Privacy Policy

This policy covers Medya Ops the product — the accounts, organizations and data you or your organization put into it. It doesn't cover third-party sites we link to (Paystack's own checkout page, for instance), which have their own privacy practices.

• Account information — your name, email address, and a hashed password (we never store it in plain text).
• Organization data — whatever your organization enters or uploads: campaigns, media plans, purchase orders, creatives, invoices, contacts, and the documents behind them.
• Payment records — the amount, currency and status of a credit purchase. Your card number is never sent to or stored by us; Paystack handles that directly.
• Usage and activity logs — actions taken in the product (who did what, when) and basic technical logs (IP address, browser) kept for security and reliability, not for tracking or advertising.

We use what we collect to:

• Run the product — generate documents, process payments, send notifications your organization configured.
• Extract structured data from documents you upload (a media plan PDF, for instance) — this sends the document's content to a third-party AI provider strictly to produce the extraction; see Subprocessors below.
• Keep the platform secure and investigate abuse or errors.
• Respond when you contact us.

We do not sell your data, and we do not use it for third-party advertising. Medya Ops carries no analytics or advertising trackers — the only cookie the product sets is your session cookie.

We share data only where it's necessary to run the product, and only ever the minimum a service needs to do its job — never sold, never handed over for that company's own purposes.

• Paystack — processes card payments. Receives what a charge needs (amount, currency, your email); your card number goes to Paystack directly and is never sent to or stored by us.
• A third-party AI provider — when your organization extracts a document (a media plan PDF, for example), that document's content is sent to this provider's API to produce the structured extraction. This is the one point where document content leaves our own infrastructure for an AI provider; nothing else in the product does this. We choose and may change which provider we use — the purpose and scope described here stays the same regardless of which one — and will name the current provider on request.
• Cloud infrastructure providers — host our database and uploaded files. They store data on our behalf under contract and don't use it for their own purposes.
• Law enforcement or regulators, only where we're legally required to.

If your organization handles documents it can't send to a third party for processing, or needs to know which provider is currently in use, tell us at hello@medyaops.com — extraction is the one workflow this applies to, and we'd rather you know upfront than find out later.

We keep organization data for as long as your organization's account is active, plus a reasonable period afterward to allow recovery from accidental deletion and to meet accounting/regulatory record-keeping obligations. Some records — the credit ledger and audit log — are kept append-only by design, so history can't be quietly rewritten; deleting an account doesn't erase what already happened on it.

Under the Nigeria Data Protection Act (and equivalent laws elsewhere, where they apply to you), you can ask to see what personal data we hold about you, correct it, or ask us to delete it where we're not required to keep it. Write to hello@medyaops.com and we'll act on it directly — no automated form standing between you and an answer.

If this changes in a way that matters, we'll update the date at the top and, for a material change, tell active account holders directly rather than let it pass silently.