Privacy Policy

Effective 1 January 2026 · Applies globally to all Nubya users

Summary: This policy explains how Nubya collects, processes, stores, and protects your personal data in compliance with GDPR, CCPA, and applicable international data protection laws.

1.1 Data Controller

Nubya acts as the data controller for personal data processed through the Platform. For all data protection enquiries, contact: privacy@nubya.app.

1.2 Categories of Personal Data Collected

Nubya collects the following categories of personal data:

• Identity & Account Data: full name, username, email address, phone number, date of birth, country of residence, and profile photograph.
• User-Generated Content: posts, comments, direct messages, live stream recordings, media uploads, and associated metadata.
• Device & Technical Data: IP address, device identifiers, operating system, browser type, cookie identifiers, and log data.
• Usage & Behavioural Data: interaction logs, search history, feature engagement, session duration, and referral data.
• Payment & Transaction Data: billing information, transaction history, wallet balances, and payout details where monetization features are used.
• Communications Data: records of support requests, reports submitted, and correspondence with Nubya.

1.3 Legal Basis for Processing

Processing is carried out on the following legal basis:

• Contractual necessity: to provide and operate the Platform and fulfil obligations to Users.
• Legitimate interests: fraud prevention, security, product improvement, and analytics, where not overridden by User rights.
• Consent: for non-essential cookies, marketing communications, and optional personalization features.
• Legal obligation: compliance with applicable laws, court orders, and regulatory requirements.

1.4 Purposes of Processing

Account creation, authentication, and account management.

Platform personalization, content recommendations, and feed curation.

Delivery of communications, service notifications, and product updates.

Security monitoring, fraud prevention, and abuse detection.

Advertising delivery and performance measurement (subject to consent where required).

Analytics, product research, and platform improvement.

Compliance with legal and regulatory obligations.

1.5 Data Sharing and Third Parties

Nubya may share personal data with:

• Service providers and processors acting on our instructions under appropriate data processing agreements (e.g., cloud hosting, payment processors, analytics providers).
• Advertising partners, subject to applicable consent requirements.
• Law enforcement, regulators, or courts where required by applicable law or to protect Nubya's legal rights.
• Successor entities in the event of a merger, acquisition, or sale of assets, subject to equivalent data protections.

Nubya does not sell personal data as defined under the CCPA.

1.6 International Data Transfers

Where personal data is transferred outside the European Economic Area (EEA) or the United Kingdom, Nubya ensures appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission or equivalent transfer mechanisms.

1.7 Data Retention

Personal data is retained for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Account data is generally retained for the duration of the account and for a further period of up to 12 months following account closure, unless longer retention is required by law or for legitimate business purposes.

1.8 User Rights

Subject to applicable law, Users have the following rights in respect of their personal data:

• Right of access: to obtain a copy of personal data held by Nubya.
• Right to rectification: to correct inaccurate or incomplete data.
• Right to erasure: to request deletion of personal data in certain circumstances.
• Right to restrict processing: to limit how personal data is used.
• Right to data portability: to receive personal data in a structured, machine-readable format.
• Right to object: to processing based on legitimate interests, including for direct marketing.
• Right to withdraw consent: at any time, without affecting prior processing.
• Right not to be subject to automated decision-making: including profiling with legal or significant effects.

To exercise any right, submit a request to privacy@nubya.app. Nubya will respond within the timeframes required by applicable law (generally 30 days for GDPR requests).

California residents have additional rights under the CCPA/CPRA, including the right to know categories of data sold or disclosed, the right to opt out of sale or sharing, and the right to non-discrimination.

1.9 Data Security

Nubya implements appropriate technical and organizational measures to protect personal data against unauthorized access, accidental loss, destruction, or alteration. These measures include encryption in transit and at rest, access controls, regular security assessments, and incident response procedures.

1.10 Children’s Privacy

The Platform is not directed to individuals under the age of 13. Nubya does not knowingly collect personal data from children under 13. Where parental consent is required under applicable law (e.g., COPPA in the United States or equivalent), Nubya will take steps to verify consent prior to processing. If you believe a child has provided personal data without appropriate consent, contact privacy@nubya.app.

1.11 Changes to This Policy

Nubya may update this Privacy Policy from time to time. Material changes will be communicated via in-app notification or email at least 30 days prior to taking effect for existing Users.