Privacy Policy

What we collect, why we collect it, and who else handles it.

Last updated: September 21, 2026

1. Who is responsible for your data

SceneSync Technologies ("SceneSync", "we", "us", or "our"), operating the digital automated video creation platform at scenesync.me, is the data controller responsible for the processing of your personal data under the Nigeria Data Protection Act (NDPA) 2023 and applicable international data privacy standards. Contact our Data Protection Officer at: support@scenesync.me.

2. What we collect

  • Account & Identity Details — your full name, email address, profile avatar, and securely hashed passwords. If you authenticate via third-party OAuth, we receive the unique identification token and authorized email profile.
  • Creator Uploads & Project Content — narration scripts, shot-list documents, visual assets (images, video clips), voice reference audio files.
  • Generated & Synthesized Media — synthesized neural voiceovers, timestamped phonetic alignment data, generated captions/subtitles, and finalized high-definition video files.
  • Credit & Transactional Records — your credit balance ledger, top-up purchase timestamps, Paystack reference IDs, and transaction amounts. Payment processing is handled by Paystack; we never receive or store your raw debit/credit card numbers or CVV codes.
  • Technical & Security Diagnostics — IP addresses, browser user-agent headers, device types, and system performance logs collected to ensure security, prevent fraud, and maintain operational stability.
  • Usage Telemetry — feature interactions and page navigation patterns to understand system load and optimize user experience.

3. Why we use it and lawful bases

Under Section 25 of the Nigeria Data Protection Act 2023, we process personal data based on the following legal grounds:

  • Contractual Performance: Storing your project files, aligning visual scenes to narration audio, synthesizing selected voices, and rendering finished video outputs upon your request.
  • Legal & Statutory Obligations: Maintaining immutable credit purchase logs and tax invoices in compliance with Nigerian commercial accounting requirements and corporate tax law.
  • Legitimate Interests: Monitoring API abuse, detecting unauthorized account access, safeguarding intellectual property, and ensuring server resilience.
  • Consent: Sending product announcements, newsletters, or platform updates via email. You can withdraw your consent at any time via the unsubscribe link in any email footer.

4. Voice samples and ethical synthetic voice processing

When you upload audio samples for voice cloning, the audio is analyzed strictly to generate acoustic embedding vectors for voice synthesis in your account. You represent and warrant that you have obtained the explicit, informed consent of the individual whose voice is being cloned prior to uploading their voice sample. You may delete custom voice models and their source samples at any time from your studio dashboard.

5. Authorized subprocessors and cross-border transfers

To deliver high-performance rendering, speech recognition, neural voice synthesis, and timeline alignment, SceneSync engages specialized, enterprise-grade technology infrastructure subprocessors bound by strict Data Processing Agreements (DPAs):

  • Acoustic Speech Recognition & Transcription Subprocessors — to transcribe narration audio and compute word-level timestamps strictly for automated caption and scene synchronization.
  • Neural Voice Synthesis & Speech Generation Engines — to synthesize speech audio and generate authorized voice embeddings solely for user-requested project renders.
  • Natural Language Processing & Script Analysis Models — to parse narration scripts and provide structured scene breakdown logic.
  • Cloud Compute & Distributed GPU Rendering Clusters — to execute high-performance video compilation, audio multiplexing, and final MP4 encoding.
  • Encrypted Database & Object Storage Infrastructure — to manage secure authentication, encrypted account states, and project asset storage.
  • PCI-DSS Certified Payment Gateways — to process credit transactions and checkouts securely without storing raw cardholder details on our servers.
  • Transactional Notification & Email Delivery Services — to deliver account verification tokens, password reset dispatches, and render completion alerts.
  • Content Delivery & Edge Security Networks — to provide global TLS 1.3 encryption, DDoS mitigation, and high-speed global media distribution.

Some infrastructure servers are located in the United States and the European Union. In compliance with Sections 41–43 of the Nigeria Data Protection Act 2023, cross-border data transfers are executed under standard contractual clauses, end-to-end TLS 1.3 encryption in transit, and AES-256 encryption at rest.

We never sell your personal data, and we never use your private uploaded creative assets to train public foundation artificial intelligence models.

Selar payments and merchant Gmail connection

Where Selar checkout is offered, Selar and its payment partners handle payment details. SceneSync receives purchase information to deliver purchased credits, Unlimited plans or skills and maintain purchase history. Customers do not need to connect their Gmail accounts to buy credits.

