Privacy Policy

Connecto Studios ("we", "us", "our") is a creative and brand studio based in Port Harcourt, Rivers State, Nigeria. For the purposes of the Nigeria Data Protection Act (NDPA) and other applicable data protection law, Connecto Studios is the data controller of the personal data described in this notice.

You can reach us at connectostudios1@gmail.com or +234 906 556 8642 about anything in this policy, including any request to access or delete your data.

Contact details: your name, email address and phone number when you enquire, book a call or create an account.

Account data: login credentials (handled by our authentication provider), profile details, and your Asset Library access status.

Project data: briefs, brand assets, files and messages you share with us so we can deliver your project.

Payment and order data: the package or asset purchased, amount, currency, payment reference, order status, our Tax Identification Number on receipts, and the payment method used. Card details are entered on Paystack's systems and never reach ours.

Manual payment data: where you pay by bank transfer or Opay, we collect the payment reference you submit, your name as given, any notes, and any proof-of-payment file you upload. Proof files are stored in a private, non-public storage bucket and are viewable only by our administrators through short-lived, expiring links.

Asset Library activity: which assets your account downloads, so we can enforce licence terms and support you.

AI assistant ("Connie") conversations: the messages you type into the chat assistant, together with the conversation context needed to answer.

Usage, device and error data: pages visited, interactions, approximate location, IP address, browser and device identifiers, and — when something breaks — automatic technical error reports containing the page URL, the error message and stack trace, your browser user-agent and related technical context.

Support data: messages you send us by email, WhatsApp, the chat assistant or contact forms.

To provide the service — creating your account, taking and verifying payments, issuing receipts, unlocking Asset Library access, delivering projects and communicating about your brief (performance of a contract).

To verify manual payments — matching your bank transfer or Opay reference and proof of payment to your order before we release access or begin work (performance of a contract).

To answer questions through the AI assistant — your messages are sent to our AI provider to generate a reply (legitimate interests, or performance of a contract where the question concerns your order).

Security, fraud prevention and licence enforcement — protecting accounts, payments and our systems, and detecting misuse of downloaded assets (legitimate interests).

Stability and product improvement — automatic error reports and usage data help us find and fix faults and improve the site (legitimate interests).

Customer support — responding to your questions and requests (performance of a contract / legitimate interests).

Marketing — occasional updates about our work and offers, where you have opted in (consent, which you can withdraw at any time).

Legal, tax and accounting obligations — keeping records of transactions where the law requires it.

Paystack — our payment processor for card payments and subscription billing. Paystack processes your payment data under its own privacy terms and PCI-DSS compliant infrastructure. We receive confirmation of payment, amounts, references and customer email, not your card number.

Opay and our bank — where you pay by transfer, the receiving institution processes the transaction and we see the reference and amount.

Lovable — our hosting, database, authentication, file storage, transactional email and AI gateway provider. Your account data, project files, proof-of-payment uploads, error reports and chat messages are processed on this infrastructure on our behalf.

Google (Gemini), via our AI gateway — processes AI assistant messages to generate replies. Do not enter sensitive personal or confidential information into the chat assistant.

Fontshare — serves the site's typeface from its CDN, which involves your browser requesting files from that provider.

Professional advisers (legal, accounting) where needed, and authorities where we are required to disclose by law.

We do not sell your personal data, and we do not use it to train AI models.

Account and profile data: while your account is active, and deleted when you delete your account.

Project briefs and uploaded project files: for the duration of the engagement and up to 24 months afterwards, then deleted. Files uploaded to your account are deleted when you delete your account.

Proof-of-payment uploads: up to 12 months after the payment is verified, and deleted when you delete your account.

Order, receipt and tax records: retained for at least 6 years to meet Nigerian tax and accounting obligations. When you delete your account these records are anonymised — your email and personal details are stripped and only the transaction amount, reference and date remain.

AI assistant conversations: not stored as a permanent transcript by us; short-lived operational logs may persist for up to 30 days.

Error and usage logs: up to 90 days.

Enquiries that do not become projects: up to 24 months.

Under the NDPA and other applicable law you may have the right to access, correct or delete your personal data, restrict or object to its processing, receive a portable copy, withdraw consent, and complain to a supervisory authority — in Nigeria, the Nigeria Data Protection Commission.

You can delete your account and personal data yourself at any time from your account page, under "Delete account". This removes your profile, briefs and uploaded files, and anonymises retained financial records as described above.

To exercise any other right, email connectostudios1@gmail.com. We aim to respond within 30 days.

We use appropriate technical and organisational measures to protect your data, including encryption in transit, row-level database access controls, private storage buckets with expiring access links, and restricting access to those who need it to do their work.

Some of our service providers — including our hosting, email and AI providers — process data outside Nigeria. Where data is transferred internationally, we rely on appropriate safeguards such as the contractual protections offered by those providers.

We use essential cookies and browser storage to keep the site and your signed-in session working, and to remember choices such as dismissing notices. These are required for the site to function, including sign-in and downloads.

We use limited technical measurement to understand how the site is used and to receive automatic error reports. We do not run advertising or cross-site tracking cookies, and we do not build advertising profiles. If we add an analytics or advertising provider in future, we will update this notice and ask for consent where the law requires it.

You can control cookies through your browser settings; blocking essential cookies may prevent sign-in and downloads from working.

Our services are for businesses and adults. You must be at least 18 to create an account or make a purchase. We do not knowingly collect data from children; if you believe a child has given us data, contact us and we will delete it.

We may update this notice from time to time. The latest version will always be on this page.