Data Compliance

This page summarises how Spoof Kitchen handles data protection, where your data is processed, who we share it with, and what rights you have. It complements our Privacy Policy and Terms of Service. If you’re evaluating Spoof Kitchen for your team and need a signed DPA or vendor questionnaire, jump to Data Processing Agreement.

We design Spoof Kitchen to meet the requirements of:

• GDPR (EU/UK General Data Protection Regulation) — lawful bases, data-subject rights, processor obligations.
• NDPA(Nigeria Data Protection Act, 2023) and the NDPC’s General Application and Implementation Directive (2025), which replaced the 2019 NDPR — lawful processing, data-subject rights, cross-border transfer safeguards, and breach notification. NDPC registration and a formally appointed data protection officer are still in progress; see Certifications.
• CCPA / CPRA (California Consumer Privacy Act) — notice at collection, right to know, delete, correct, and opt out of sale (we do not sell personal data).
• POPIA (South Africa) — for users in the Republic of South Africa.

Spoof Kitchen acts as a data controller for your account and usage data, and as a data processor for content you upload and the audience data you fetch from connected social platforms.

We use the following vendors to operate the service. Each is bound by data-protection terms equivalent to those we offer you. We update this list before adding any new sub-processor that handles personal data.

To receive email notice of changes, email privacy@spoof.media.

Account and content metadata are stored in Supabase’s EU region. Media files are stored on Bunny.net’s EU origin and cached at edge nodes worldwide for delivery performance. The application servers are in Germany, and error monitoring stays in Sentry’s Frankfurt region.

Some processing is not EU-resident, and we want to be direct about it. Product analytics (PostHog), AI inference (OpenAI, Google), and social publishing (Zernio) are processed in the United States. If you use AI features or connect a social account, that data leaves the EU. See International transfers for the safeguards that apply.

We cannot currently offer US-only or EU-only residency as a configurable option. If regional residency is a hard requirement for your organisation, write to compliance@spoof.media.

Encryption

• TLS 1.2+ for all data in transit, with HSTS preloaded.
• AES-256 at rest for databases and object storage.
• Platform OAuth tokens held by our own publishing service are encrypted with AES-256-GCM and never reach the browser; tokens for the platforms Zernio connects are held by Zernio.
• Passwordless sign-in: short-lived one-time codes emailed per session, or Google sign-in, so no password is ever stored or transmitted.

Application hardening

• Strict Content-Security-Policy, frame-ancestors: none, nosniff, and a restrictive Permissions-Policy on every response.
• Row-level security on customer data in Supabase.
• Rate limiting on authentication, upload, and AI endpoints.
• Least-privilege access to production credentials.

Software lifecycle

• Code review before merge.

Resilience

• Managed database backups provided by Supabase on their standard schedule.
• Error monitoring and alerting on production failures.

We are an early-stage team and we would rather understate this than overstate it. We do not yet run automated dependency scanning, commission penetration tests, run a formal quarterly access review, enforce SSO across all staff tooling, or publish a status page. Those are on the roadmap, and this page will change when they are real.

Spoof Kitchen is an early-stage product. We are honest about what we have and what we are working toward:

We hold no certifications or regulatory registrations today.

• NDPC registration — not yet registered with the Nigeria Data Protection Commission as a data controller of major importance. In progress, together with appointing a data protection officer.
• SOC 2 Type I — not started. Observation period planned for Q4 2026.
• ISO 27001 — not started. Gap assessment scheduled for 2027.

Our underlying infrastructure providers (Supabase, Hetzner, Bunny.net, Paystack, OpenAI) maintain their own SOC 2 / ISO / PCI attestations, and we inherit those controls at the infrastructure layer — but that is their attestation, not ours, and we will not present it as ours. If your procurement process requires a certified vendor, we are not one yet.

If you are an EU/UK customer, or any customer whose jurisdiction requires it, we will sign a Data Processing Agreement that incorporates the Standard Contractual Clauses (2021/914/EU) for international transfers. To request a pre-signed DPA, email compliance@spoof.media. We typically return a signed copy within 5 business days.

Where we transfer personal data outside the EEA, UK, or Nigeria, we rely on:

• For data leaving Nigeria, the bases in sections 41 to 43 of the NDPA: contractual data protection terms with each sub-processor and, where those alone don’t give equivalent protection, the transfer being necessary to perform our contract with the user. We record the basis for each transfer.
• Standard Contractual Clauses with our sub-processors.
• UK International Data Transfer Addendum where applicable.
• Supplementary technical measures: encryption in transit and at rest, pseudonymisation where feasible.

If we discover a personal-data breach likely to put your rights at risk, we will notify the Nigeria Data Protection Commission (and any other relevant supervisory authority) within 72 hours of becoming aware, as the NDPA (s.40) and GDPR require. Where the risk to you is high, we will tell you directly and without delay. The notice will describe what happened, what data was involved, the likely impact, the steps we are taking, and who to contact. We keep a record of every breach, notified or not.

You can exercise the following rights by writing to privacy@spoof.media from your account email address. We respond within 30 days. Self-serve export and deletion are not built yet, so every request below is handled manually by us today — that does not limit the right, only the mechanism.

• Right of access
• Right to rectification
• Right to erasure (“right to be forgotten”)
• Right to data portability (export as JSON / ZIP)
• Right to restrict or object to processing
• Right to withdraw consent
• Right to lodge a complaint with a supervisory authority (e.g. NDPC, ICO, CNIL)

Account and content data are kept for as long as your account is active. When you ask us to delete your account, personal data is erased or anonymised within 30 days, except where retention is required by law (for example, tax invoices kept for 7 years). Residual copies in managed backups age out on our providers’ standard rotation.

Deleting your Spoof Kitchen account does not retroactively delete posts already published to a social platform — those live on that platform under its own terms, and you remove them there.

Spoof Kitchen integrates with social platforms via their official APIs and complies with each platform’s developer policies:

• Meta (Instagram) — Platform Terms, including Limited Use restrictions for tokens and content.
• TikTok — Developer Terms of Service and Content Sharing Guidelines.
• Google (YouTube) — YouTube API Services Terms and Google API Services User Data Policy (including Limited Use).
• X — Developer Agreement and Policy.
• LinkedIn — API Terms of Use.

We only request the OAuth scopes needed to publish your content and read aggregated insights. You can revoke access at any time from the platform’s own connected-apps screen, or by emailing privacy@spoof.media.

Spoof Kitchen is operated by Spoof Social Studio Ltd (RC 9424008), 38 Adedoyin Street, Off Aguda, Surulere, Lagos, Nigeria. For compliance, security, or DPA enquiries:

• Compliance: compliance@spoof.media
• Privacy / DPO: privacy@spoof.media
• Security disclosures: security@spoof.media