Privacy Policy

Naitrons Limited (RC [number]), [registered address], Lagos, Nigeria, runs Triveelo and is the data controller for the personal data described in this policy. That means we decide why and how it is used, and we are responsible for protecting it under the Nigeria Data Protection Act 2023 ("NDPA").

• Privacy questions and requests: [contact email for privacy]
• Data Protection Officer: [DPO name/email if appointed]

This policy covers triveelo.com, play.triveelo.com, ads.triveelo.com, api.triveelo.com and the games played on them. It does not cover other sites that adverts or artist profiles link to.

• You can play every game without an account. Guests are known to us only by the username they pick and an anonymous play session.
• Accounts need an email address, a username, country, city and birth month and year. We never ask for your day of birth.
• 13 to 17 year olds need a parent or guardian's consent by email. Their data is never used to target adverts.
• Adults can choose to let us use their age group to pick adverts. It is off unless you turn it on.
• We do not sell personal data. Advertisers only see totals, never who you are.
• We store IP addresses only in a scrambled (hashed) form, to stop fake views and plays.
• You can see, correct, download or delete your data, and complain to the Nigeria Data Protection Commission.

Guests (playing without an account)

• On your device only: the username you pick, your progress (Gems, items, upgrades, missions, best scores, settings) and cached game files. We cannot see this unless you send it to us. See the Cookie Policy.
• Scores: when you finish a run we receive your username, score, distance, Gems collected and run length, so you can appear on the game's leaderboards.
• Play session data: a random session identifier, the game and area you are playing, and events that show an advert was seen or heard, or a song was played. These have no name or email attached.
• Technical data: your IP address and browser details reach our servers with every request. We use them for security and to detect bots; where we store an IP address with play data, we store a one-way hash of it, not the address itself.

Players with an account

• Email address, username, country and city.
• Birth month and year, and the age group we work out from them (13 to 17, 18 to 24, 25 to 34, 35 to 44, 45 and over).
• Your choice about age-group advertising, and records of what you agreed to and when.
• Avatar choices, level, experience points (XP), badges and favourite game.
• Game progress synced to our server: Gems and a record of how they were earned and spent, items, upgrades, unlocks, missions and scores.
• Sign-in records: when codes were requested and used, and your active sessions.

Players aged 13 to 17

• Everything listed for players, except that we do not show your city publicly.
• Your parent or guardian's email address, and a record of when they confirmed or withdrew consent.

Advertisers

• Email address, your name and the advertiser name shown next to your adverts.
• Bookings: games, placements, areas and weeks booked, prices, currency, category, ARCON approval reference, your confirmation that you hold the rights, and review decisions.
• Creatives you upload (images, audio, shout-out and mission text) and the results of our automated checks.
• Payment records: amounts, payment references, refunds and fees. Card and bank details are entered on Paystack's or Stripe's pages; we do not receive or store them.

Shout-outs can include another person's first name (for example a birthday message). Only add someone's name if they would be happy to see it in a game.

Artists and rights holders

• Artist profile: stage name, country, biography, links and artwork.
• Tracks: audio files, title, genre, explicit flag, release year, ISRC and UPC codes, and where the track may play.
• Rights information: your role (owner, co-owner, label or distributor), distributor name, proof documents, collecting-society membership, the split sheet (names, emails and shares of every rights holder) and confirmations from co-owners.
• Identity verification: legal name, the country of your ID document, an image of the document and a selfie, or a reference from a verification provider if we use one.
• Payout details: a payout account reference from Paystack or Stripe and a masked description (for example "Bank ****1234").
• Stream statistics, monthly statements, balances and transfers.

If an artist lists you as a co-owner on a split sheet, we receive your name, email address and share from them. We email you to confirm or decline, and use your details only for that track's rights and payouts.

People on a launch list

If you ask to be told when a coming-soon game is out, we keep your email address, the game and when you gave consent.

Administrators and voice actors

For our own staff we keep their email address and a log of administrative actions. For voice actors we keep their name and the recordings they made for us under their contract.

When you contact us

We keep the messages you send and our replies.

The NDPA (section 25) only allows us to use personal data where we have a lawful basis. These are ours:

Where we rely on legitimate interests, we have weighed our interests against yours and kept the data to the minimum, for example by hashing IP addresses and reporting only totals to advertisers. You can object (see Your rights).

We do not send marketing emails to anyone under 18. Platform emails, such as sign-in codes and booking updates, are part of the service and are not marketing.

Under the NDPA a child is anyone under 18, as defined by the Child's Rights Act 2003. We have designed Triveelo with that in mind:

• Under 13: no account. Children can play as guests, which involves only a chosen username, scores and anonymous session data. We ask that they do not use their real name as a username.
• 13 to 17: an account is only activated after a parent or guardian confirms it through a link we email to them, which lasts seven days. We ask for birth month and year only. A parent or guardian can withdraw consent at any time, and we will then delete the account and its personal data.
• Children's data is never used for advert targeting, their city is not shown publicly, and they receive no marketing.
• Artist, advertiser and payout features are for adults only.

If you believe we hold a child's data without proper consent, contact [contact email for privacy] and we will look into it and delete the data where appropriate.

Advertisers can ask for their advert to be shown to particular age groups (18 to 24, 25 to 34, 35 to 44 or 45 and over). Adverts aimed at an age group are only shown to adult account holders who have switched on "Use my age group to show ads that suit me" and who fall in that group.

