Nesora Privacy Policy

This Privacy Policy explains how NESORA SYSTEMS LTD (“NESORA”, “we”, “us” or “our”) collects, uses, stores, shares and protects personal data when people visit or use the NESORA website, applications, Fan Space, Creator Space, content viewing, creator monetization, payment, customer support and related services (the “Platform”).

NESORA is registered with the Nigeria Data Protection Commission (NDPC) as a data controller/processor of major importance. Registration details shown on the certificate provided by NESORA are registration number NDPC/RC/DP/3753, with validity shown from 21 October 2026 to 21 October 2027.

For privacy questions or to exercise your rights, contact hello@nesora.com. This Policy should be read with the NESORA Terms of Service and any notices shown when you use a specific feature.

The data we collect depends on how you use NESORA. It may include:

• Account and identity data: username, display name, email address, phone number, date of birth or age confirmation, profile image and account settings.
• Creator data: public profile, uploaded content, titles, thumbnails, creator preferences, audience interactions, account verification information and payout details.
• Payment and transaction data: transaction reference, funding amount, credits purchased or consumed, refunds, chargebacks, payout amounts and payment status. Payment providers may process card or bank details directly under their own security and privacy terms.
• Content and activity data: content uploaded, comments, reports, viewing events, eligible viewing duration, credit deductions, follows, likes, searches and interactions with platform features.
• Technical and device data: IP address, device type, operating system, app version, browser type, identifiers, logs, crash reports, approximate location derived from IP, and cookie or similar technology data where used.
• Support and safety data: messages to support, complaint details, appeals, reports of harmful or infringing content, and records needed to investigate security or fraud concerns.
• Employment, supplier or business-contact data: information supplied by staff, applicants, contractors, creators, business partners and vendors where relevant to the relationship.

NESORA uses personal data for specified and legitimate purposes, including:

• Creating and managing accounts and providing Fan Space and Creator Space features.
• Processing payments, funding credits, calculating eligible content consumption, preparing creator statements and administering creator payouts.
• Hosting, streaming, recommending and moderating content and helping creators manage their profiles and audiences.
• Providing customer support, resolving complaints, processing refunds and appeals, and communicating important service information.
• Securing accounts, detecting fraud, preventing abuse, investigating policy violations and enforcing the Terms of Service.
• Measuring service performance, diagnosing technical problems and improving features, where an appropriate lawful basis exists.
• Meeting tax, accounting, legal, regulatory, recordkeeping and lawful request obligations.
• Sending marketing communications where permitted by law and, where required, with consent. Users can opt out of marketing messages.

NESORA processes personal data only where an appropriate lawful basis applies under the Nigeria Data Protection Act 2023 and applicable rules. Depending on the activity, the basis may include performing a contract with you, complying with a legal obligation, your consent, protecting vital interests, performing a task in the public interest where legally applicable, or legitimate interests that do not override your rights.

Where processing relies on consent, you may withdraw consent at any time. Withdrawal does not invalidate processing carried out before withdrawal, and some data may still be processed under another lawful basis where the law permits it. If information is necessary to provide a requested feature or meet a legal obligation, refusing to provide it may mean that feature or service cannot be provided.

Because NESORA uses a credit-based content consumption and creator monetization model, the Platform may record content identifiers, viewing events, eligible viewing duration, displayed rates, credit balances, credit deductions, funding transactions, creator revenue calculations, adjustments and payout records.

This information is used to calculate consumption, display account activity, prepare creator statements, investigate disputed charges, prevent manipulation and administer payments. NESORA does not use viewing records to promise or guarantee creator earnings.

NESORA may share relevant personal data with:

• Service providers that host the Platform, deliver content, provide analytics, send communications, support customer service or protect the service.
• Payment providers, including Paystack, banks and other financial service providers, to process payments, refunds and creator payouts.
• Professional advisers, auditors, insurers and business service providers where reasonably necessary and subject to appropriate confidentiality duties.
• Regulators, law-enforcement agencies, courts or other parties where required by law or necessary to protect rights, safety and security.
• A successor or acquiring entity in a proposed or completed merger, restructuring or sale, subject to appropriate safeguards and applicable law.

NESORA does not sell personal data to advertisers. We do not share personal data with third parties for their own unrelated marketing without an appropriate legal basis and any consent required by law.

Some service providers may store or process data outside Nigeria. Where NESORA transfers personal data internationally, it will assess the applicable legal requirements and implement appropriate safeguards, such as an approved transfer mechanism, contractual protections or another lawful basis where permitted. Information about relevant transfers may be requested at hello@nesora.com.

NESORA keeps personal data only for as long as reasonably necessary for the purpose for which it was collected, including service delivery, security, legal compliance, accounting, payment reconciliation, fraud prevention and dispute resolution. Retention periods vary by data category and legal obligations.

