1. Scope
This policy covers website visits, registration, queue administration, the optional Autopay Upgrade, Stripe Connect status and provider-confirmed payment-verification activity.
PRIVACY
POLICY
How NollyWin protects registration without collecting identity documents.
2. Information members provide
NollyWin may collect name, email, mobile number, country, age confirmation, agreement acceptance, autopay authorization and support messages. Never send NollyWin a card number, bank number, Stripe password, PIN, BVN, identity-document image or verification code.
3. Phone formatting and account uniqueness
Mobile numbers are standardized in international E.164 format. NollyWin stores the normalized number and prevents the same email address or phone number from being assigned to more than one membership. NollyWin does not require an SMS code.
4. CAPTCHA and registration security
Registration uses a bot challenge and server-side rate limits. NollyWin stores short-lived keyed hashes of network and email identifiers for abuse prevention rather than retaining raw network addresses in the registration-attempt log.
5. No identity documents or selfies
NollyWin does not require members to upload identity documents or selfies for membership and does not create or retain an identity-document fingerprint.
6. No direct Stripe-account access
NollyWin cannot sign in to, browse or control any member's Stripe account. We cannot view a member's Stripe password, complete balance, unrelated transactions, bank credentials, full card credentials or private financial dashboard.
7. Autopay token and consent records
For an upgraded account, NollyWin stores Stripe-generated customer, subscription and payment-method reference IDs—not the complete card number—along with the selected contribution amount, enable or pause status, consent version, consent time and a protected network-address hash.
8. Limited payment data received
Stripe sends NollyWin limited provider events needed to operate the rotation: provider references, payer and recipient identifiers, amount, currency, payment status, application-fee amount and timestamp. NollyWin does not receive complete card, bank or login credentials.
9. Why data is used
Limited account and payment data is used to prevent basic duplicate registration, confirm payment, activate a first-time member, determine activity, initiate authorized autopay, apply queue rules, prevent duplicate charges or credit, correct reversals, qualify tracked referrals and support disputes.
10. Optional email consent
Registration offers a separate, optional checkbox for NollyWin marketing, onboarding and re-engagement emails. Consent is not required to create or use an account. These broadcasts do not include account, payment, queue or private profile information. A member may withdraw consent at any time by unchecking the email box in the Member Circle or by using the unsubscribe link in a broadcast. Essential account, service, security and support messages are not marketing.
11. Referral tracking
NollyWin stores an opaque referral code, the referring and referred account identifiers, qualification status, timestamps and earned or applied upgrade-month credits. Public referral links do not expose a member's name, email, phone number or internal user ID.
12. No financial account or wallet
NollyWin does not create a bank account, wallet, balance statement or transaction account for a member and does not maintain a copy of the member's Stripe financial account. Dashboard amounts are operational verification and queue records, not funds held by NollyWin.
13. Retention
Membership and operational records are kept only as reasonably needed for the service, security, disputes and legal obligations. A member who requests deletion has a 30-day grace period before NollyWin permanently deletes the account and personal membership records, subject to lawful retention by independent providers such as Stripe.
14. Sharing
Limited data may be shared with Stripe, Supabase, Cloudflare, hosting, security and professional providers; the named recipient where needed for a direct payment; or where law and safety require. NollyWin does not sell personal information.
15. Security and international processing
Reasonable safeguards are used, but no internet service guarantees absolute security. Providers may process information in supported countries under their applicable safeguards.
16. Member rights
Depending on location, a member may request access, correction, deletion, restriction, portability or objection. Security, dispute and lawful-retention exceptions may apply.
17. Adults only
Membership is restricted to people aged 18 or older.
18. Contact
Submit privacy questions or account-uniqueness disputes through the Contact page or email rworship@nollywoodspotlight.org.