Privacy Policy

Celebut Limited, including its subsidiaries and corporate affiliates ("Celebut", "we", "us", or "our"), is deeply committed to protecting the privacy, confidentiality, and security of the personal data of our users ("User", "you", or "your").

This Privacy Policy ("Policy") governs our processing of personal data across the global Celebut social media platform, websites, mobile applications, creator economy features, and proprietary technical infrastructure (collectively, the "Services"). By accessing or using the Services, you acknowledge that you have read, understood, and agree to the collection, transmission, storage, disclosure, and utilization of your personal data as described herein.

1. Regulatory Compliance Framework

Celebut operates as a data controller or data processor, as applicable under local legislation. We process personal data in strict compliance with the statutory and regulatory privacy frameworks within the jurisdictions where we offer Services, including, without limitation:

• The General Data Protection Regulation (GDPR) (EU) 2016/679;
• The UK Data Protection Act 2018 (and the retained UK GDPR);
• The Nigeria Data Protection Act (NDPA) and all associated directives, including the General Application and Implementation Directive (GAID); and
• Any other applicable regional, national, or state-level data protection and privacy statutes.

2. Personal Data We Collect

We collect personal data to provision, secure, and personalize our Services. This information is categorized as follows:

2.1 Information You Provide Directly to Us

• Account Registration Data: Your full legal name (matching your government-issued identification), date of birth, email address, telephone number, and country of residence.
• Verification and Compliance (KYC) Data: To comply with global Anti-Money Laundering (AML) regulations and authorize gifting features, we collect valid government-issued identification documents (e.g., international passport, driver's license, national ID), live photograph/video verification data, and your documented occupation.
• Financial and Withdrawal Data: To process payouts, we collect your bank account details. This bank account must be situated in your verified country of residence, deal in your local currency, and bear a legal name that identically matches your verified identity profile on Celebut.
• User-Generated Content: Content you create, share, post, or upload to the platform, including photos, text, videos, comments, custom celebration guidelines, and milestone event preferences.

2.2 Information Automatically Collected (Device and Telemetry Data)

When you interact with our Services, our system architectures automatically capture data from your hardware device:

• Telemetry and Identifiers: Your Internet Protocol (IP) address, hardware device model, operating system type and version, unique device identifiers, and platform crash diagnostic logs.
• Usage Data: Granular logs regarding how you interact with our platform, including time logs, features utilized, connections made, profiles viewed, and event tracking.
• Cookies and Tracking Technologies: We utilize cookies, web beacons, and pixels to authenticate sessions, secure your platform interaction, and remember your account preferences.

2.3 Information from Third Parties

• Payment Processors: We receive transaction status logs, partial payment identifiers, and risk assessment scores from our third-party regulated payment processors to ensure transaction integrity.

2.4 Children's Privacy and Age Assurance Protocols

Celebut is designed strictly for individuals aged 18 or older (or the legal age of digital consent in your jurisdiction). We do not knowingly collect information from children under this threshold.

To prevent underage sign-ups, we use explicit age-verification steps:

• Self-Declared Age Gates: Users must enter their date of birth when creating an account.
• AI Age-Estimation Modeling: If our system detects behavior or text suggesting a user is under 13, the account is flagged and suspended until the user can prove their age.
• Biometric Age Verification for Monetization: Creators must pass an identity check using a government ID and a matching facial selfie to unlock cash gifting or platform payouts. This ensures minors cannot access financial monetization features.

3. How We Use Your Personal Data

Celebut processes your personal data under valid legal bases (including contractual necessity, legal obligation, and legitimate interest) for the following purposes:

3.1 Contractual Execution

Establishing your user profile, managing your internal Platform Balance, and allowing you to participate in social gifting and the platform creator economy.

3.2 Identity Verification

Cross-verifying your registered data against government documents and destination bank accounts to facilitate safe, identity-matched withdrawals.

3.3 Security and Fraud Prevention

Auditing public milestone events to actively monitor against misrepresentation, fraudulent solicitation, friendly fraud, identity theft, and suspicious account closures.

3.4 Personalization and Curation

Curating content recommendations, profile discoveries, synchronized milestone events, and tailored commercial promotions based on your activity, subject to your configuration settings.

3.5 Legal and Regulatory Compliance

Adhering to mandated financial record-keeping, preservation of digital evidence for law enforcement, and local tax declaration obligations.

4. AI, Algorithmic Profiling, and Automated Decision-Making

Celebut utilizes highly complex machine learning systems and algorithmic models to manage content curation, maintain ecosystem safety, and provide custom metrics.

4.1 Recommendation Engines and Algorithmic Curation

The content feed visible to you is not chronological; it is built dynamically using automated profiling systems. The platform tracks your precise interaction speed, viewing duration for specific creators, comment histories, sound track repetitions, and regional trends to build a local interest matrix. This profile automatically predicts what content you are most likely to interact with and rearranges your feed based on those scores.

4.2 Automated Content Moderation and AI Oversight

To protect the community at scale, Celebut runs text, images, and video feeds through automated computer vision and natural language processing (NLP) models. These AI models check for structural violations of our Community Guidelines (such as explicit material, illegal substances, hate speech, or dangerous activities).

4.3 Algorithmic Flagging

Media with high violation probabilities is flagged automatically. The system will either direct the post to human review teams or apply automated safety actions, like shadow-banning, adding sensitive content filters, or temporarily blocking visibility.

4.4 Automated Account Bans

Serious, clear violations of child safety or violent extremism policies trigger automated account blocks. If an account is suspended via completely automated logic, the user receives an alert and can request human review via the Appeals Center.

4.5 Creator Analytics Deep-Profiling

We aggregate user views, profile visits, watch-time distributions, and digital gifting loops to generate detailed Creator Analytics dashboards. This allows Creators to view the demographic breakdown (such as age range, generalized location, and language) of their followers. All follower information used in these dashboards is aggregated and stripped of direct identifiers.

5. Device Permissions

To provide full mobile and web app functionality, Celebut will request native system access permissions on your device:

• Photo Gallery and Storage: Necessary to permit you to select, upload, and share user-generated content or verification documents.
• Camera Modules: Required to capture profile imagery, event footage, or live video elements for identity verification.
• Network Status: Required to optimize data transmission speeds and connection routing.

You can modify or revoke these permissions via your operating system controls at any time. However, revoking required permissions will restrict your access to corresponding platform features and may affect your overall experience on our platform.

5.1 Financial, Monetization, and Platform Balance Data

• User Payment Processing: Credit card or debit card brand, masked primary account number (PAN, keeping only the last 4 digits), expiration date, billing address, and transaction tokens. Note: Full cardholder details are processed directly by PCI-DSS-compliant third-party payment gateways.
• User Payout Information: Local bank account numbers, International Bank Account Numbers (IBANs), SWIFT/BIC codes, PayPal accounts, or hyper-localized digital wallet routing keys, as applicable.
• Monetization Activity Metrics: Real-time accounting tracking of Platform Balance fluctuations, historical internal transaction ledgers showing Cash Gifting sources, subscription costs, purchase success ratios, and pending processing windows.

5.2 User-Generated Content (UGC) and Behavioral Data

• Media Assets: Photos, video streams, audio recordings, live broadcasts, and text posts created and distributed by users.
• Content Metadata: Structural data embedded within media files, such as exchangeable image file format (EXIF) data, geo-tag markers showing file generation location, capture time, camera focal specs, and encoder rates.
• Interactive Inputs: Follow graphs, user blocks, direct content reports, comments, emojis, bookmarks, and structural lists created by the user.

5.3 Device, Technical, and Telemetric Logs

• Hardware Profiling: Device brand, precise model names, operating system variants and current build patch level, unique hardware identifiers (e.g., MAC address, IMEI, Android ID), and browser versions.
• Network and Telecommunications Data: Current Internet Service Provider (ISP), mobile network operator name, signal strength indicators, network connection type (WiFi, 4G, 5G), and public-facing Internet Protocol (IP) addresses.
• Application Performance Metrology: Detailed crash stack traces, precise software version markers, core interaction latency rates, page-load timing states, background processing states, and local application resource draw values.

5.4 Communications and Support Tickets

• Private Messages: End-to-end encrypted or platform-routed text messages, media drops, and link shares sent through our localized chat utility.
• Support Requests: Written messages, screenshots, video evidence, and debug files submitted to Celebut support personnel or dynamic interactive helper modules.

6. User Controls, Privacy Settings, and Individual Rights

We believe you should have control over your personal privacy. Celebut provides settings directly within the account dashboard to manage your data footprint:

6.1 App Privacy Configurations

• Profile Visibility: Toggle your profile between Public and Private. Choosing a private setting means only approved followers can view your uploaded content.
• Content Restrictions: Manage who can comment on your posts, restrict text mentions, or turn off direct message requests completely.
• Account Safety Actions: Block or report offending profiles instantly. Activating a block cuts off all direct communication and visibility between your account and that profile.

7. How We Collect Personal Data

We employ a tripartite architecture for collection:

• Direct User Submission: Actions performed actively by you, such as filling out account forms, completing your profile, passing biometric KYC checks, sending private text chats, or inputting banking profiles.
• Automated Telemetric Harvesting: Data collected seamlessly by Celebut infrastructure the millisecond you open our platform, including device data, system events, background interaction timers, and tracking scripts.
• Third-Party and Enterprise Integrations: Information acquired via commercial networks, marketing providers, public identity databases (such as legal business registers), and identity provider single-sign-on (SSO) APIs (e.g., Apple ID, Google Sign-In).

