Privacy Policy

This Privacy Policy explains what personal information Million Dollar Advertisement collects, why we collect it, who we share it with, how long we keep it, and the choices and rights you have. It applies to our website (milliondollaradvertisement.com) and our Android app. It is written in line with the Nigeria Data Protection Act 2023 (NDPA) and related regulations.

1. Who we are

Million Dollar Advertisement is operated by Alkebulan Technology Company Ltd, a company registered in Nigeria (RC 1937876) ("we", "us"). We are the data controller for the personal data described here. You can contact us about privacy at [email protected].

2. Who this is for

You must be at least 18 years old to use Million Dollar Advertisement. It is not directed at children, and we do not knowingly collect information from anyone under 18. If we learn that an account belongs to someone under 18, we will delete it.

3. What we collect

Information you give us:

• Account details: your email address, business or advert name, and (optionally) your location (state or country that you choose from a list — we never read your device's GPS location), business category and tags.
• Profile content: profile picture or logo, description, website and social-media links, and the links you choose to make public.
• Content you create: posts, reels (video posts), stories, offers, comments, likes, shares, saves, follows, gifts, and the messages you send to other members.
• Support requests you send us, and anything you tell us in them.
• Referral payout details when you request a withdrawal: a Nigerian bank account (bank and account details) or a USDT wallet address.
• Files you upload (images and videos), including bank-transfer payment receipts.

Information about payments:

• What you bought (size, number of squares), the amount and currency, payment references, and the status of the payment. Card details are entered with, and held by, our payment providers — we never see or store your full card number. For USDT we do not receive your private keys.
• The IP address used at checkout and a fraud-risk score from Google reCAPTCHA, to detect fraud and abuse.

Information collected automatically:

• Technical data such as IP address, browser and device type, and pages requested, in server and security logs.
• A push-notification identifier if you allow notifications (see section 6).
• A session cookie that keeps you signed in (see section 12).

Spider, our AI assistant, and voice:

• The messages you send to Spider and Spider's replies, kept so the conversation can continue.
• To answer you, Spider is also given information from your own account: your business name, category, tags, location, follower and following counts, squares owned, and the captions and like counts of your recent posts. Spider is not given what you watched, which profiles you viewed, or any other member's private data, and we do not record that information.
• If you use the microphone button, your speech is converted to text by your own browser or device (for example the speech service built into Chrome or Safari). We do not receive or store your voice recordings.

What we do NOT collect: your precise location, your contacts, your photos other than files you deliberately upload, or advertising identifiers.

4. Why we use it, and our legal basis

• To create and run your account and public profile, sell you squares and process payments — because we need to in order to provide the service you asked for (contract).
• To send one-time login codes, receipts and service messages (contract).
• To operate posting, following, messaging, notifications, Discovery, Reels, the leaderboard and Spider (contract and our legitimate interest in running the platform).
• To calculate and pay referral rewards and keep the Square Coin ledger (contract).
• To prevent fraud, abuse and security incidents, moderate content, and enforce our Terms (legitimate interests and legal obligation).
• To keep financial and accounting records and respond to lawful requests (legal obligation).
• To send you notifications you can switch off, such as a follower's new post or a new square purchase (legitimate interest, and your consent where push notifications are concerned).

We do not sell your personal data, and we do not use it for advertising profiles.

5. What is public

Some information is visible to other people by design: your business name, category, location, profile picture, description, links you make public, posts, stories, offers, follower and following counts, and the squares you own on the wall. The homepage "Happening now" feed shows a business name and the size of a purchase. Comments, likes and shares are visible to other members. Messages are visible to you and the person you sent them to. You can choose which of your website and social links are shown publicly, and you can block people (see section 5 of our Community Guidelines), but the rest of your profile is public, so please think before posting anything you would not want everyone to see.

6. Who we share information with

We use trusted service providers who process data for us. We give them only what they need:

• Payments: Paystack and OPay (Naira card and bank payments, where enabled), NOWPayments (USDT crypto payments), and our own bank for manual bank transfers.
• Email: Resend, which delivers our emails (login codes, receipts, notifications).
• Push notifications: OneSignal, which receives a device identifier and your user ID so we can send notifications you have allowed.
• Security and delivery: Cloudflare, which sits in front of our website to protect it and deliver it quickly, and Google reCAPTCHA, which helps stop automated abuse at checkout.
• GIFs: GIPHY, which receives the search words you type when you search for a GIF.
• AI and voice: Anthropic (which powers Spider's answers and receives your message plus the profile details in section 3 needed to answer) and ElevenLabs (which turns Spider's text reply into speech and receives that reply text, not your voice).
• Hosting and infrastructure providers that store our data.
• Professional advisers, regulators, courts and law-enforcement authorities where the law requires it or where needed to protect our rights or others' safety.
• A buyer or successor, if our business is ever sold or reorganised, who must honour this policy.

