Privacy Policy

1. The core commitment: your media stays on your device

NZcam's face swap and voice change processing happens 100% locally on your own computer. Your source photos, video files, and voice recordings are never uploaded to our servers, never stored by us, and never used to train any model. The desktop application contacts our servers only to register the device, sign you in, keep your live session licensed while you use it, and check for software updates.

Optional cloud-powered features. Some NZcam features are clearly labeled as cloud-powered (for example, live AI effects). These are the one exception to local-only processing: when you choose to turn one on, the video needed for that feature is streamed in real time to our AI processing partner for the duration of that session, transformed, and streamed back to you. That video is used only to generate your live output for the session; we do not store it, and it is not used to train models. Core face swap and voice clone stay 100% local as described above, and you are always told which features are cloud-powered before you enable them.

2. Data we do collect (website and account)

Running the NZCAM website and account system does require some data:

• Account data: your username, email address, and a hashed password (or your Google/GitHub account identifier if you use social login).
• Billing data: handled by our payment processor, Flutterwave. We receive your purchase status and a payment token, but never your full card number, your bank login, or your PIN. If you set up Auto top-up we store that token so we can charge the amount you chose. If you set up a bank direct debit we store the mandate reference your bank issued, together with the limits you approved (maximum amount per charge, and expiry date) — not your account credentials.
• Device data:to run the app on one machine at a time and to support you, the desktop app sends a device fingerprint (a hash of your machine's firmware identifier) plus its name, model, serial number, GPU, operating system, and IP address. A device is recorded once and kept even if you uninstall, so a reinstall resumes where it left off.
• Usage/analytics data: cookieless, aggregate website analytics (see Section 4), with no personal data, no cross-site tracking.
• Contact/support data: anything you send us via the contact form.

3. How we use this data

To operate your account, process credit and plan payments, run auto top-up if you turn it on, enforce one signed-in device at a time, provide support, protect the app against tampering and redistribution, and send transactional emails (sign-in codes, receipts, password reset).

4. Why we are allowed to use it (legal bases)

Where the Nigeria Data Protection Act 2023, the UK/EU GDPR, or a similar law applies to you, we rely on these bases:

• Performance of a contract — creating and running your account, taking payment, delivering credits, licensing your device, and providing support.
• Legitimate interests — keeping the service secure, preventing fraud, piracy and abuse, enforcing one signed-in device at a time, and understanding aggregate website usage. We rely on this only where it does not override your rights.
• Legal obligation — tax, accounting, and responding to lawful requests.
• Consent — where we ask for it, such as enabling a cloud-powered feature or setting up a payment mandate. You can withdraw consent at any time; that stops future processing but does not undo what was lawful beforehand.

5. Face and voice data

This deserves its own section, because NZcam is a face and voice tool and you should not have to infer the answer.

We do not collect, receive, store or derive biometric identifiers. The face and voice models run on your computer. No faceprint, voiceprint, face embedding or similar template is sent to us or stored by us, and we do not use your face or voice to identify you, to authenticate you, or to build any recognition database. The one labelled exception is a cloud-powered feature you turn on yourself, where live session video passes to our AI processing partner to be transformed and returned, and is not retained afterwards or used for training.

Because that media stays on your device, it is yours to manage: source photos, recordings and output live in the folders you chose, and deleting them there deletes them. We have no copy to delete.

6. Analytics and advertising measurement

Our website analytics are cookieless and privacy-respecting (Plausible), proxied through our own domain. They identify nobody, collect no personal data, and run for every visitor.

Advertising measurement, only with your consent.We advertise on TikTok, and if you accept marketing cookies we load the TikTok Pixel to learn whether an ad led to a visit, a signup or a purchase. It sets a cookie, reads TikTok's click identifier from the link you arrived on, and shares your IP address and browser user-agent with TikTok, who may combine that with data they already hold. Nothing is sent to TikTok unless you accept — declining, or simply not choosing, means the pixel never loads. See our Cookie Policy.

7. Data sharing

We share data only with the service providers needed to run the business: Flutterwave (payments), TikTok (advertising measurement, only if you accepted marketing cookies), Supabase (our database, authentication and email), our hosting provider, and, only when you use a cloud-powered AI feature, the real-time AI processing partner that powers it (which receives your live session video to perform the transformation and does not retain it afterward). Each is bound to use the data only to provide its service to us.

We may also disclose data where we are legally required to — to comply with a valid legal process, to enforce our Terms and Acceptable Use Policy, to prevent fraud or abuse, or to protect someone's safety. If our business is ever sold or merged, account data may transfer with it, and this policy continues to apply until you are told otherwise.

