Privacy Policy
Last updated 19 September 2026
This explains what Flixerpay collects about you, why we have it, who else sees it, and how to get a copy or have it erased. It is written to meet the Nigeria Data Protection Act 2023 and the NDPR.
Two things we never hold. We do not hold your money. Every naira sits in your Uphiva wallet, and we only record what a campaign is worth. And we never store your card number: Paystack holds the card and gives us a reference. We also never see your Uphiva password.
Contents
1. Who we are
Flixerpay is a Nigerian social-campaign marketplace, operated as part of the Uphiva ecosystem. For the data described here, Flixerpay is the data controller.
Uphiva provides your sign-in and your wallet, and is a separate controller for that. What Uphiva does with your data is covered by Uphiva's own privacy policy, not this one.
Data protection enquiries: privacy@flixerpay.com.
2. What we collect
| From Uphiva when you sign in | Your name, email address, Uphiva user ID, and profile photo if you have one. We never receive your Uphiva password. |
|---|---|
| Your profile | Handle, bio, niches, location, languages, and the social accounts you connect. |
| Marketplace activity | Workspaces and brands you create, campaigns you post or claim, briefs, deliverable links, submissions, approvals, rejections, reviews, ratings, messages between a brand and a creator, and disputes. |
| Studio content | Posts you draft and schedule, uploaded images and video, captions, calendars, and the publish history of each post. |
| Earnings records | What a campaign was worth, what was approved, the take rate applied, and XP and Flexcoin awarded. Amounts, not funds. |
| Subscriptions | Plan, status, renewal dates, and a Paystack customer and transaction reference. Never a card number. |
| WhatsApp TV | Channel details, subscriber figures, rate cards, and the evidence you submit for verification. |
| Technical and security | IP address, device and browser information, sign-in times, pages requested, and error reports. Used for security, rate limiting and fixing faults. |
| Audit records | A tamper-evident log of sensitive actions: moderation decisions, verifications, staff access, role changes. |
| Support | Anything you send us when you report a problem or ask for help. |
We do not ask for, and you should not send us, government ID numbers, BVN, bank account numbers or health information.
3. Why we have it, and our lawful basis
| Running the marketplace | Performance of our contract with you. You cannot claim a campaign or be paid for it without this. |
|---|---|
| Showing your profile to brands | Performance of our contract. Your public profile, handle, niches and approved work are visible to others by design. |
| Taking subscription payments | Performance of our contract, and our legal obligation to keep financial records. |
| Security, fraud and abuse prevention | Our legitimate interest in a marketplace that is not being gamed, and our legal obligations. |
| Moderation and verification | Legitimate interest in trust between strangers transacting. |
| Service email you cannot switch off | Performance of our contract: a claim approved, a deadline, a payment released. |
| Marketing email | Your consent. Withdraw it at any time; it does not affect service email. |
| Publishing to your social accounts | Your consent, given when you connect the account, withdrawn when you disconnect it. |
4. Who we share it with
We do not sell your personal data. We share it only with the following, and only as far as each needs:
| Other users | A brand sees the profile, submission and messages of a creator who claims its campaign, and the reverse. Reviews and leaderboard positions are public. |
|---|---|
| Uphiva | Identity and wallet. Funding, releases and balances happen there. |
| Paystack | Subscription payments. They receive your card details directly. We never see them. |
| Resend | Sending email. |
| Unipile, X, Meta, TikTok | Only when you connect an account, and only to publish what you tell us to. |
| Anthropic | AI drafting (see below). |
| Vercel and Neon | Hosting and the database. |
| Authorities | Where the law requires it, or to protect someone's safety or our legal rights. |
5. Connected social accounts
When you connect X, LinkedIn, Instagram or another network, we store an access token so Studio can publish on your instruction. Tokens are encrypted at rest and are used only for the actions you ask for. We read back public metrics on your own posts to show you how they performed. We do not read your private messages, and we do not post anything you did not schedule.
Disconnect an account at any time in Studio → Accounts. That deletes the stored token immediately. Revoking access from the platform's own settings works too.
6. AI features
Studio can draft captions and suggest ideas. To do that, the brief, your brand voice notes and the relevant campaign text are sent to Anthropic to generate a suggestion. We do not send your contact details, your earnings, or your private messages. Suggestions are drafts. Nothing is published without you.
7. Cookies
We keep this small. We use:
- a session cookie, so you stay signed in (the service cannot work without it);
- preference cookies that remember your theme, your currency and whether balances are blurred;
- short-lived security cookies used during sign-in to prevent request forgery.
We do not use advertising cookies, and we do not let third parties track you across other sites from here.
8. How long we keep it
| What | How long we keep it |
|---|---|
| Your profile, campaigns and Studio content | While your account is open |
| Financial and tax records | Up to 6 years, as Nigerian law requires, even after you leave |
| Security logs | Normally up to 12 months |
| Audit records | Kept as a tamper-evident chain. After erasure these hold only an identifier that no longer refers to anybody (see below) |
| Backups | Deleted data ages out of backups within 30 days |
9. Your rights
Under the Nigeria Data Protection Act you may ask us to: give you a copy of your data; correct it; delete it; restrict or object to how we use it; or send it to someone else in a portable format. You may also withdraw consent at any time, and complain to the Nigeria Data Protection Commission.
Most of this is self-serve in the app under Settings → Privacy. Otherwise email privacy@flixerpay.com and we will respond within 30 days. We do not charge for this, and we will not treat you worse for asking.
10. Getting your data deleted
You can delete your Flixerpay account and the personal data attached to it in two ways:
- In the app, go to Settings, then Privacy, then Delete account.
- By email, write to privacy@flixerpay.com from the address on your account.
Deletion removes your profile, your campaigns and claims, your Studio content and uploads, your messages, your connected-account tokens, and the reviews you wrote. It is permanent and cannot be undone.
Two things survive, and we would rather say so plainly. Financial records we are legally required to keep are retained for the period above. And entries in our tamper-evident audit log keep a bare identifier. It refers to no person once your account is gone, and removing it would break the chain that detects a real intruder.
Deleting your Flixerpay account does not delete your Uphiva account or wallet. Ask Uphiva separately for that.
11. How we protect it
Traffic is encrypted in transit. Credentials and social tokens are encrypted at rest. Access by our staff is limited to those who need it and is written to the audit log. We apply a strict content security policy, rate-limit sensitive endpoints, and keep the powers that sit above a workspace separate from any customer account. No system is perfectly secure, but if a breach affects you we will notify you and the Commission as the law requires.
12. Transfers outside Nigeria
Some providers above (hosting, email, AI) process data outside Nigeria. Where they do, we rely on the safeguards the Act permits, including contractual protections with each provider, and we send them only what the feature needs.
13. Children
Flixerpay is for people aged 18 and over. We do not knowingly collect data about children. If you believe a child has an account, tell us and we will remove it.
14. Changes and contact
If we change this policy in a way that matters, we will tell you in the app or by email before it takes effect. The date at the top always shows the current version.
Privacy and data protection: privacy@flixerpay.com
Anything else: hello@flixerpay.com