We do not allow these providers to use your data for their own marketing.

7. Emails and notifications

• Service emails (login codes, receipts, payment problems) are sent because you use the platform; you cannot opt out of these while you have an account.
• Notification emails and push notifications — such as when someone you follow posts something new, when another member buys squares, or when you get a message, follower, like, comment or gift — can be switched on or off in Dashboard → Overview. Every "someone just bought squares" email also has a one-click unsubscribe link.
• Push notifications only work if you allow them in your browser or phone.

8. Transfers outside Nigeria

Some of the providers above are based in, or process data in, other countries (for example the United States or the European Union). When your data is transferred outside Nigeria we take steps to make sure it stays protected in line with the NDPA, such as using providers that commit to appropriate safeguards.

9. How long we keep your information

• Your account information, content and messages: for as long as your account exists.
• One-time login codes: they expire after 10 minutes.
• Sign-in session: up to 7 days after you last use the platform, unless you sign out sooner.
• Stories: they stop being shown 24 hours after you post them.
• Spider conversations: until you delete your account.
• Support requests: until resolved, and for a reasonable period afterwards.
• Server and security logs: for a limited period needed for security and troubleshooting.
• Payment, purchase, payout and reward-ledger records: for as long as the law requires us to keep financial records (in Nigeria this is generally up to six years). After you delete your account, these records are kept without your name, email, IP address or payout details.
• Backups: we keep database backups for 14 days. If you delete your account, your deleted data can remain in backups for up to 14 days before it is overwritten.

10. Your rights

Under the NDPA you can:

• ask what personal data we hold about you and get a copy;
• ask us to correct data that is wrong (you can edit most of it yourself in Dashboard → Edit profile);
• ask us to delete your data;
• ask us to restrict, or object to, certain uses of your data;
• ask for your data in a portable format;
• withdraw your consent at any time, where we rely on consent (for example by turning off notifications).

To use these rights, email [email protected] from the address on your account. We may need to confirm it is really you, and we aim to reply within 30 days. If you are unhappy with our answer you can complain to the Nigeria Data Protection Commission (NDPC).

11. Deleting your account

You can permanently delete your account at any time, inside the app (Dashboard → Account → Delete account) or without the app at milliondollaradvertisement.com/delete-account. We confirm it is you with a code sent to your email. Deletion cannot be undone. When you delete your account:

• We permanently remove your profile, posts, reels, stories, offers, comments, likes, shares, saves, views, messages you sent, follows and followers, blocks, Spider conversations, support requests and the images and videos you uploaded, and we remove your push-notification identity.
• Your wall squares stay sold and cannot be refunded or resold, but they lose your name and logo and show only as "Deleted account".
• We keep payment, purchase, payout and reward-ledger records, without your name, email, IP address or payout details, because we must keep financial records by law.
• Any unclaimed Square Coin and referral earnings are forfeited, and purchases are not refunded.
• We cannot delete your account while a referral withdrawal is still waiting to be paid; once it is paid (or cancelled) you can delete it.
• Content you sent to other people (for example messages they received from you) is removed as described above, but copies other people made themselves (such as a screenshot) are outside our control.

If you cannot access your email, contact [email protected].

12. Cookies and similar technologies

• Sign-in session cookie: essential. It keeps you logged in after you verify a one-time code and lasts up to 7 days after you last visit. Staff use a separate, protected session cookie.
• Preferences stored on your device: your light/dark theme and your Spider voice on/off choice.
• Push notifications: if you allow them, OneSignal stores a subscription identifier in your browser or device.
• Security cookies: Cloudflare and Google reCAPTCHA may set cookies or use similar technologies to detect bots and abuse, mainly at sign-in and checkout.

We do not use advertising or cross-site tracking cookies, and we do not currently use analytics cookies. If that changes we will update this policy first.

13. Security

We protect your data with encrypted connections (HTTPS), passwordless sign-in using one-time codes that expire quickly, restricted access for staff with two-step verification for administrators, and separation from our payment providers, who handle card data. No system is perfectly secure. If a breach affects your personal data in a way the law requires us to report, we will notify you and the authorities as the law requires.

14. Changes to this policy

We may update this policy as the platform changes. We will change the "Last updated" date above and, for significant changes, tell you in the app or by email.

15. Contact us

Alkebulan Technology Company Ltd (RC 1937876), Nigeria Email: [email protected] Our Help & Support page is at milliondollaradvertisement.com/support.