Privacy Policy

This Privacy Policy describes how Velune ("we", "us", "our") collects, uses, stores, and protects your personal data when you access or use the Velune digital library platform — including our website, mobile web application, and Progressive Web App (PWA).

This policy is written in compliance with the Nigeria Data Protection Regulation (NDPR) 2019 and its implementing guidelines. By creating an account or using the Platform, you acknowledge that you have read and understood this policy.

Where this policy applies to children under 13, please refer specifically to Section 13 — Children's Privacy.

Velune is a digital library platform designed primarily for readers in Nigeria. For the purposes of data protection law, Velune is the Data Controller responsible for your personal data.

If you have any questions about how we handle your data, or wish to exercise any of your rights described in this policy, you can contact our Data Protection Officer at:

• Email: privacy@velune.com
• General enquiries: adminveluneapp@gmailcom

We collect personal data in the following categories, depending on how you interact with the Platform:

A. Account & Identity Data

• Full name (provided during registration or pulled from your Google profile if you sign in with Google)
• Email address
• Encrypted password (email/password accounts only — we never see your plain-text password)
• Profile avatar URL (from Google when signing in with Google; from your upload if manually set)
• Account role (user or admin) and subscription status

B. Reading & Usage Data

• Books you have opened, read, and completed — including your reading progress (current page/position per book)
• Books you have added to Favourites
• Bookmarks, highlights, and personal notes you create within books
• Search queries entered in the Platform's search bar
• Categories and genres you browse

C. Subscription & Payment Data

• Your current subscription plan (Free, Premium Monthly, or Premium Annual)
• Payment references and transaction identifiers returned by our payment processors (Paystack or Stripe)
• Subscription start date, renewal date, and cancellation date

We do not store your full card number, CVV, bank account number, or any raw payment credentials. All payment details are processed and stored by Paystack or Stripe under their PCI-DSS compliant infrastructure.

D. Technical & Device Data

• IP address and approximate geographic location (country/city level)
• Browser type, version, and operating system
• Device type (desktop, tablet, mobile)
• Pages visited, time spent on each page, and navigation path through the Platform
• Referral source (how you arrived at the Platform)

This technical data is collected automatically via Google Analytics (see Section 8 — Cookies & Storage).

E. Account Preferences

• Parental control settings (Premium subscribers): whether adult content is blocked and any daily reading time limit set
• UI preferences stored locally in your browser (e.g. theme, reader settings)

We use the data we collect for the following purposes:

We do not use your personal data for targeted advertising, and we do not share your data with advertising networks.

Under the Nigeria Data Protection Regulation (NDPR) 2019, we must have a lawful basis for each type of processing we carry out. Our legal bases are:

• Contract performance — processing necessary to deliver the service you have signed up for. This covers account creation, authentication, reading progress sync, subscription management, and content access control.
• Legitimate interests — processing necessary for our legitimate business interests, where those interests are not overridden by your rights. This covers platform analytics (aggregated), search improvement, security monitoring, and AI recommendations.
• Legal obligation — processing required to comply with Nigerian law, including tax and financial record-keeping obligations and responding to lawful requests from regulatory authorities.
• Consent — where we rely on your consent (e.g. optional features or uses not covered above), we will ask for it explicitly and you may withdraw it at any time without affecting the lawfulness of prior processing.

You may choose to create a Velune account or sign in using your existing Google account via Google OAuth 2.0. If you choose to do so, please note the following:

• What Google shares with us: When you authorise the Google sign-in, Google provides us with your name (full_name), email address, and profile photo URL (avatar_url). We do not receive your Google password or any Google payment information.
• How we store it: Your name and profile photo URL are stored in your Velune profile row in our database (hosted on Supabase). Your email is stored as part of your authentication record.
• Google's own privacy practices: Your use of Google Sign-In is also governed by Google's Privacy Policy (policies.google.com/privacy). Velune is not responsible for Google's data practices.
• Revoking access: You may revoke Velune's access to your Google account at any time via your Google Account settings at myaccount.google.com/permissions. Revoking access will prevent future sign-ins via Google but will not automatically delete your Velune account or your data.

Velune relies on a small number of carefully selected third-party services to operate. Each is a data processor acting under our instructions and under their own data protection commitments:

We do not use any other advertising networks, data brokers, or analytics providers beyond those listed above.

Velune uses cookies and browser local storage to operate the Platform and improve your experience. Here is a breakdown of what we use and why:

You can control cookie behaviour through your browser settings. Disabling cookies may prevent some features — such as staying signed in — from working correctly. Clearing local storage will remove your saved preferences.

Analytics opt-out: You can opt out of Google Analytics tracking across all websites by installing the Google Analytics Opt-out Browser Add-on.

