Last updated 14 September 2026
Privacy policy
A creator's livelihood and a buyer's spending both pass through this platform, so this page tries to be useful rather than defensive: what we collect, why, where it goes, and the parts you will not like.
Short version — we do not sell your data, this website sets no cookies and runs no analytics, we never hold a full bank account number, and we cannot delete your financial records because the law says we must keep them.
What this covers
This policy explains what Nuvora collects about you, why we need it, who else gets to see it, and what you can ask us to do with it. It covers this website, the Nuvora dashboard and the Nuvora mobile app.
Two kinds of person appear below and their data is treated differently: creators, whose profiles and earnings live here, and buyers, the people at businesses who fund campaigns. Where something applies to one only, it says so.
What we collect
Things you tell us. Your name, email address, phone number and password when you create an account. For creators, the profile you build: your handle on each platform, your occupation, the kinds of content you make, your languages, and the city and country you work in.
Audience figures. Follower counts, typical views and engagement for the channels on a creator's profile. Today these are figures creators enter themselves, and they are labelled self-declared wherever a buyer sees them. When a creator connects a platform account directly, figures read from that platform are labelled verified instead. We never hold a list of the individual people in anyone's audience — only distributions, as percentages.
Work. The campaigns you fund or accept, the briefs, the files creators submit, review decisions and messages about the work.
Money. What was funded, what was earned, what was paid out and when. For a creator's payout method we store the account holder's name, the bank or mobile money provider, and the last four digits only. The full account number stays with our payment provider; it never reaches our database.
Technical records. Your IP address and browser or device description are recorded against each sign-in session and against actions in the audit log. These are what let us — and you — tell a legitimate sign-in from someone else's.
What you tell support. If you write to us through the support page, we keep your name, your email address, what the request was about and the message itself — including anything you chose to put in it. It is kept as a record of what arrived and when, so a request cannot be quietly lost or edited after the fact. You do not need an account to write to us, and we never ask for your password.
Why we need it
To run your account and keep it yours. To show buyers who a creator is and what they reach, which is the entire point of a creator profile. To move money correctly and to be able to prove afterwards where every shilling went. To detect fraud and account takeover. And to meet obligations we cannot decline, such as keeping financial records.
Where we rely on your consent — for optional marketing email, for example — you can withdraw it and we stop. Where we rely on performing our contract with you or on a legal obligation, we cannot: you cannot be paid without a payout record, and we cannot delete financial history on request.
What we do not do
We do not sell your data, and we do not share it with advertisers.
This website sets no cookies and runs no analytics. There is no tracking pixel, no third-party script, and no consent banner because there is nothing to consent to. Reading these pages leaves no record of you with us or with anyone else.
We do not collect or infer audience income, and you cannot filter creators by it. It is rarely accurate and filtering on it edges toward exclusionary targeting, so we leave it out rather than offer it carefully.
If a creator connects a platform account, we ask that platform only for the ability to read public profile and audience figures. We never post as you, read your private messages, or follow anyone on your behalf. Direct connection is not switched on for any platform yet — every channel today is added by hand — so no access token for a creator's social account exists at present.
Who else sees it
Buyers see a creator's profile. Handle, name, city, languages, interests, audience figures with their provenance labels, and delivery history. A creator's email address and phone number are not on the public profile — they are released to a buyer only once there is an actual working relationship, and never to someone merely browsing.
Creators see who hired them — the business, the brief and the people reviewing their work.
Our providers. Payments and payouts go through Paystack, which necessarily receives the payer's or payee's details to move the money. Transactional email goes through our email provider. Our infrastructure runs on Amazon Web Services. Each of these processes data on our instructions and for no purpose of its own.
Where the law requires it. We will disclose data where we are legally obliged to. We will not hand over more than is asked for, and we will tell you unless we are prohibited from doing so.
If Nuvora is ever acquired, your data would move with the business, and this policy would continue to apply until you were told otherwise.
Where your data is stored
Our systems run on Amazon Web Services in Frankfurt, Germany (the eu-central-1 region). If you are in Kenya, that means your personal data leaves the country to be processed.
We tell you this rather than leave it in a schedule because it is exactly the kind of thing a privacy policy usually hides. The transfer is to a jurisdiction with strong data protection law, under contractual terms with AWS, and it is a deliberate choice about reliability rather than an accident.
Files creators upload are stored in private object storage — not publicly readable, and reachable only through short-lived links issued to people entitled to see them.
How we protect it
Passwords are hashed, never stored or recoverable. Browser sessions use HTTP-only cookies, so no page script can read your session token even if one were injected. Any provider token we hold is encrypted before it reaches the database and is never included in an API response.
Financial history is append-only: a correction is a new reversing entry and the database refuses edits to posted records. That is a security property as much as an accounting one — it means nobody, including us, can quietly rewrite what happened to your money.
Adding a new payout method starts a 24-hour wait before it can receive money, and we check the account name with the provider first. If an account is ever taken over, that window is what stops earnings being redirected before the creator notices.
No system is perfectly secure. If personal data is ever breached in a way likely to harm you, we will tell you and the Office of the Data Protection Commissioner, promptly and specifically rather than in generalities.
How long we keep it
Your profile and work history are kept while your account is open. If you close it, we remove your profile from the platform and creators stop appearing in search.
Financial and audit records are kept for seven years after the transaction, because tax and accounting law requires it. This is the part of your data you cannot have deleted on request, and we would rather say so plainly than imply a right we cannot honour.
Your rights
Under the Kenyan Data Protection Act 2019 you can ask us to:
- tell you what we hold about you, and give you a copy;
- correct anything that is wrong;
- delete data we no longer have a lawful reason to keep;
- stop using your data for a particular purpose, or object to it;
- hand your data to you in a portable form.
Some of these you can do yourself: profile details, channels and payout methods are all editable in the product.
For the rest — a full copy of your data, or deletion of an account — write to info@nuvora.africa and we will act within thirty days. We handle these by hand today; there is no self-service button, and we would rather tell you that than let you hunt for one.
If you think we have handled your data badly, tell us first — we would like the chance to fix it. You can also complain to the Office of the Data Protection Commissioner in Kenya.
Children
Nuvora is not for anyone under 18 and we do not knowingly collect data about children. If we learn that an account belongs to a minor, we close it and delete the data. If you believe a child's data is here, tell us and we will deal with it immediately.
Changes to this policy
The date at the top of this page is the version in force. If we change something that affects your rights or how we use your data, we will tell you before it takes effect rather than quietly reposting the page.
This policy forms part of our terms of service.
Questions about this document? Write to info@nuvora.africa. If something here contradicts what the product actually does, tell us — we would rather fix the document than argue the point.