Okin Oracle is operated by Okin Holdings. We respect your privacy. This policy explains what data we collect, how we use it, how long we keep it, who processes it on our behalf, and your rights under the Nigeria Data Protection Regulation (NDPR) and the GDPR.
Data we collect
- Account: email, full name, country, WhatsApp (optional).
- Creator submissions: bio, category, audience description, business goals.
- Pasted public profile links (TikTok, X, Instagram, YouTube, LinkedIn, etc.) and web-scraped public metrics from those URLs.
- Optional uploads: analytics screenshots, media kits, rate cards.
- Brand briefs and brand "analyse a creator" requests.
- Feedback, outcome reports and payment records.
How we use it
To generate your reports, operate the service, communicate with you about your account, prevent abuse, and improve Okin Oracle and future Okin Holdings products through anonymised, aggregated analysis. We do not sell your personal data.
Subprocessors
We rely on the following processors. Each is bound by contractual data-protection terms.
- Lovable Cloud (Supabase) — hosting, database, auth, storage (EU/US regions).
- Lovable AI Gateway (Google Gemini) — AI report generation. Prompts contain only your submitted data; content is not used to train third-party models.
- Firecrawl — scrapes the public profile URLs you paste, to verify metrics.
- Paystack — payment processing (Nigeria).
- Google OAuth — optional sign-in.
- Resend / transactional email provider — account and report emails.
Retention windows
- Account & profile: until you delete your account.
- Submissions & reports: 24 months from last activity, then archived.
- Web-scraped enrichment snapshots: 7 days cache, refreshed on report re-generation.
- Uploaded screenshots / media kits: 24 months, then purged.
- Payment records: 7 years (legal / tax obligations).
- Consent logs: 7 years (NDPR compliance).
- Analytics events: 24 months, aggregated thereafter.
Sharing
We do not sell your personal data. High-scoring creators may be contacted for Okin Brand Group partnership review — always with a clear opt-out.
Security
Row-level security on every user table, role-based access for admins, encryption in transit (TLS) and at rest, HMAC-verified payment webhooks, HIBP leaked-password checks at signup, and per-user daily rate limits on AI and scraping.
Your rights (NDPR / GDPR)
You can access, correct, export, restrict or delete your data at any time from Settings → Data. Deletion requests are processed within 30 days and cascade across submissions, reports, enrichment snapshots, uploads and analytics. Consent and payment records are retained where legally required.
Contact
Data protection queries: privacy@okinoracle.com.