We share your data only in the following limited circumstances:

• With our service providers — as listed in Section 7, solely for the purpose of operating the Platform on our behalf. These providers are contractually bound to process your data only on our instructions.
• Legal requirements — if we are required by Nigerian law, court order, or regulatory authority to disclose your data. Where permitted, we will notify you before any such disclosure.
• Protection of rights — where necessary to enforce our Terms of Service, protect our legal rights, or prevent fraud, abuse, or harm to the Platform or its users.
• Business transfers — in the event of a merger, acquisition, or sale of all or part of Velune's assets, your data may be transferred to the successor entity. We will notify you via email and in-app notice at least 30 days before any such transfer and give you the option to delete your account beforehand.

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, destruction, or disclosure. These measures include:

• Encryption in transit: All data transmitted between your browser and the Platform is encrypted using TLS (HTTPS). This includes authentication requests, reading data, and API calls.
• Encryption at rest: Your data is stored in Supabase, which encrypts data at rest using AES-256 on AWS infrastructure.
• Password security: Passwords are hashed using industry-standard algorithms (bcrypt) by Supabase's authentication layer. We never store or transmit plain-text passwords.
• Row Level Security (RLS): Our database enforces Supabase Row Level Security policies so that each user can only access their own data. No user can read another user's bookmarks, reading progress, or profile information.
• OAuth token handling: Google OAuth tokens are handled entirely by Supabase's authentication layer and are never stored in our application code or logs.
• Payment security: Card and payment data is handled exclusively by Paystack and Stripe under their PCI-DSS compliant systems. We hold only a payment reference identifier, not card details.
• Access controls: Administrative access to user data is restricted to authorised Velune team members who require it to operate the Platform.

While we employ robust security measures, no internet-based service can guarantee absolute security. In the event of a data breach that is likely to result in risk to your rights and freedoms, we will notify you and the relevant Nigerian authority within 72 hours of becoming aware, as required by the NDPR.

We retain your personal data only for as long as necessary to fulfil the purposes described in this policy, unless a longer retention period is required by law. The following retention periods apply:

When data reaches the end of its retention period, it is permanently deleted or irreversibly anonymised.

Under the Nigeria Data Protection Regulation (NDPR) 2019, you have the following rights regarding your personal data. You may exercise any of these rights by contacting us at privacy@velune.com:

We will respond to all valid requests within 30 days. In complex cases we may extend this by a further 60 days, with notice given within the initial 30-day period. We will not charge a fee for exercising your rights unless requests are manifestly unfounded or excessive, in which case a reasonable administrative fee may apply.

If you believe we have not handled your data lawfully, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

We do not knowingly collect personal data from children under 13 years of age. If you are under 13, you may not create a Velune account. If you are between 13 and 17, you may only use Velune with the knowledge and consent of a parent or legal guardian, who agrees to these terms on your behalf.

For users aged 13–17 on shared accounts, we strongly recommend that the account holder (parent or guardian) enable the parental controls available to Premium subscribers. These controls can restrict adult content and set daily reading time limits.

If we discover that we have inadvertently collected data from a child under 13, we will delete that data promptly. Parents or guardians who believe their child has registered a Velune account without consent should contact us at privacy@velune.com and we will take appropriate action within 48 hours.

Velune is designed primarily for use in Nigeria, but our infrastructure means that some of your data may be stored or processed outside Nigeria:

• Supabase hosts your account and reading data on AWS infrastructure, which may include servers in the United States or other regions depending on Supabase's server configuration. Supabase operates under standard contractual clauses and their own data protection commitments.
• Google Analytics processes anonymised analytics data on Google's global infrastructure, which may include servers outside Nigeria.
• Stripe processes international payment data on infrastructure located in the United States and Ireland.

Where data is transferred outside Nigeria, we take steps to ensure that adequate protections apply, including contractual arrangements with our service providers that require them to protect your data to standards consistent with the NDPR.

By using Velune, you acknowledge and consent to these international transfers, where they are necessary to deliver the service.

We may update this Privacy Policy from time to time to reflect changes in our data practices, the services we use, or applicable law. When we make material changes, we will:

• Update the "Effective" date at the top of this page
• Send you an email notification to the address registered to your account at least 14 days before the changes take effect
• Display an in-app notice when you next sign in to the Platform

Your continued use of the Platform after the effective date of a revised policy constitutes your acceptance of the changes. If you do not agree, you should close your account before the changes take effect.

Minor changes — such as corrections of typos or clarifications that do not materially affect how your data is processed — may be made without advance notice.

We encourage you to review this policy periodically to stay informed about how we protect your data.

If you have any questions about this Privacy Policy, wish to exercise your data rights, or have a concern about how we have handled your personal data, please contact us:

• Data Protection enquiries: adminveluneapp@gmailcom
• General support: adminveluneapp@gmailcom
• Response time: We aim to acknowledge all privacy requests within 5 business days and resolve them within 30 days

If you are not satisfied with our response, you may escalate your complaint to the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.