Delivami

Legal & Studio Compliance

Transparent agreements governing creative file delivery, pay-to-unlock escrow, payout settlement, and data sovereignty on Delivami.

Privacy Policy

Version 2026-10-27 · Last updated: November 2026

At Delivami Inc. (“Delivami,” “we,” “us,” or “our”), protecting your creative intellectual property and personal data is foundational to our studio platform. This Privacy Policy explains what data we collect, how we process and encrypt it, our strict zero-training AI policy, and how you can exercise your data rights.

1. Information We Collect

  • Creator & Studio Account Data: When you register a Delivami account, we collect your name, email address, phone number (encrypted at rest using AES-256-GCM), studio/workspace name, country, currency preference, and authentication credentials (hashed passwords, WebAuthn passkey public keys, TOTP 2FA secrets, or Google/GitHub OAuth identifiers via Better Auth).
  • Payout & Financial Records: When you configure payouts or issue invoices, we collect your verified Mobile Money wallet number or bank account details (resolved via Paystack), invoice line items, tax rates, and settlement history. Delivami never stores raw credit or debit card numbers.
  • KYC Identity Verification Data: To enable payouts and comply with anti-money laundering (AML) regulations, our verification partner Dojah collects government-issued ID details and biometric liveness checks. On our servers, Delivami stores only your verification status, verified legal name, ID type, the last 4 characters of your ID, and a salted HMAC-SHA256 cryptographic fingerprint (idNumberHash and identityHash) to prevent duplicate-account fraud—never the raw plaintext ID number.
  • Client Reviewer Data: When a client opens a delivery portal, leaves timestamped comments, approves deliverables, or pays an invoice, we record their name, email address, phone number (if SMS notifications are enabled), OTP verification timestamps, IP address, and browser user-agent for the project’s immutable audit trail.

2. How We Use Your Information

We process personal data strictly to:

  • Host encrypted project vaults, stream watermarked review proxies, and unlock master deliverables upon payment confirmation;
  • Process client checkout payments, calculate tiered clearing balances, and disburse payouts via Paystack;
  • Deliver transactional emails (via Resend) and SMS/WhatsApp alerts (via Twilio, Termii, and Africa’s Talking) for portal OTP codes, revision sign-offs, payment receipts, and security holds;
  • Detect and prevent fraud, unauthorized account access, malware uploads, and abusive traffic;
  • Comply with statutory tax retention and financial regulatory obligations.

3. Private AI Processing & Zero Model Training Policy

Delivami includes optional AI studio assistants powered by Cloudflare Workers AI (localized edge inference for comment summarization, revision change detection, plain-language invoice explanations, and support routing) and AssemblyAI (asynchronous transcription and multi-speaker diarization for long-form video and audio deliverables).

  • Strict Zero Foundation Model Training: Your master video cuts, photographs, audio stems, project documents, and client conversations are never sold, licensed, or used to train, fine-tune, or evaluate public AI models.
  • Ephemeral Inference: Audio and text payloads submitted for transcription or summarization are processed transiently to attach timecode transcripts or revision summaries to your workspace and are never shared across tenants.

4. Infrastructure & Third-Party Subprocessors

We share only the minimum necessary data with GDPR-compliant infrastructure providers required to operate the Service:

  • Cloudflare: Edge compute (Pages & Workers), AES-256 encrypted master file storage (R2), adaptive HLS video streaming (Stream), database connection pooling (Hyperdrive), distributed coordination (Durable Objects & Queues), Custom Hostnames, and bot defense (Turnstile).
  • Neon: Serverless PostgreSQL primary and read-replica databases with enforced SSL/TLS and tenant isolation.
  • Paystack: PCI-DSS Level 1 payment processing, Mobile Money & card checkout, bank account verification, and creator payouts.
  • Dojah: Identity verification (KYC) and AML compliance screening.
  • Resend, Twilio, Termii & Africa’s Talking: Transactional email, SMS, and WhatsApp notification delivery.
  • PartyKit: Real-time WebSocket synchronization for live review comments and studio notifications.
  • Security & Threat Intelligence: VirusTotal, Google Safe Browsing, AbuseIPDB, and FingerprintJS for pre-delivery malware scanning, phishing link detection, and IP reputation checks.
  • Diagnostics & Consent-Gated Analytics: Sentry (error monitoring), PostHog, Amplitude, and Google Analytics (loaded only when you grant analytics consent via our cookie preference manager).

5. Data Retention & Self-Serve Account Deletion

You have full control over your account lifecycle directly inside Settings > Privacy & Data:

  • Data Export (Portability): You can generate and download a complete JSON archive of your profile, projects, invoices, payouts, and session logs at any time.
  • 30-Day Deletion Grace Period: When you confirm account deletion (by typing DELETE MY ACCOUNT), your account enters a 30-day grace period. Signing back in or clicking the emailed cancellation link restores your account. A final reminder is emailed 3 days before permanent erasure.
  • Permanent Erasure vs. Statutory Tax Retention: After 30 days, your profile, credentials, R2 vault files, Stream videos, comments, proposals, draft/unpaid invoices, API keys, and connected integrations (Slack, QuickBooks) are permanently deleted. Personal details on KYC records are scrubbed so only the non-reversible keyed hash remains for fraud prevention. Paid or refunded invoices and payout records are retained in anonymized form (with all names, emails, phone numbers, addresses, and notes removed) for 6 years to satisfy tax laws in Ghana, Nigeria, Kenya, and the UK.

6. Your Privacy Rights (GDPR, CCPA & Local Laws)

Depending on your jurisdiction (including the European Economic Area, the United Kingdom, Ghana, Nigeria, Kenya, South Africa, and California), you have the right to access, rectify, export, restrict, or erase your personal data, and to withdraw consent for optional analytics or marketing cookies at any time.

7. Contact Our Privacy Team

To exercise your data rights or ask questions about this Privacy Policy, please contact our Data Protection team at privacy@delivami.com or dpo@delivami.com.