Privacy Policy
We collect the minimum data we need to run Gisthaus. We do not sell your information to anyone. You retain ownership of your content. We protect your data with the utmost seriousness.
1. Information We Collect
Account information: When you register, we collect your email address, username, and optional display name, bio, and profile photo. You supply this information directly.
Content you create: Your gists, replies, voice recordings, images, polls, and reactions. This is your content — we store it to operate the Platform.
Usage data: Pages you visit, features you use, time spent, and how you interact with the Platform. We use this to improve Gisthaus and personalise your experience.
Device and technical information: Browser type, operating system, IP address, and device identifiers, collected for security, fraud prevention, and diagnostic purposes.
Payment metadata: Transaction identifiers and amounts for tips and subscriptions. We do not store your full card details — payments are processed by Paystack, a PCI-DSS compliant processor licensed by the Central Bank of Nigeria.
Communications: If you contact us by email or through support channels, we retain that correspondence to resolve your issue and improve our service.
2. How We Use Your Information
3. Who We Share Your Data With
We do not sell, rent, or trade your personal data. Full stop.
We share data only with the following categories of third parties, and only to the extent necessary to operate the Platform:
Supabase: Our database and authentication provider. Your account data and content are stored on Supabase infrastructure.
Paystack: For payment processing only. Paystack receives the payment information necessary to complete transactions.
LiveKit: For real-time voice rooms. Audio streamed through LiveKit is not recorded or stored by LiveKit.
Law enforcement: Only when required by a valid Nigerian court order, warrant, or other lawful legal process, or where we are legally obligated to report certain content (e.g., CSAM).
Business transfers: If Gisthaus is acquired by or merges with another company, your data may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.
4. Your Rights Under the NDPR
Under the Nigeria Data Protection Regulation (NDPR) and the Nigeria Data Protection Act (NDPA) 2023, you have the following rights regarding your personal data:
Right to access
Know what personal data we hold about you and receive a copy.
Right to rectification
Request correction of inaccurate or incomplete data.
Right to erasure
Request deletion of your account and associated personal data.
Right to portability
Request your data in a structured, machine-readable format.
Right to object
Object to processing of your data for specific purposes.
Right to withdraw consent
Withdraw consent at any time (this may limit Platform functionality).
To exercise any of these rights, email us at privacy@gisthaus.com. We will respond within 30 days. You also have the right to lodge a complaint with the Nigeria Data Protection Bureau (NDPB) if you believe we have not handled your data lawfully.
5. Data Retention
We retain your personal data for as long as your account is active or as needed to provide you with the Platform. If you delete your account, we will delete or anonymise your personal data within 30 days, except where:
In cases involving law enforcement investigations (e.g., CSAM reports), we may be required to preserve account data for an extended period pursuant to legal obligations.
6. Cookies and Tracking
We use only essential cookies for authentication, session management, and security. We do not use advertising cookies, third-party tracking pixels, or sell cookie data to advertisers.
You can control cookie settings through your browser. Disabling essential cookies will prevent you from signing in to Gisthaus.
7. Data Security
We implement industry-standard technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These measures include encrypted data storage, encrypted data transmission (TLS/HTTPS), access controls, and regular security reviews.
No system is perfectly secure. In the event of a data breach that affects your personal data, we will notify you and the Nigeria Data Protection Bureau (NDPB) as required by law within 72 hours of becoming aware of the breach.
8. Children
Gisthaus is intended for users aged 13 and older. Paid features require users to be at least 18 years of age. We do not knowingly collect personal data from children under the age of 13.
If we discover that we have inadvertently collected data from a child under 13, we will delete that data immediately and permanently. If you believe a child under 13 has created an account, please contact us at privacy@gisthaus.com.
9. Changes to This Policy
If we make significant changes to this Privacy Policy, we will notify you in-app and by email at least 14 days before the changes take effect. The updated policy will be posted on this page with a revised effective date.
Your continued use of the Platform after the effective date of the revised policy constitutes your acceptance. If you do not agree to the updated policy, you must stop using the Platform.
10. Contact Us
If you have questions about this Privacy Policy or want to exercise your data rights, please contact us: