Privacy Policy

Who we are

This Privacy Policy explains how personal information is handled when you use Thelvora Surprise at surprise.thelvora.com (the "Service").

The Service is operated by Thelvora Novatech Limited ("Thelvora", "we", "us").

Privacy contact: support@thelvora.com

Information we collect

Depending on how you use the Service, we may collect and process:

• Purchaser email: used for payment processing and order records.
• Sender name and recipient name that you enter when creating a surprise.
• Messages, letters and other text you write into a template.
• Uploaded photographs/images and uploaded music/audio (where a template supports them).
• Template and experience selections, including soundtrack choices where applicable.
• Colours and other customisation settings you choose in the editor.
• Payment and order information such as amount, currency, payment status, Paystack transaction reference, terms-acceptance records, and an order recovery code associated with your payment.
• Newsletter email if you subscribe from the site footer.
• Optional feedback such as a rating and comment after purchase, linked to a payment reference where provided.

Our servers and hosting provider may also process standard technical information that is typically generated when you use a website (for example IP address, browser/device information, and request logs) as part of operating, securing and troubleshooting the Service. We do not operate a separate product database that stores analytics profiles of visitors for advertising.

Your browser may also store limited information locally (for example draft content, a recent payment reference, experience id, order code, or feedback-prompt state) to improve convenience on the same device. That local storage is not used as the source of truth for whether a payment succeeded.

Why we process information

We process information to:

• create, host and deliver the surprise experience you purchase;
• process payments and confirm successful payment;
• provide order-recovery access using the order code you receive;
• respond to support, privacy and refund requests;
• prevent fraud, abuse and unauthorised access;
• maintain security and integrity of the Service;
• improve reliability and product quality;
• send optional product updates if you subscribe to the newsletter;
• comply with applicable legal and accounting obligations.

We do not sell your personal information. We do not use the Service to run third-party advertising profiles based on your surprise content.

Lawful basis

Where Nigerian data-protection principles apply, we rely on the lawful basis that fits the processing:

• Contract / service delivery: creating your surprise, processing payment, hosting the experience for the purchase period, and providing recovery access.
• Consent: for optional newsletter subscription, and for any other processing where we ask for consent and consent is the appropriate basis. You may withdraw newsletter consent by contacting us.
• Legitimate interests: security, fraud prevention, service improvement, and defending legal claims, balanced against your rights.
• Legal obligation: retaining certain payment/transactional records where required by law.

Consent is not treated as the basis for everything. Core purchase and delivery processing is handled as necessary to provide the Service you request.

Third-Party Service Providers

We may use trusted third-party service providers to help us operate the Service, including payment processing, hosting, storage, email delivery, analytics, security and other infrastructure services. These providers may process personal information only as necessary to provide their services to us and are expected to handle such information in accordance with applicable privacy and data-protection requirements.

Payment card and bank details are handled by our payment provider (currently Paystack). Thelvora does not store raw card numbers on its systems. See also the Payment information section below.

Payment information

Payment card and bank details are processed by Paystack. Thelvora does not store raw card numbers or bank account secrets on our systems. We store payment-related records we need to operate the Service (for example email, amount, status, Paystack reference, order code, and verification timestamps).

User-uploaded content

You retain ownership of the photographs, messages, audio and other content you upload or enter. Thelvora does not claim ownership of that content.

By uploading or submitting content, you grant Thelvora a limited right to store, process, transmit and display that content as needed to provide, maintain, secure and support the Service (including showing the surprise to anyone who opens your share link).

You are responsible for having the rights and permissions needed to upload content, including permissions relating to people appearing in photos and any music you upload.

How surprise links and media work

After successful payment, the surprise is available through a unique share link. Anyone who has that link may be able to open the experience, so share it only with people you trust.

Access to the interactive surprise page is checked on our servers (including payment status and expiry). Uploaded media files are stored with our storage provider. Direct file URLs may be publicly addressable if obtained, so treat share links carefully and avoid uploading highly sensitive material you would not want exposed if a link is forwarded.

If you leave checkout before receiving your link, you may use the order recovery code shown before payment, together with our Recover link feature, to retrieve a paid surprise link. Recovery looks up the order by code and only returns the link when payment has been confirmed as successful on our servers.

Retention

Shared surprise links are intended to remain available for 7 days after successful payment. After that period, the experience page is no longer available through the Service.

We retain user-uploaded content for as long as reasonably necessary to provide the purchased experience and operate the Service. Unpaid or abandoned draft media may be removed automatically after a short period as part of routine cleanup.

We do not currently guarantee that every paid media file is permanently deleted from storage at the exact moment a 7-day link expires. Underlying database and storage records may remain until deleted through operational cleanup, a verified deletion request, or other legitimate need. Transactional and legal records (including payment and verification records) may be retained longer where needed for accounting, dispute handling, security or legal compliance.

Writing templates may allow a recipient to download a letter (for example as an image or PDF). Downloads saved to a device are outside our control after download.

Your privacy rights

Subject to applicable Nigerian law, you may have rights to request access to, correction of, or deletion of personal information we hold about you; to object to or request restriction of certain processing; to request portability of information you provided where applicable; and to withdraw consent where processing is based on consent (for example newsletter subscription).

To exercise these rights, email support@thelvora.com with enough detail for us to verify and respond to your request. We may need to confirm your identity or order details before acting, and some records may need to be retained where the law requires.

Children's information

Thelvora Surprise may be used to create birthday or similar experiences that involve children. If you upload a child's name, photo or other personal information, you must have the appropriate authority or permission to do so. Do not upload children's information you are not allowed to share.

Security

We apply practical safeguards appropriate to the Service, including:

• HTTPS transmission for the website;
• keeping payment secrets and database service credentials on the server (not in the browser);
• database access controls so sensitive payment tables are not publicly writable;
• server-side Paystack verification before unlocking a paid surprise;
• Paystack webhook signature checks where webhooks are used;
• upload restrictions such as allowed file types and size limits;
• order recovery based on a hard-to-guess order code rather than email-only lookup.

No online service is perfectly secure. Please protect your order code and share links, and contact us promptly if you believe there has been unauthorised access related to your order.

Data incidents

If we become aware of a personal-data or security incident affecting the Service, we will assess it and respond in accordance with applicable law, including any notification obligations that apply.

International processing

Some providers we use (including payment, database/storage and hosting providers) may process information on infrastructure located outside Nigeria. Where required, we take steps appropriate to the Service to use providers under contractual and organisational safeguards.

Cookies and similar technologies

The Service uses browser storage mainly for functional convenience (such as drafts and recent order helpers). We do not currently run a separate non-essential marketing analytics cookie banner because we do not currently ship third-party advertising/analytics trackers in the application. If we introduce non-essential tracking in future, we will update this Policy and implement any consent steps then required.

Policy changes

We may update this Privacy Policy from time to time. The "Last updated" date at the top will change when we do. Material changes will be communicated by posting the updated Policy on this page and, where appropriate, by other reasonable notice (for example a notice on the website).

Contact

For privacy questions or requests: support@thelvora.com