Nimipiko
Legal

Privacy Policy

NIMIPIKO STUDIO LTD · Last updated: 2026

Introduction

This Privacy Policy explains how Nimipiko Studio Ltd ("Nimipiko", "we", "us") collects, uses, and protects personal data when you use voices.nimipiko.com (the "Platform"). We are committed to protecting your personal information and being transparent about what we collect and why. By using the Platform, you acknowledge this policy.

1. Data Controller

2. Data We Collect

We collect only what is necessary to provide our services:

  • Full name and email address (provided when submitting a project brief or creating an account)
  • Phone / WhatsApp number (optional, for project communication)
  • Voice recordings and scripts submitted through the Platform
  • Payment references — we do not store full card numbers; payments are processed via PCI-compliant third-party processors
  • Project details: language, tone preferences, deadlines, and file delivery formats
  • Technical data: IP address, browser type, device type, and pages visited (via analytics tools)
  • Authentication tokens (Supabase session cookies used to keep you logged in)
  • Preference data stored locally: language choice, theme (dark/light), cookie consent status

3. Cookies & Tracking Technologies

We use the following types of cookies and local storage on this Platform:

  • Authentication cookies (Supabase) — essential; keep you signed in during a session. Cannot be disabled without breaking login.
  • Cookie consent preference (nimipiko_cookie_accepted) — stored in localStorage; remembers your accept/decline choice.
  • Theme preference (nimipiko_theme) — stored in localStorage; remembers dark or light mode across visits.
  • Language preference (nimipiko-lang) — stored in localStorage; remembers your selected language (EN/FR/RW).
  • Analytics (Google Tag Manager / GTM-PJBW79JP + Vercel Analytics) — collects anonymised usage data such as page views, session duration, and traffic sources. No personal identifiers are linked to analytics data.
  • You can clear all stored preferences at any time through your browser's developer tools (Application → Local Storage / Cookies).

We do not use advertising cookies, retargeting pixels, or sell your data to third parties.

4. How We Use Your Data

We process your data exclusively for the following purposes:

  • Delivering the voice-over, sound library, and Visual Soul services you have requested
  • Communicating with you about your active or prospective project
  • Processing and recording payments securely
  • Sending your referral code if you join our Ambassador Programme
  • Maintaining the security and integrity of the Platform (fraud detection, abuse prevention)
  • Generating anonymised, aggregate usage analytics to improve the Platform
  • Complying with legal obligations under Rwandan and applicable international law
  • Responding to your privacy requests, questions, or complaints

We do not use your data for automated decision-making or profiling that produces legal effects.

5. Third-party Service Providers

We share data with trusted processors only to the extent necessary to operate the Platform:

  • Supabase (database & authentication) — stores your account data and project files on servers in the EU. Privacy policy: supabase.com/privacy
  • Vercel (hosting & infrastructure) — serves the Platform and collects anonymised access logs. Privacy policy: vercel.com/legal/privacy-policy
  • Google Tag Manager (GTM-PJBW79JP) — loads analytics scripts. Data processed under Google's Privacy Policy: policies.google.com/privacy
  • Vercel Analytics — anonymised page-view and performance analytics. No personal identifiers collected.
  • Payment processor — handles all card transactions via PCI-DSS compliant infrastructure. Nimipiko never receives or stores full card numbers.
  • MTN Mobile Money — for clients who pay via mobile money in Rwanda. Subject to MTN's privacy terms.

We review all processors for adequate data protection standards before engagement.

6. International Data Transfers

Nimipiko Studio Ltd is based in Rwanda. Our service providers (Supabase, Vercel) operate infrastructure in the EU and US. Where applicable, we rely on contractual safeguards (Standard Contractual Clauses or equivalent) to ensure your data receives adequate protection outside Rwanda, in accordance with applicable data protection laws.

7. Data Retention

We retain your data only as long as necessary:

  • Account data: retained for the duration of your account and for 2 years after the last activity
  • Project files and voice recordings: retained for 1 year after final delivery, then permanently deleted
  • Payment references: retained for 7 years to comply with Rwandan financial regulations
  • Analytics data: anonymised; retained for up to 14 months then automatically deleted by the analytics provider
  • Cookie consent records: retained for 1 year
  • You may request earlier deletion of your data at any time — see Section 8 (Your Rights)

8. Your Rights

You have the following rights regarding your personal data:

  • Access — request a copy of all personal data we hold about you
  • Rectification — request correction of inaccurate or incomplete information
  • Erasure — request deletion of your data ('right to be forgotten'), subject to legal retention obligations
  • Restriction — request that we limit how we process your data in certain circumstances
  • Portability — receive your data in a structured, machine-readable format
  • Objection — object to processing based on legitimate interests
  • Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing
  • Lodge a complaint — with the Rwanda Utilities Regulatory Authority (RURA) or a competent data protection authority in your jurisdiction

We respond to all valid data rights requests within 30 days.

9. Policy Updates

We may update this Privacy Policy to reflect changes in our practices or applicable law. When we make material changes, we will notify you by email (if you have an account) or via a prominent notice on the Platform. The 'Last updated' date at the top of this page always reflects the current version. Continued use of the Platform after the effective date constitutes acceptance of the revised policy.

10. Contact & Privacy Requests

For any privacy-related requests, questions, or to exercise your rights, please contact us at:

requests.voices@nimipiko.com