Creator Program Privacy

This page explains what data we collect from creators in the VaultMart Creator Affiliate Program, why we collect it, and how it's protected. This supplements VaultMart's main privacy policy.

1. What we collect

From you directly when you apply:

• Your display name and bio
• Social handles, follower counts, and a public post URL
• Bank account details for payouts

Automatically when your referral link is used:

• A first-touch vm_via cookieset on your visitor's browser for 30 days
• A click record containing a hashed IP address and hashed user-agent, the source referrer (e.g. tiktok.com), and the landing path
• Whether the click eventually converted to a signup, and the resulting user's ID

IPs and user-agents are hashed with a server-side secret salt before storage. We do not store raw IP addresses.

2. Why we collect it

• To verify eligibility and review applications.
• To attribute revenue to the correct creator (1% commission tracking).
• To process bi-weekly payouts to your bank account.
• To detect fraud — self-referrals, click farms, fake follower schemes.
• To respond to support questions or program-related emails.

3. Who sees your data

• VaultMart admin staff — full access for review, payouts, and fraud investigation.
• Paystack — our payment processor receives your bank name, account number, account name, and the payout amount when we send a payout.
• Supabase — our database host, where this data is stored encrypted at rest.
• We do not sell or share your data with advertisers, marketers, or any third party not listed above.

4. Visibility of your referral link

Your referral_code and display_name are treated as public — anyone visiting your link sees nothing that identifies you beyond your chosen display name. Your real legal name, email, follower counts, social handles, and bank details are private.

5. Retention

We retain application data and earning records for as long as your creator account is active, plus 7 years after closure for tax and accounting purposes. Click records are retained for 2 years for fraud analysis. You can request deletion of inactive account data by emailing us.

6. Your rights (NDPA)

Under the Nigeria Data Protection Act, you can request:

• A copy of all personal data we hold on you.
• Correction of inaccurate data.
• Deletion of data we are not legally required to retain.
• Restriction of processing while we resolve a complaint or correction.

Email privacy@vaultmart.com.ng to exercise these rights. We respond within 30 days.

7. Security

Data is stored encrypted at rest in Supabase, accessed only over TLS. Bank account numbers are partially masked in the admin dashboard. Service-role database access is restricted to backend systems and named admin staff.

8. Contact

Privacy questions: privacy@vaultmart.com.ng. Program questions: creators@vaultmart.com.ng.