Payment and creator payout records may need to be retained after account closure for financial, tax, audit or legal purposes. When data is no longer required, NESORA will delete it, anonymise it or securely dispose of it in accordance with its retention procedures and applicable law.

Subject to applicable law and any lawful exceptions, you may have the right to:

• Receive clear information about how NESORA processes your personal data.
• Request access to personal data NESORA holds about you.
• Request correction of inaccurate or incomplete personal data.
• Request deletion or erasure where the legal requirements are met.
• Object to or request restriction of certain processing.
• Withdraw consent where processing is based on consent.
• Request a portable copy of certain data where the right applies.
• Challenge a decision made solely by automated processing where the law provides that right.
• Lodge a complaint with the Nigeria Data Protection Commission.

To exercise a right, email hello@nesora.com with the subject “Privacy Request”. NESORA may ask for reasonable information to verify your identity and will respond within the period required by applicable law. You may also contact the NDPC through its official website at ndpc.gov.ng.

NESORA may use cookies, software development kits (SDKs), pixels, local storage, app identifiers and similar technologies on its website or applications. These technologies may remember settings, maintain sessions, protect accounts, understand service performance and measure campaign effectiveness.

10.1 Categories

• Strictly necessary technologies: support login, security, payment flow, load balancing and essential platform functions.
• Preferences technologies: remember choices such as language or display settings.
• Analytics technologies: help measure usage, errors and feature performance.
• Advertising or marketing technologies: where used, measure campaigns or personalise promotions.

10.2 Choices and Consent

NESORA will provide appropriate information and choices for non-essential cookies or tracking technologies where required by law. Where consent is required, these technologies will not be activated before the required consent is obtained. Users may change available choices through the cookie settings or device/browser controls. Blocking strictly necessary technologies may prevent some features from working.

The exact technologies used depend on the current website and app configuration. NESORA will keep its cookie notice and consent settings aligned with the technologies actually deployed.

NESORA is designed for users who meet the minimum age requirement stated during registration. Users must provide truthful age information and may not bypass age controls.

NESORA must confirm and publish its minimum age before public launch. Where the Platform is not intended for children, NESORA will take reasonable steps to prevent underage account creation and will not knowingly collect children’s personal data in breach of applicable law.

Where a feature is permitted for a child or processes a child’s personal data, NESORA will apply the safeguards and consent or authorisation requirements required by Nigerian law, including any applicable parental or guardian involvement. NESORA may restrict access to age-inappropriate content and may request age verification where reasonably necessary.

If a parent, guardian or user believes a child has supplied personal data contrary to NESORA’s age rules, contact hello@nesora.com with the subject “Child Safety / Privacy”. NESORA will assess the request and take appropriate action, including restricting or deleting the account or data where required.

NESORA prohibits sexual exploitation or abuse of children, grooming, solicitation of minors for sexual purposes and any content involving child sexual abuse. Such material may be removed and reported to relevant authorities where required by law.

NESORA uses appropriate technical and organisational measures designed to protect personal data against unauthorised access, unlawful processing, accidental loss, destruction, alteration or disclosure. Measures may include access controls, authentication, encryption where appropriate, secure development practices, logging, backups, staff confidentiality obligations, vendor due diligence and security reviews.

No internet transmission or storage system can be guaranteed completely secure. Users should use strong, unique credentials, keep devices updated and report suspected account compromise promptly.

NESORA limits access to personal data to personnel and service providers who need it for authorised purposes. Vendors handling personal data are assessed and governed by appropriate contractual and data-processing requirements.

NESORA maintains a process for identifying, escalating, assessing, documenting and responding to suspected personal data breaches. If a breach occurs, NESORA will take reasonable steps to contain it, investigate the cause, mitigate harm, restore security and determine whether notification to the NDPC or affected individuals is required.

Notifications will be made within the applicable legal timeframe and where the relevant statutory threshold is met. NESORA will retain records of the incident and corrective actions in accordance with its incident-response procedures.

The Platform may contain links to third-party websites or use third-party services. Those services may have their own privacy notices and terms. NESORA is responsible for its own processing and does not control the privacy practices of independent third parties. Review their privacy information before providing data directly to them.

NESORA may update this Privacy Policy when its services, data practices or legal obligations change. The updated version will be published through the Platform or another appropriate channel with a revised effective date. Where required by law, NESORA will provide additional notice or obtain consent.

For privacy questions, data access or deletion requests, cookie choices, child-safety concerns or suspected data incidents, contact: NESORA SYSTEMS LTD Email: hello@nesora.com

You may also lodge a complaint with the Nigeria Data Protection Commission (NDPC) through its official website: ndpc.gov.ng.

Effective date: 24 October 2026.