• It is off unless you turn it on, at sign-up or in your account settings.
• You can turn it off at any time, as easily as you turned it on. Adverts that are not aimed at an age group still appear.
• Guests and 13 to 17 year olds never receive age-targeted adverts.
• We never tell an advertiser who you are. Advertisers see only totals by age group, and any group with fewer than 50 different players is hidden.

We use some automated processing. None of it produces legal or similarly significant effects on you without a person being involved:

• Age-group advertising places you in an age group, only if you opted in. It affects which adverts you see, nothing else.
• Fraud and bot checks automatically reject advert views and song plays that look fake (for example too many events too quickly, or automated browsers). Rejected events are simply not counted.
• Score checks automatically reject impossible scores. A decision to suspend an account for cheating is made by a person.
• Content checks automatically screen adverts, music and usernames for file problems and offensive words. Every advert and track is then approved or rejected by a person.

You can ask for a person to review any decision about you, give your point of view and challenge it, as section 37 of the NDPA provides.

We do not ask for sensitive personal data such as health, religion or political views. The only exception is artist identity verification: an image of your face (selfie) compared with your ID document may count as biometric data. We only process it with your explicit consent, use it only to confirm you are who you say you are, keep it in private storage and delete the images 30 days after our decision.

We do not sell personal data. We share it only with:

We also share:

• with the public: usernames, scores, levels, badges, country and (adults only) city on leaderboards and profiles; artist stage names, artwork and track details on the radio and artist pages; advertiser names next to their adverts;
• with advertisers: totals of views, listens and unique players by day, game, placement and (for opted-in adults, with small groups hidden) age group, never anyone's identity;
• with artists and rights holders: stream totals and unique listener counts, and the names and shares of co-owners on the same split sheet;
• with authorities: where the law requires it, for example the Nigeria Data Protection Commission, the Advertising Regulatory Council of Nigeria, tax authorities, the police or a court;
• with professional advisers and buyers: our lawyers, accountants and auditors under confidentiality, and anyone who buys our business, who must protect your data in the same way.

Each service provider acts on our written instructions under a contract that requires it to protect your data, as section 29 of the NDPA requires.

Some of our providers store or handle data outside Nigeria, as shown above. We only transfer personal data abroad where the NDPA allows it (sections 41 to 43): where the recipient is bound by law, contract clauses or other measures giving adequate protection, or where the transfer is needed to provide the service you asked for (for example a Stripe payment in pounds).

We keep a record of the basis for each transfer. You can ask us for details at [contact email for privacy].

We keep personal data only as long as we need it. These are our standard periods:

When an account is deleted, we remove its profile and personal data. We keep records we must hold by law (such as payment records) for the periods above.

Under the NDPA (sections 34 to 38) you have the right to:

• know whether we hold your data and get a copy of it;
• have inaccurate or incomplete data corrected;
• have your data erased when we no longer need it or have no lawful basis to keep it;
• restrict our use of it while a request or objection is dealt with;
• object to processing based on legitimate interests, and to direct marketing at any time;
• withdraw consent at any time, without affecting what we did before;
• not be subject to a solely automated decision with significant effects, and ask for human review;
• receive your data in a structured, machine-readable format and have it sent to another organisation.

How to use them

• Many settings are in your account: you can change your profile, turn age-group advertising on or off, and delete your player account.
• For anything else, email [contact email for privacy] from the address on your account. We may ask for proof of identity before acting.
• A parent or guardian can act for a child under 18.
• We reply without undue delay and within 30 days. Requests are free unless they are clearly unfounded or excessive.

Please contact us first at [contact email for privacy] so we can try to put things right. You also have the right to complain to the Nigeria Data Protection Commission (ndpc.gov.ng) under section 46 of the NDPA.

If you are in the United Kingdom or the European Union, you can also complain to your local data protection authority, such as the UK Information Commissioner's Office (ico.org.uk).

We use technical and organisational measures suited to the risks, including:

• encrypted connections (HTTPS) for every page, game and request;
• sign-in codes stored only as one-way hashes, expiring after 10 minutes and limited to five attempts;
• signed, HttpOnly session cookies that scripts on the page cannot read;
• IP addresses hashed before they are stored with play data;
• identity documents and rights proofs kept in private storage, opened only through logged administrative actions;
• administrator access limited to named people, with an audit log;
• nightly database backups and regular security updates.

No system is completely secure. Keep your email account safe, because it is how you sign in.

If a personal data breach is likely to put your rights at risk, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it. If it is likely to put you at high risk, we will tell you directly and promptly, in plain language, with advice on how to protect yourself. We keep a record of every breach and what we did about it.

Triveelo is aimed at players in Nigeria. If you use it from the United Kingdom or the European Union, or pay in pounds or dollars, UK or EU data protection law may also apply to you and give you equivalent rights. You can exercise them in the same way.

We will update this policy when our services or the law change. The version and date at the top show the latest version. If a change materially affects how we use your data, we will tell account holders by email before it takes effect, and ask for fresh consent where the law requires it.

• Naitrons Limited, [registered address], Lagos, Nigeria (RC [number])
• Privacy: [contact email for privacy]
• Data Protection Officer: [DPO name/email if appointed]
• General help: [contact email for support]