The separate SceneSync Selar Receipts integration is for an authorized SceneSync administrator connecting the designated merchant mailbox. It requests gmail.readonly, which permits reading messages across that mailbox. This permission is broader than the receipts we need; our application searches for Selar sale notifications and reads matching message bodies and headers. It cannot send, modify or delete Gmail messages.

We use receipt information to check message provenance, identify the buyer and product, validate the paid amount and currency, prevent duplicate fulfillment, maintain credit and referral records, and investigate unmatched payments. Information processed includes message IDs and dates, sender and authentication headers, buyer email, product title, quantity, payment reference, amount and currency. Review records may also contain email snippets and parsed receipt details. We do not use this Gmail data to generate videos.

Receipt records and review metadata are stored in our backend database. The mailbox refresh token is encrypted before database storage; access tokens are used by the server to call Google. Infrastructure providers, including Google, Render and Supabase, process data as needed to operate this integration. Customer purchase history exposes only that customer's purchase details; restricted receipt and connection records are available through authorized administrative/server access.

Google-derived data is not sold, used for advertising, or used to train generalized AI models. Human access is limited to purposes permitted by Google's Limited Use requirements, such as investigating a specific payment with the mailbox owner's affirmative agreement, security investigations or legal obligations. SceneSync's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

The mailbox owner can stop future access by removing SceneSync Selar Receipts from their Google Account connections. Revocation does not itself erase previously stored records. To request removal of the stored connection token or receipt/review data, contact support@scenesync.me. Deletion requests are handled after ownership verification, subject to applicable recordkeeping requirements. Financial records follow the retention schedule below. Purchase records derived from a receipt — the payment reference, amount, date, and buyer details matched to a SceneSync account — are financial records: retained for six (6) years under Section 6, then deleted, except where a legal or accounting obligation requires keeping a record longer. Gmail connection credentials and review data are not automatically classified as six-year financial records. Our administrator maintenance procedure can remove supplementary order email headers after 90 days, resolved review payloads after 30 days, and other review payloads after 90 days. These are eligibility thresholds for operator-run cleanup, not an automatic deletion guarantee. Local disconnection removes the stored mailbox refresh token while preserving purchase and credit history.

6. Data retention schedule

  • Project Uploads & Renders: Stored while your account remains active. When you delete a project, associated temporary media and render files are permanently purged from active storage within 30 days.
  • Account Profile Data: Retained for the active duration of your account and securely erased within 180 days following account closure.
  • Financial & Payment Records: Retained for six (6) years to comply with statutory Nigerian corporate accounting, tax auditing, and anti-money laundering regulations.
  • System Diagnostics & Error Logs: Rotated and automatically purged every 90 days.

7. Security safeguards

We employ enterprise-grade security controls, including automated HTTPS/TLS 1.3 encryption across all public endpoints, encrypted database storage at rest, tokenized role-based access control (RBAC), and automated DDoS protection. While no internet platform can guarantee absolute invulnerability, in the event of a security incident affecting your personal data, we will notify you and the Nigeria Data Protection Commission (NDPC) within statutory timeframes.

8. Your statutory rights under NDPA 2023

As a data subject under the Nigeria Data Protection Act 2023, you have the right to:

  • Access: Request confirmation and a copy of personal data processed about you.
  • Rectification: Request correction of inaccurate, outdated, or incomplete information.
  • Erasure: Request the deletion of your account and personal data where no legal override exists.
  • Restriction & Objection: Object to specific data processing operations, including marketing communications.
  • Data Portability: Obtain an export of your creative projects in a structured, standard format.
  • Withdraw Consent: Revoke previously granted consent at any time without retroactive penalty.

To exercise any of these rights, email our Data Protection team at support@scenesync.me. We will process and respond to verified requests within thirty (30) calendar days. If you believe your rights have not been upheld, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

9. Cookies and tracking

SceneSync uses essential HTTP cookies to maintain secure authenticated user sessions and protect against cross-site request forgery (CSRF). We utilize first-party analytics (Google Analytics 4 with IP anonymization) to evaluate site traffic and app performance. You can manage or disable cookies at any time through your browser preferences.

10. Minors

SceneSync is strictly designed for users aged 18 and older. We do not knowingly collect personal information from minors. If we discover that an account was created by a minor, we will promptly delete all associated data.

11. Amendments to this policy

We may update this Privacy Policy periodically to reflect technological or regulatory advancements. We will notify you of material changes via email or an in-app notice prior to the changes taking effect.

12. Contact us

For privacy inquiries, data deletion requests, or regulatory questions, please contact:
Email: support@scenesync.me
Operating Entity: SceneSync Technologies, Lagos State, Federal Republic of Nigeria.