Privacy Policy

1. Data We Collect and Why

We collect the following data to operate, secure, and improve M&R Edge Studios. The table below matches the data disclosures we provide in app stores (App Store App Privacy and equivalent store disclosures).

We do not sell your personal data. We do not use your content to train AI models.

2. Social Platform Integrations

Connecting social accounts is optional. When you choose to connect TikTok, YouTube, Instagram, Facebook, LinkedIn, X, or other platforms, we request only the permissions needed to publish your content on your behalf. We store platform access tokens in encrypted form and do not store your social platform passwords.

You can revoke access at any time through the platform's own settings or by contacting us. Data transmitted to these platforms is governed by their respective privacy policies.

3. AI and Content Processing

When you use AI features, your prompts and scripts are sent to third-party AI providers to generate scripts, visuals, or audio. AI-generated outputs are treated as your content. We do not use your content to train AI models.

4. Lawful Basis for Processing

We process your personal data on the following legal bases:

• Contract: To provide the Service you signed up for — account management, content creation, and publishing.
• Legitimate interest: To improve our Service, analyse usage patterns, and prevent fraud.
• Consent: For optional marketing communications, social media account connections, and analytics cookies. You can withdraw consent at any time.
• Legal obligation: To comply with tax, accounting, and other regulatory requirements.

5. Service Providers and Subprocessors

We share data only with trusted service providers necessary to operate the Service:

• Lovable Cloud — Application hosting, backend database, authentication, serverless functions, and storage.
• Supabase, Inc. — Database hosting and authentication infrastructure.
• Stripe, Inc. — Payment processing for subscriptions and credit purchases.
• Paystack — Payment processing and creator payouts where applicable.
• Cloudflare, Inc. — CDN, DDoS protection, and WAF (processes data in transit only).
• Functional Software, Inc. (Sentry) — Crash reporting and error diagnostics.

We may also share data with law enforcement when required by law, or in connection with a merger or acquisition.

6. Data Storage and Security

Your data is stored securely using industry-standard measures:

• Data encrypted at rest using AES-256
• Data encrypted in transit using TLS 1.2+
• Social platform access tokens encrypted at rest
• Infrastructure protected by Cloudflare WAF and DDoS mitigation

We implement appropriate technical and organisational measures to protect your data. However, no method of transmission or storage is 100% secure.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes outlined in this policy:

• Account data: Retained while your account is active, deleted within 30 days of account deletion.
• Content: Deleted within 30 days of account deletion; backups purged within 90 days.
• Payment records: Retained for 7 years as required by UK tax legislation.
• Analytics data: Anonymised after 26 months.

8. Your Rights

Under the UK GDPR, Data Protection Act 2018, and the Nigeria Data Protection Act 2023, you have the right to:

• Access — Request a copy of your personal data.
• Rectification — Correct inaccurate or incomplete data.
• Erasure — Request deletion of your data.
• Portability — Export your data in a machine-readable format.
• Restriction — Restrict processing in certain circumstances.
• Objection — Object to processing based on legitimate interest.
• Withdraw consent — Revoke consent at any time without affecting prior processing.

To exercise these rights, email info@michelleandrichedgestudio.com. We will respond within 30 days.

If you are unsatisfied, you may lodge a complaint with the UK Information Commissioner's Office (ICO) or the Nigeria Data Protection Commission (NDPC).

9. Data Deletion

You can request deletion of all your personal data at any time:

• In the app: Settings → Account → Delete Account
• By email: info@michelleandrichedgestudio.com with subject line "Data Deletion Request"

We permanently delete your account, projects, uploaded media, connected social tokens, and associated personal data within 30 days. Backups are purged within 90 days.

10. Cookies and Analytics

We use essential cookies for authentication and session management. We may use analytics cookies to understand how users interact with the app and improve the experience. You can manage analytics preferences through the cookie consent banner in the app.

We do not use tracking cookies for advertising purposes.

Inside the iOS app, cookies are strictly functional (sign-in session and security). We do not set advertising or cross-site tracking cookies in the app, and we do not use the Advertising Identifier (IDFA) to track you across apps or websites owned by other companies.

11. International Data Transfers

Your data may be transferred to and processed in countries outside the UK and Nigeria, including the United States where some of our infrastructure providers are based. We ensure all transfers comply with UK GDPR requirements through Standard Contractual Clauses, adequacy decisions where applicable, and vendor-specific data processing agreements.

12. Children's Privacy

The Service is not intended for children under 13. We do not knowingly collect personal data from children under 13.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification.

14. Contact Us

For privacy-related questions, data deletion requests, or to exercise your rights, contact us at info@michelleandrichedgestudio.com.