Privacy Policy

This Privacy Policy explains how Speccraft Media Ltd. ("Speccraft", "we", "us") collects, uses, stores, and shares your personal information when you use the Noizes platform at noizes.xyz and related services (the "Platform").

1. Information We Collect

1.1 Account Information

When you create an account we collect:

• Email address
• Password (stored as a cryptographic hash — we never store plaintext passwords)
• Display name, avatar, bio, and location (optional, provided by you)
• Account role (Creator or Collector)

1.2 Identity Verification (Creators Only)

If you register as a Creator, we collect additional identity information to comply with applicable law and to prevent fraud:

• Full legal name
• Country of residence
• Government-issued ID type, number, and a photograph of the document
• A selfie for identity matching
• Artist/stage name
• Social media and music platform links
• Years active as a creator

Identity documents are stored in a private, access-restricted storage bucket and are only accessible to authorised Noizes review personnel.

1.3 Payment Information

When you make a purchase, payment is processed by Paystack. We do not store your full card number or M-Pesa PIN. We receive and store:

• Transaction reference and status
• Amount and currency
• Payment channel (card or M-Pesa)
• Date and time of payment

1.4 Content & Activity Data

• Creators: Music files, artwork, lyrics, credits, rights declarations, and release metadata you upload to Noizes Studio.
• Collectors: Acquisition records, transfer history, resale offers, and collector notes you write.
• Provenance data: Every ownership event (acquisition, transfer, resale) is recorded in a public, hash-chained provenance ledger associated with each edition.

1.5 Aggregate Analytics

We collect aggregate, non-identifying analytics on Drop Pages (e.g. total page views, share clicks, download counts per day). We do not collect individual visitor identifiers, IP addresses, device fingerprints, or any personally identifiable information for analytics purposes.

1.6 Waitlist

If you sign up for our waitlist, we collect your email address and your preferred role (Creator or Collector).

1.7 Local Storage (Your Device Only)

Certain data is stored only on your device and is never sent to our servers:

• Draft release data in Noizes Studio (stored in IndexedDB)
• Listener interaction state within .nz experiences (stored in localStorage)
• Authentication session tokens (stored in cookies)

2. How We Use Your Information

3. How We Share Your Information

We do not sell your personal information. We share data only as follows:

• Service providers: We use Supabase (database and authentication hosting), Paystack (payment processing), Resend (transactional email), and Netlify (website hosting). Each provider processes data on our behalf under contractual obligations to protect your information.
• Public provenance: When you acquire, transfer, or resell an edition, your display name and the event details are recorded in the edition's provenance chain, which is visible to other users.
• Creator profiles: If you are a Creator, your artist name, bio, avatar, and links are publicly visible on your Drop Pages.
• Legal requirements: We may disclose information if required by law, regulation, legal process, or governmental request.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

4. Data Retention

• Account data: Retained for as long as your account is active. Upon account deletion, personal profile data is deleted within 30 days, but provenance records (which are part of the public ledger) are retained permanently.
• KYC documents: Retained for a minimum of 5 years after account closure, as required by applicable anti-money-laundering regulations, then securely deleted.
• Payment records: Retained for 7 years for tax and accounting compliance.
• Waitlist data: Retained until you are invited or request removal.

5. Data Security

We use industry-standard measures to protect your data, including:

• Encryption in transit (TLS/HTTPS for all connections)
• Encryption at rest for sensitive data (AES-256-GCM for cryptographic signing keys)
• Private storage buckets with access controls for identity documents
• Row-level security (RLS) policies on our database, ensuring users can only access their own data
• Hashed passwords (managed by Supabase Auth)

No system is perfectly secure. If we become aware of a data breach affecting your personal information, we will notify you and the relevant authorities as required by applicable law.

6. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data, subject to our legal retention obligations.
• Portability: Request your data in a structured, commonly used, machine-readable format.
• Restriction: Request that we restrict processing of your data in certain circumstances.
• Objection: Object to processing based on legitimate interests.
• Withdraw consent: Where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact us at privacy@noizes.xyz. We will respond within 30 days.

7. International Data Transfers

Our service providers may process data in countries outside Kenya. Where personal data is transferred to a jurisdiction that does not provide an adequate level of data protection, we ensure appropriate safeguards are in place (such as standard contractual clauses or the provider's certified compliance frameworks).

8. Children's Privacy

Noizes is not intended for anyone under 18 years of age. We do not knowingly collect personal information from children. If we learn that we have collected information from a child, we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on the Platform at least fourteen (14) days before the changes take effect.

10. Contact

For privacy-related questions or requests:

Speccraft Media Ltd.
Data Protection Contact
Email: privacy@noizes.xyz