We do not sell your personal data. We have never done so, and we never will.

If — and only if — you accept marketing cookies, the TikTok Pixel shares limited data with TikTok for advertising measurement, which California law classifies as "sharing for cross-context behavioural advertising". Declining stops it entirely, which is why we ask before loading anything rather than offering an opt-out afterwards.

8. Where your data goes (international transfers)

We are based in Nigeria, and the providers we use operate internationally, so account and billing data may be processed outside your country — including in the European Union and the United States. Where we transfer personal data out of Nigeria we do so on the bases allowed by section 41 of the Nigeria Data Protection Act 2023, and where we transfer it out of the EEA or the UK we rely on an adequacy decision, or on Standard Contractual Clauses with the recipient, together with contractual confidentiality and security commitments.

You can ask us which providers hold what, and on what basis, using the contact details below.

9. How we protect it

Data is encrypted in transit. Passwords are hashed, never stored in a readable form, and we cannot see them. Locally stored licence and session files on your device are encrypted and bound to that machine, so copying them elsewhere does not carry your account with them. Access to production data is limited to the people who need it. We use a managed database provider with row-level access rules, so one account cannot read another's data.

No system is perfectly secure, and we will not claim otherwise. Please use a strong, unique password and keep your sign-in code private.

10. Data breaches

If a breach affects your personal data and is likely to result in a risk to your rights, we will notify the Nigeria Data Protection Commission within the time the NDPA requires, and tell affected users directly, describing what happened, what data was involved, and what to do about it.

11. Your rights

You can access, update, or delete your account data by contacting us. Under Part VI of the Nigeria Data Protection Act (NDPA) 2023, you possess specific and enforceable rights regarding your personal data. You have the right to request access to the personal data we hold about you and receive it in a commonly used format. You possess the right to request the rectification of any inaccurate, out-of-date, or incomplete data. You may request the erasure of your personal data where it is no longer necessary for the purposes collected or where you have withdrawn your consent. Furthermore, you hold the right to restrict the processing of your data, the right to object to data processing (particularly for direct marketing or where based on legitimate interests), and the right to data portability. You also maintain the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects. To exercise any of these rights, please contact us. If you believe your statutory data privacy rights have been violated, you have the right to lodge a formal complaint with the Nigeria Data Protection Commission (NDPC).

12. Data retention

We keep account and billing data for as long as your account is active, plus a reasonable period afterward for legal and accounting purposes — for payment records, that is the period our tax and accounting obligations require. Device records are retained so a returning machine resumes its prior status. Support messages are kept while they are useful for handling your issue and any follow-up. When a retention period ends, we delete the data or irreversibly anonymise it.

Deleting your account removes your profile, credentials and wallet balance. We may retain the minimum needed for a legal obligation, to resolve a dispute, or to keep an abuse or fraud record effective — because an account terminated under section 4 of our Acceptable Use Policy must not be trivially re-created.

13. Automated decisions

We do not make decisions about you by automated means alone that produce legal or similarly significant effects, and we do not profile you for advertising. Automated signals can flag an account for review — for example, suspected payment fraud or licence tampering — but a person reviews the case before an account is terminated, and you can appeal as described in our Acceptable Use Policy.

14. Children

NZcam is an 18+ product. It is not directed at children, we do not knowingly collect data from anyone under 18, and accounts we find to belong to a minor are closed and their data deleted. If you believe a child has given us personal data, contact us and we will remove it.

15. If you are in the EEA or the UK

The rights in section 11 apply to you under the UK/EU GDPR, on the legal bases set out in section 4, with transfers handled as described in section 8. You may lodge a complaint with your local supervisory authority — in the UK, the Information Commissioner's Office — as well as with us. We would rather hear from you first.

16. If you are in California

You may request the categories and specific pieces of personal information we have collected, the sources, the purpose, and the categories of third parties we disclosed it to; request deletion; request correction; and you will not be treated differently for exercising any of these rights. We do not sell personal information. The categories we collect are listed in section 2.

We share data for cross-context behavioural advertising only where you have accepted marketing cookies (section 6). Because that sharing never begins without your consent, declining the banner — or ignoring it — is the opt-out, and you can withdraw at any time by clearing this site's data in your browser.

17. Changes to this policy

We'll update the "Last updated" date above whenever we make material changes, and for changes that materially affect how we use your data we will give notice as described in our Terms of Service.

18. Contact

Contact us or email email our support team.