Privacy Policy

Varanda (https://www.joinvaranda.com) is an online marketplace where brands post briefs and hire everyday creators to make user-generated content (UGC). In this policy, “Varanda”, “we” and “us” mean the operator of the Varanda platform, who is the data controller for the personal data described here.

Legal entity: Varanda (business registration in progress).

Contact for anything about your data, including requests to exercise your rights: hello@joinvaranda.com.

This policy is written to meet the Nigeria Data Protection Act 2023 (NDPA) and, where it applies to you (for example if you are in the UK or the European Economic Area), the GDPR / UK GDPR.

Account data. Your email address, full name, the role you pick (creator or brand), your password (stored only as a secure hash by our authentication provider; we never see it), whether your email is verified, and sign-in records (time, method, IP address and device/browser details).

Google sign-in. If you choose “Continue with Google”, Google shares your name, email address and profile photo with us (basic profile scopes only). We don't get your Google password, contacts, files or anything else.

Creator profile and portfolio. Display name, photo, headline, bio, country/state/city, languages, niches, content types, platforms, prices and turnaround time, plus the videos and thumbnails you upload. Your public profile and portfolio are visible to anyone who visits the creator directory.

Brand profile. Company name, website, industry, logo, country and, if provided, a CAC registration number.

Identity checks (KYC). To keep the marketplace safe, protect payments and meet anti-fraud rules, we may ask you to verify your identity or business (for example NIN, BVN, passport or CAC details). We record the type of check, the result, the date and a reference. Checks are currently reviewed by our team; if we start using a verification provider, we will update this policy first.

Briefs, applications and orders. Briefs you post, pitches and prices you send, invites, order details and status history, deliveries (the content files you upload for an order), revision requests, reviews and ratings.

Payments and payouts. Payments are processed by Paystack. We never see or store your full card details. We keep payment references, amounts, fees, refunds and status. For creator payouts we send your bank and account number to Paystack to confirm the account name and create a transfer recipient, and we keep only the bank, account name, the last 4 digits of the account number and Paystack's recipient code.

Messages. Order chat messages and attachments between a brand and a creator, read receipts and dispute statements and evidence.

Safety logs. Varanda blocks sharing phone numbers, emails, social handles, outside payment details and similar contact details on the platform. When something is blocked we log who tried, where (chat, pitch, brief, invite), the category (for example “phone number”) and a short redacted snippet of at most 60 characters, never the full message. These logs are visible only to Varanda admins and are used for warnings, strikes and suspensions.

Notifications and settings. In-app notifications and your preferences.

Technical data. Server and security logs kept by our hosting providers (IP address, browser, pages requested, errors). We don't use advertising or analytics trackers.

We only use personal data where the law allows it. Under the NDPA (section 25) and the GDPR (Article 6) the bases we rely on are:

We don't sell your personal data, and we don't make decisions with legal or similarly significant effects about you based solely on automated processing. The contact-sharing filter automatically blocks a message, but any strike or suspension is decided by a person.

• The public: creator profiles, portfolios, ratings and published reviews; open briefs are visible to signed-in creators.
• The other party to an order: the brand and creator see each other's profile, order details, chat, deliveries and dispute statements for that order.
• Varanda admins: a small number of authorised staff can see account details, KYC status, safety logs, payments and payouts, and, when handling a dispute, the order's recent chat, deliveries and evidence. Admin actions are recorded in an audit log.
• Our service providers (below), only to provide their service to us.
• Authorities, where the law requires it or to prevent fraud or harm.
• A buyer or successor, if Varanda's business is reorganised, sold or transferred; this policy would continue to apply.

Each provider may only use your data to provide their service to us and must keep it secure. Paystack and Google also process some data as independent controllers under their own privacy policies.

Some providers store or process data outside Nigeria (mainly the UK, the EU and the USA). We only transfer data where it's allowed under Part VIII of the NDPA (and Chapter V of the GDPR where it applies): for example where the destination has adequate data protection law, under standard contractual clauses or similar safeguards offered by the provider, or where the transfer is necessary to perform our contract with you. You can ask us for more detail about these safeguards at hello@joinvaranda.com.

• Account and profile data: while your account is open. After you ask us to close it, we delete or anonymise it within 30 days, except what we must keep as described below.
• Portfolio files: until you delete them or close your account.
• Orders, payments, refunds, payouts and the ledger: 6 years after the transaction, to meet accounting, tax and anti-fraud obligations.
• Order chat, deliveries and dispute evidence: for the life of the order and up to 2 years after it ends, so we can handle disputes, refunds and claims. Deliveries you licensed to a brand may already have been downloaded by that brand.
• Safety logs, strikes and suspensions: up to 2 years after the last event, or longer if needed to stop a suspended user from rejoining.
• KYC check records: up to 5 years after the account closes, where anti-fraud or financial rules require it.
• Server and security logs: kept by our hosting providers for their standard periods, usually a few days to a few months.

Under the NDPA (sections 34 to 38) and, where it applies, the GDPR, you have the right to:

• Be informed about how we use your data (this policy).
• Access your data and get a copy.
• Correct inaccurate or incomplete data. You can edit most of your profile yourself in your dashboard.
• Erase your data, unless we must keep it (for example payment records).
• Restrict or object to our use of your data, including where we rely on legitimate interests.
• Data portability: receive data you gave us in a common, machine-readable format.
• Withdraw consent at any time where we rely on consent (this doesn't affect what we did before).
• Not be subject to solely automated decisions with significant effects.
• Complain to the data protection authority where you live. We'd appreciate the chance to fix things first.

How: email hello@joinvaranda.com from the address on your account, saying what you'd like. We may ask you to confirm your identity. We reply within 30 days (we'll tell you if we need longer for a complex request). It's free, unless a request is clearly unfounded or excessive. To close your account, email us the same way; in-app account deletion is coming.

We use only strictly necessary cookies: the sign-in cookies set by our authentication provider (Supabase) that keep you logged in and protect your session, and short-lived cookies used during sign-in (for example while you return from Google). The sign-in flow may also store a temporary code in your browser's storage. We don't use advertising, tracking or analytics cookies, so there's no cookie banner.

If you block these cookies you won't be able to sign in. Paystack's checkout page may set its own cookies for payment security, under Paystack's policy.

Varanda is for adults only. You must be 18 or older to create an account, and we don't knowingly collect data from anyone under 18. If you believe a child has an account, email hello@joinvaranda.com and we will close it and delete their data. Content featuring minors may only be submitted where the law allows and with the documented consent of a parent or guardian.

Data is encrypted in transit (HTTPS) and protected by row-level access rules in our database so users only reach their own records. Payment cards are handled by Paystack, not us. Deliveries, chat attachments and dispute evidence are kept in private storage readable only by the parties and admins. No system is perfectly secure; if a breach is likely to put your rights at risk, we will report it to the relevant data protection authority within 72 hours and tell affected users without undue delay, as the NDPA requires.

We may update this policy as Varanda grows. The date at the top shows the latest version. If a change is significant, we will tell you by email or in the app before it takes effect. See also our Terms of Service.

Email hello@joinvaranda.com with any question or request about your personal data.