Privacy Policy

Who we are

Noorvale Studios Limited (RC 8837679) is a company registered in Nigeria, working from Keffi, Nasarawa State. We are the data controller for personal data described here. Reach us at hello@noorvale.com.

This policy covers noorvale.com and the Noorvale services — Watch, Toons, Music and Play — and our mobile app.

What we collect

When you create an account: your email address, and a phone number if you provide one. Passwords are handled by our authentication provider and we never see or store them in readable form.

When you use the services: what you watch or listen to and how far through it you got, items you add to a list, and profile settings such as subtitle and audio-language preferences. On Toons, the kids profiles and content-rating limits set by the account holder.

When you pay: we record the plan, the amount, the status and a reference from the payment provider. We do not receive or store card numbers. Card details are handled by Paystack or Stripe and never reach our systems.

Automatically: the country the request came from, broad device and browser information, and technical logs of requests to our API. We use these to serve the right catalogue, keep the service working on the networks and devices people actually use, and investigate abuse.

If you contact us: your name, email, and whatever you write. If you subscribe to updates, your email address.

Why we use it, and on what basis

Under the Nigeria Data Protection Act 2023 we must have a lawful basis for each use. Ours are:

• Performance of a contract — running your account, streaming what you are entitled to, taking payment, resuming playback where you left off.
• Legitimate interest — keeping the service secure and available, preventing fraud and abuse, understanding in aggregate which titles are watched so we know what to make next.
• Consent — marketing email, which you can withdraw at any time without affecting your account.
• Legal obligation — tax, accounting and records we are required to keep.

We do not sell personal data. We do not use it to build advertising profiles or share it with data brokers.

Who we share it with

Only the providers that make the service run, and only what each one needs:

• Supabase — database and authentication.
• Cloudflare — hosting, content delivery and video streaming.
• Paystack and Stripe — payment processing.
• Professional advisers, and authorities where the law requires it.

Some of these process data outside Nigeria. Where they do, we rely on the provider's contractual data-protection commitments as permitted under the NDPA's cross-border transfer provisions.

Children

Toons is made for children, but a Noorvale account is not. Accounts are for adults, who create kids profiles within their own account and set the content rating those profiles may reach. We do not knowingly collect personal data directly from a child.

If you believe a child has provided us personal data directly, write to hello@noorvale.com and we will delete it.

How long we keep it

Account and profile data for as long as the account exists, and for a short period afterwards so an accidental deletion can be undone. Payment records for as long as tax and company law require. Technical logs for a limited period, then discarded.

Your rights

Under the NDPA you may ask us to:

• give you a copy of the personal data we hold about you;
• correct it if it is wrong;
• delete it, where we are not required to keep it;
• restrict or object to a particular use;
• provide it in a portable form;
• withdraw consent you previously gave.

Write to hello@noorvale.com. We will respond within one month. If you are not satisfied, you may complain to the Nigeria Data Protection Commission.

Security, and its limits

Access to data is restricted to what each part of the system needs: our applications reach the database only through our own API, which holds the sole credentials, and row-level security stands behind that as a second layer. Traffic is encrypted in transit. Payment credentials never reach us at all.

No system is perfectly secure. If a breach affects your rights we will notify you and the Commission as the NDPA requires.

Changes

When this policy changes we will update the effective date above, and for anything material we will tell account holders directly rather than relying on you to re-read the page.