8. Sharing and Disclosure of Personal Data

We do not sell your personal data. We disclose personal data strictly under the following conditions:

• Regulated Payment Processors: Your data is shared with country-specific, third-party payment entities to process P2P cash gifts, verify bank credentials, manage payouts, and fulfill regional KYC obligations.
• Platform Ecosystem Interactions: When a user sends a Digital Gift or subscribes to a Creator, that Creator sees the user's username, public avatar, and the total value of the gift. Creators also receive aggregated, anonymous audience reports.
• Corporate Affiliates: We share data across our corporate subsidiaries and affiliates to ensure seamless infrastructure support and global service continuity.
• Service Providers: We engage trusted data centers, cloud hosting providers, software developers, and diagnostic sub-processors operating under strict confidentiality mandates.
• Regulatory, Legal and Enforcement Authorities: We disclose personal data to courts, administrative agencies, regulators, or law enforcement bodies if we believe in good faith that disclosure is legally mandated, necessary to protect user safety, prevent platform fraud, or preserve evidence.

8.1 Global Data Transfers and Cloud Hosting

Celebut maintains a global cloud computing infrastructure. To ensure operational optimization, high availability, and network redundancy, your content and personal data will be transferred, stored, and processed across international borders. This includes transmission to distributed servers and third-party facilities located outside your country of residence.

When executing cross-border data transfers from the EU, UK, Nigeria, or other heavily regulated environments, Celebut implements mandatory legal safeguards—including Standard Contractual Clauses (SCCs), adequacy assessments, and data transfer agreements—to ensure that your personal data receives the exact equivalent level of statutory protection required by your home nation.

9. Security Protocols

We implement rigorous technical, administrative, and physical security controls to safeguard the confidentiality, integrity, and availability of personal data. These include multi-factor authentication (MFA) support, end-to-end data encryption protocols during transit and at rest, and automated fraud-detection analytics.

9.1 Data Retention Framework

We retain personal data only as long as necessary to fulfill the operational purposes detailed in this Policy or as legally mandated by statutory retention periods.

Upon a voluntary account deletion request, personal data is purged from our active systems within ninety (90) days, subject to the following statutory retention exceptions:

• Transaction Logs: Data associated with commercial transactions, financial payouts, and AML tracking is archived for extended statutory durations to fulfill mandatory banking and corporate record-keeping obligations.
• Legal and Evidentiary Disputes: Personal data relevant to an active platform investigation, a breach of terms, or an ongoing legal claim will be preserved until the dispute is conclusively adjudicated.
• Technical Backup Architectures: Data residing within deep encrypted backup archives will persist until standard technical lifecycle rotation completely overwrites the sectors.

10. Your Data Protection Rights

Depending on your geographic location, you possess specific, enforceable statutory data protection rights, which you can exercise by contacting our compliance office:

• Right of Access: The right to request copies of the personal data we hold about you.
• Right to Rectification: The right to compel us to correct inaccurate or incomplete personal data.
• Right to Erasure ("Right to be Forgotten"): The right to request the total deletion of your personal data under specific conditions.
• Right to Restrict Processing: The right to limit the mechanisms by which we process your information.
• Right to Data Portability: The right to request the transfer of your structured personal data directly to another entity or format.
• Right to Object: The right to challenge data processing based strictly on our legitimate interests or direct marketing pathways.

11. Data Security Architecture and Incident Notification

Celebut maintains an enterprise-grade security system designed to prevent unauthorized data access, changes, leaks, or destruction.

11.1 Technical Safeguards

• Encryption Protocols: All data moving between user devices and our servers is secured using Transport Layer Security (TLS 1.3). Data saved on our servers is protected using Advanced Encryption Standard (AES-256).
• Identity Verification Controls: We enforce Multi-Factor Authentication (MFA) for all internal employees, run role-based identity checks (Least Privilege access model), and continuously log system access.
• System Vulnerability Testing: We perform regular external penetration tests, automated vulnerability scans, and manage a continuous bug bounty program to patch security flaws quickly.

11.2 Breach and Incident Notification

If a security incident occurs that compromises personal data, Celebut will follow standard regulatory timelines:

• Supervisory Authorities: We will notify the relevant Lead Supervisory Authority (such as the Irish Data Protection Commission for EU users) within 72 hours of confirming the breach under GDPR guidelines.
• Affected Individuals: If the data breach poses a high risk to your personal rights and freedoms, we will notify you directly via your registered email address without undue delay. This notice will explain what data was accessed, the potential risks, and the steps we are taking to secure your account.

12. Contact Information and Amendments

We reserve the right to amend this Privacy Policy from time to time to align with product updates, corporate structuring changes, or shifting legal landscapes. When material revisions are made, we will notify you through the platform interface or via your registered email address before the effective date.

If you have any questions, compliance concerns, or wish to exercise your data rights, please contact our Data Protection Officer (DPO) at:

Celebut Compliance Office Email: privacy@celebut.com