Privacy Policy

What we collect, why we collect it, and who else handles it.

Last updated: September 21, 2026

1. Who is responsible for your data

SceneSync Technologies ("SceneSync", "we", "us", or "our"), operating the digital automated video creation platform at scenesync.me, is the data controller responsible for the processing of your personal data under the Nigeria Data Protection Act (NDPA) 2023 and applicable international data privacy standards. Contact our Data Protection Officer at: support@scenesync.me.

2. What we collect

  • Account & Identity Details — your full name, email address, profile avatar, and securely hashed passwords. If you authenticate via third-party OAuth, we receive the unique identification token and authorized email profile.
  • Creator Uploads & Project Content — narration scripts, shot-list documents, visual assets (images, video clips), background music files, and voice reference audio files.
  • Generated & Synthesized Media — synthesized neural voiceovers, timestamped phonetic alignment data, generated captions/subtitles, and finalized high-definition video files.
  • Credit & Transactional Records — your credit balance ledger, top-up purchase timestamps, Paystack reference IDs, and transaction amounts. Payment processing is handled by Paystack; we never receive or store your raw debit/credit card numbers or CVV codes.
  • Technical & Security Diagnostics — IP addresses, browser user-agent headers, device types, and system performance logs collected to ensure security, prevent fraud, and maintain operational stability.
  • Usage Telemetry — feature interactions and page navigation patterns to understand system load and optimize user experience.

3. Why we use it and lawful bases

Under Section 25 of the Nigeria Data Protection Act 2023, we process personal data based on the following legal grounds:

  • Contractual Performance: Storing your project files, aligning visual scenes to narration audio, synthesizing selected voices, and rendering finished video outputs upon your request.
  • Legal & Statutory Obligations: Maintaining immutable credit purchase logs and tax invoices in compliance with Nigerian commercial accounting requirements and corporate tax law.
  • Legitimate Interests: Monitoring API abuse, detecting unauthorized account access, safeguarding intellectual property, and ensuring server resilience.
  • Consent: Sending product announcements, newsletters, or platform updates via email. You can withdraw your consent at any time via the unsubscribe link in any email footer.

4. Voice samples and ethical synthetic voice processing

When you upload audio samples for voice cloning, the audio is analyzed strictly to generate acoustic embedding vectors for voice synthesis in your account. You represent and warrant that you have obtained the explicit, informed consent of the individual whose voice is being cloned prior to uploading their voice sample. You may delete custom voice models and their source samples at any time from your studio dashboard.

5. Authorized subprocessors and cross-border transfers

To provide high-performance rendering, transcription, and speech generation, SceneSync engages specialized technology infrastructure providers bound by strict Data Processing Agreements (DPAs):

  • Supabase — user authentication, encrypted database storage, and secure project object storage.
  • AssemblyAI — acoustic speech-to-text transcription to compute word-level timestamps for automatic scene synchronization.
  • Fish Audio — neural text-to-speech audio synthesis and voice model generation.
  • OpenRouter / Google Gemini — script analysis and structured scene breakdown logic.
  • Amazon Web Services (AWS) & Render — scalable cloud compute and distributed video rendering pipelines.
  • Paystack — PCI-DSS certified payment processing for one-time credit purchases.
  • Resend — transactional email delivery, password reset dispatches, and render notifications.
  • Cloudflare — DDoS mitigation, SSL encryption, and global content delivery.

Some infrastructure servers are located in the United States and the European Union. In compliance with Sections 41–43 of the Nigeria Data Protection Act 2023, cross-border data transfers are executed under standard contractual clauses, end-to-end TLS 1.3 encryption in transit, and AES-256 encryption at rest.

We never sell your personal data, and we never use your private uploaded creative assets to train public foundation artificial intelligence models.

6. Data retention schedule

  • Project Uploads & Renders: Stored while your account remains active. When you delete a project, associated temporary media and render files are permanently purged from active storage within 30 days.
  • Account Profile Data: Retained for the active duration of your account and securely erased within 180 days following account closure.
  • Financial & Payment Records: Retained for six (6) years to comply with statutory Nigerian corporate accounting, tax auditing, and anti-money laundering regulations.
  • System Diagnostics & Error Logs: Rotated and automatically purged every 90 days.

7. Security safeguards

We employ enterprise-grade security controls, including automated HTTPS/TLS 1.3 encryption across all public endpoints, encrypted database storage at rest, tokenized role-based access control (RBAC), and automated DDoS protection. While no internet platform can guarantee absolute invulnerability, in the event of a security incident affecting your personal data, we will notify you and the Nigeria Data Protection Commission (NDPC) within statutory timeframes.

8. Your statutory rights under NDPA 2023

As a data subject under the Nigeria Data Protection Act 2023, you have the right to:

  • Access: Request confirmation and a copy of personal data processed about you.
  • Rectification: Request correction of inaccurate, outdated, or incomplete information.
  • Erasure: Request the deletion of your account and personal data where no legal override exists.
  • Restriction & Objection: Object to specific data processing operations, including marketing communications.
  • Data Portability: Obtain an export of your creative projects in a structured, standard format.
  • Withdraw Consent: Revoke previously granted consent at any time without retroactive penalty.

To exercise any of these rights, email our Data Protection team at support@scenesync.me. We will process and respond to verified requests within thirty (30) calendar days. If you believe your rights have not been upheld, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

9. Cookies and tracking

SceneSync uses essential HTTP cookies to maintain secure authenticated user sessions and protect against cross-site request forgery (CSRF). We utilize first-party analytics (Google Analytics 4 with IP anonymization) to evaluate site traffic and app performance. You can manage or disable cookies at any time through your browser preferences.

10. Minors

SceneSync is strictly designed for users aged 18 and older. We do not knowingly collect personal information from minors. If we discover that an account was created by a minor, we will promptly delete all associated data.

11. Amendments to this policy

We may update this Privacy Policy periodically to reflect technological or regulatory advancements. We will notify you of material changes via email or an in-app notice prior to the changes taking effect.

12. Contact us

For privacy inquiries, data deletion requests, or regulatory questions, please contact:
Email: support@scenesync.me
Operating Entity: SceneSync Technologies, Lagos State, Federal Republic of Nigeria.