences: Voluntary user details including country, state, gender, date of birth / age bracket, and selected interest categories used solely to deliver relevant feed content.
3. Precise GPS Location Coordinates & Ongoing Recalibration: During profile setup and onboarding, we request device location permissions to auto detect your country, state, and city via browser GPS coordinates. Furthermore, during active authenticated sessions and upon login, the platform periodically reverifies geographic locality (via browser GPS if permitted, or network IP geolocation fallback) to recalibrate your location when traveling or relocating. These geographic fields are locked as read-only to prevent manual fabrication, ensuring advertisers connect with authentic listeners physically present in designated campaign zones.
4. Engagement & Attention Metrics: Timestamps of verified ad interactions, verification challenge outcomes (swipe, hold, tap), dwell time, and ATW score progression.
5. Settlement & Payout Information: When requesting a payout, you submit your registered phone number, settlement bank name, and account number. These details are transmitted via encrypted TLS connections directly to our regulated payment infrastructure partners (Paystack Payments Limited and Korapay Technologies Limited) to execute disbursements. Paayh does not permanently store raw banking numbers on your public user profile record.

III. Advanced Security & Application Layer Encryption

Paayh implements multi layered, military-grade data security:

• Application Layer Field Encryption (AES-256-GCM): Highly sensitive personal attributes (including settlement details, bank identifiers, and security credentials) are encrypted at the application layer prior to storage using authenticated AES-256-GCM. In the unlikely event of underlying infrastructure access, stored ciphertext remains mathematically unreadable.
• Cryptographic HMAC Blind Indexing: Searchable sensitive fields use keyed HMAC-SHA256 blind indexing, permitting verified query lookups without ever decrypting raw databases or exposing plaintext indexes.
• Encrypted Network Transmission: All data in transit is protected using modern Transport Layer Security (TLS 1.3) protocols.

IV. How We Use Your Data

We process personal data strictly for legitimate operational purposes:

1. To authenticate your account session and maintain account security.
2. To deliver relevant, localized sponsored content and calculate earned promotional incentive credits. Geographic recalibration ensures you receive commercial offers, retail specials, and events physically accessible to you where you currently are, preventing wasted sponsor ad spend and location spoofing. For clarity, cash credits accrue strictly on paid commercial campaigns where the sponsor allocated an impression budget; reciprocal mutual posts, platform updates, brand jingles, special offers, and business daily highlights carry zero cash incentive.
3. To audit transactions for fraud prevention, sybil prevention, and anti money laundering (AML) compliance under Nigerian law.
4. To disburse verified settlement payouts through licensed payment processors (Paystack and Korapay) with pass-through regulated interbank transfer fee accounting.
5. We do NOT sell, rent, or trade your personal information to third party data brokers.

V. Cookies & Tracking Technologies

For a comprehensive breakdown of our storage mechanisms, token lifecycle, and category disclosures, please inspect our standalone Cookie Policy.

1. Essential Session Cookies: We utilize encrypted HTTP only session cookies to authenticate logged in users, prevent cross site request forgery (CSRF), and maintain UI preferences (dark or light theme).
2. Impression Tracking: Ephemeral browser tokens are used to prevent duplicate ad deliveries and record single view impression confirmations.
3. Cookie Control: You can manage or disable cookies via your browser settings; however, disabling essential session cookies will prevent login and dashboard access.

VI. User Privacy Rights (NDPA 2023 & GDPR)

Under the Nigeria Data Protection Act 2023 and applicable international regulations, you possess the right to:

• Right of Access: Review the personal data held on your profile.
• Right to Rectification: Update inaccurate account or contact information.
• Right to Erasure (Account Deletion): Request the permanent deletion of your account and associated personal data via your dashboard or our Help Center.
• Right to Revoke OAuth Permissions: Revoke Paayh's access to your Google account at any time via your Google Account Security Settings.
• Sovereignty of Engagement & Voluntary Participation: You retain complete freedom over whether to engage with or patronize any commercial advertiser. You are never obligated to make purchases, and any transaction entered into with an advertiser is solely between you and that third party.

VII. Data Retention & Inactivity Policy

Personal data is retained only for as long as necessary to provide services and fulfill statutory accounting obligations. Inactivity resets and balance expirations are strictly enforced in accordance with our Platform Inactivity Management Guidelines:

• 7 Day Inactivity: Inactivity for 7 consecutive days resets monetization status; personal account data and wallet balances remain intact.
• 60 Day Dormant Account Expiration: Inactive accounts with zero engagement or login for 60 consecutive days forfeit unclaimed promotional incentive credits.
• Deleted Accounts: When an account is deleted, personal data is permanently purged from active operational databases.

VIII. Contact Our Data Protection Team

For questions, data access requests, or regulatory inquiries, contact our Data Protection and Compliance team:

Email: privacy@paayh.com or legal@paayh.com
Support Portal: Paayh Help Center