Privacy Policy

MusicFundr is a music streaming and artist-support platform built for the Nigerian market and operated from Lagos, Nigeria. References to "MusicFundr", "we", "us", or "our" in this policy refer to the MusicFundr platform and its operators.

This policy is designed to comply with the Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Act (NDPA) 2023.

Account data: When you register, we collect your first name, last name, email address, and an optional phone number and stage name. Passwords are stored as one-way cryptographic hashes — we cannot see your password.

Usage data: We collect information about how you use the Platform, including songs played, play duration, searches, library saves, and device/browser type. This data is used to improve the service and personalise your experience.

Payment data: Payments are processed by Paystack. We receive a transaction reference and confirmation status from Paystack but we never receive or store your card number, CVV, or bank PIN.

Artist payout data: If you are an artist withdrawing earnings, we collect your bank account name, account number, and bank code to process transfers via our payment partner.

Content: Music files, cover artwork, and profile images you upload are stored on our cloud infrastructure (Cloudflare R2 for audio and Cloudinary for images).

Communications: If you contact us by email or through the contact form, we retain your message and contact details in order to respond and for quality purposes.

We use the data we collect to:

• Provide, operate, and maintain the Platform
• Process your payments and payouts
• Send transactional emails (email verification, password resets, payout confirmations)
• Personalise your discovery and trending feeds
• Detect and prevent fraud, abuse, and security incidents
• Comply with applicable legal obligations
• Improve the Platform based on aggregate usage analytics

We do not sell your personal data to third parties. We do not use your data for advertising purposes on third-party networks.

We share your data only in the following circumstances:

Service providers: We share data with trusted third-party providers who help us operate the Platform, including Paystack (payments), Cloudflare (CDN and storage), Cloudinary (image hosting), and our email delivery provider. These providers process data on our behalf under strict data processing agreements.

Legal obligations: We may disclose data when required by Nigerian law, court order, or regulatory authority.

Business transfers: If MusicFundr is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.

Beyond the above, we do not share, sell, rent, or trade your personal data with any third party.

Your data is stored on servers in the European Union (Cloudflare and Cloudinary infrastructure) and processed in Nigeria. All transfers are protected by industry-standard encryption (TLS in transit, AES-256 at rest).

We retain your account data for as long as your account is active and for up to 12 months after deletion, to comply with legal obligations and resolve disputes. Payment transaction records are retained for 7 years as required by Nigerian financial regulations. Usage analytics are retained in aggregate, anonymised form indefinitely.

The MusicFundr web app uses cookies and similar technologies for authentication (to keep you logged in) and to remember your preferences. We do not use third-party tracking or advertising cookies.

You can manage cookies in your browser settings. Disabling authentication cookies will prevent you from staying logged in.

Under the NDPA 2023, you have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data (subject to legal retention obligations)
• Portability: Receive your data in a structured, machine-readable format
• Objection: Object to processing of your data for certain purposes
• Withdrawal of consent: Where processing is based on consent, withdraw it at any time

To exercise any of these rights, email privacy@musicfundr.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC).

MusicFundr is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with their data, please contact us immediately and we will delete that information.

We take the security of your personal data seriously. Our measures include:

• HTTPS encryption for all data in transit
• One-way hashing of passwords (bcrypt)
• JWT-based authentication with token versioning to invalidate sessions on password changes
• Rate limiting on authentication endpoints
• Role-based access controls limiting which staff can access which data

No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. In the event of a breach that affects your rights, we will notify you as required by the NDPA.

We may update this Privacy Policy from time to time. Material changes will be communicated by email or in-app notice at least 14 days before they take effect. The "Effective" date at the top of this page reflects the most recent revision.

For privacy-related questions, data requests, or to reach our Data Protection Officer:

MusicFundr — Data Protection
Lagos, Nigeria
privacy@musicfundr.com

For general enquiries: Contact page