wavset

Dyalect Limited ("Dyalect", "we", "us", or "our") is committed to protecting the privacy and security of your personal data. This Privacy Policy describes how we collect, use, store, share, and protect your personal data when you use the wavset platform (the "Platform"), including its web application and mobile-optimised interfaces.

This Privacy Policy is issued in compliance with Nigeria's Data Protection Act 2023 (the "NDPA") and the regulations made under it. By using the Platform, you acknowledge that you have read and understood this Privacy Policy.

At a Glance: Your Privacy Summary

This table summarises the key points of this Privacy Policy. Please read the full policy below for complete details.

1. Who We Are and How to Contact Us

1.1 Data Controller

Dyalect Limited is the data controller for all personal data collected through the wavset Platform. This means we determine the purposes and means of processing your personal data.

1.2 Data Protection Officer

Dyalect has designated a Data Protection Officer (DPO) responsible for overseeing data protection compliance. You may contact our DPO at: info@dyalectstudio.com. Any request relating to your personal data rights under the NDPA should be sent to this address.

2. What Data We Collect

We collect the following categories of personal data:

2.1 Account and Identity Data

When you create a wavset account, we collect:

• Your email address (used to identify your account and communicate with you);
• Your password (stored in hashed, non-reversible form using bcrypt with a minimum cost factor of 12 — we never store or view your plaintext password);
• Your account type (Artist or Manager);
• Timestamps of account creation, email verification, and last login.

2.2 Financial Records Data (Content)

The Platform is designed for you to enter your own financial records. We store the data you choose to submit, which may include:

• Income records: source, amount, currency, exchange rate, date, category, and notes;
• Expense records: category, amount, currency, date, and notes;
• Royalty statements: platform, distributor, reporting period, amounts reported, amounts received, expected payment dates, and payment status;
• Show records: event name, date, location, promoter, fee, deposit amounts, and payment status;
• Deal records: brand name, deal type, total value, currency, deliverables, payment instalment schedules, and deal status;
• Annual income goals and progress data.

This data is provided entirely by you. wavset does not connect to any bank account, streaming platform, distributor system, or third-party financial data source. All financial data in the Platform was entered by you or your authorised Manager.

2.3 Collaboration Data

If you use the Team plan, we collect:

• The email address of any Manager you invite;
• Manager invitation tokens and their expiry timestamps;
• Audit trail records: which user created or last edited each record, and the timestamp of those actions.

2.4 Payment and Billing Data

When you subscribe to a paid plan, payment is processed by Paystack. We do not store, process, or receive your payment card numbers, bank account numbers, CVV codes, or other sensitive payment credentials. We receive from Paystack only:

• Subscription status (active, cancelled, suspended);
• Transaction reference numbers;
• Billing dates and plan details;
• Payment success or failure status.

Your payment data is governed by Paystack's own Privacy Policy, available at paystack.com/privacy.

2.5 Usage and Technical Data

We collect limited technical and usage data to operate and improve the Platform:

• Request IDs, timestamps, and HTTP status codes for server log purposes;
• Device type, browser type, and operating system (from standard HTTP headers);
• Session activity patterns (for security monitoring and performance purposes);
• Error codes and diagnostic information.

We do not log financial amounts, email addresses, or authentication tokens in our application logs. We do not use third-party analytics trackers that build behavioural profiles across the internet.

2.6 Opportunities Hub Usage

The Opportunities Hub is a read-only curated feature. We do not track which listings you view or click on. External links in the Opportunities Hub will take you to third-party websites governed by their own privacy policies.

3. How We Collect Your Data

We collect your data in the following ways:

• Directly from you: when you create an account, log financial records, enter subscription details, or contact us;
• From your authorised Manager: when a Manager enters records on your behalf within your Workspace;
• From Paystack: when payment events occur (subscription created, charge succeeded, charge failed, subscription cancelled);
• Automatically through the Platform: technical and usage data collected through standard server logs and session management.

4. Legal Basis and Purposes for Processing

Under the Nigeria Data Protection Act 2023, we are required to have a lawful basis for processing your personal data. The following table sets out the purposes for which we process your data and the lawful basis for each:

5. How We Share Your Data

5.1 What We Do Not Do

Dyalect does not sell, rent, or trade your personal data or your financial records to any third party under any circumstances.

Dyalect does not share your individual financial records with record labels, music distributors, streaming platforms, publishers, or any music industry third parties.

Dyalect does not use your individual data to train artificial intelligence or machine learning models without your explicit written consent.

5.2 Third-Party Service Providers

We share limited data with the following trusted third-party service providers, who process data on our behalf under contractual obligations to protect it:

5.3 Legal Disclosure

Dyalect may disclose your personal data to law enforcement agencies, regulators, courts, or other public authorities where required to do so by applicable Nigerian law, court order, or legal process. We will notify you of any such disclosure request where we are legally permitted to do so.

5.4 Business Transfers

If Dyalect is involved in a merger, acquisition, asset sale, or restructuring, your personal data may be transferred to the successor entity. You will be notified of any such change and your rights will be protected in accordance with this Privacy Policy and the NDPA.

6. How We Protect Your Data

Dyalect implements robust technical and organisational security measures appropriate to the sensitivity of your financial data:

6.1 Encryption

• All data transmitted between your device and the Platform is encrypted using HTTPS / TLS 1.2 or higher. We do not permit HTTP connections.
• Your data is encrypted at rest within our database infrastructure managed by Supabase.
• Your password is stored using bcrypt hashing with a minimum cost factor of 12. Plaintext passwords are never stored or logged.

6.2 Access Controls

• Every database record is tagged with a workspace identifier. No query ever returns data from a workspace the authenticated user does not belong to.
• Row-level security (RLS) is enforced at the database layer as an independent second line of defence, separate from application-level access controls.
• Authentication tokens (JWTs) are signed with a secret key stored exclusively in environment variables. Tokens are never committed to the codebase or logged.
• Login attempts are rate-limited to prevent brute force attacks.

6.3 Payment Security

Dyalect never touches, stores, processes, or logs your payment card details, bank account numbers, or CVV codes. All payment data is handled exclusively by Paystack, which operates in accordance with applicable payment card industry security standards.

6.4 Internal Security Practices

• Access to production systems is restricted to Dyalect personnel with a legitimate operational need.
• Application logs contain only request IDs, timestamps, and error codes. Financial amounts, email addresses, and authentication tokens are never logged.
• All dependencies are reviewed for known security vulnerabilities before each deployment.
• Environment variables and secrets are never committed to version control repositories.

6.5 Security Incidents

In the event of a personal data breach that poses a risk to your rights and freedoms, Dyalect will notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of the breach, as required by the NDPA. We will also notify affected users without undue delay where the breach is likely to result in a high risk to their rights and freedoms, and will provide details of the nature of the breach and the steps we are taking to address it.

7. Data Retention

We retain your personal data only for as long as necessary to provide the Platform services and meet our legal obligations. The following retention periods apply:

At the end of the applicable retention period, all personal data and financial records are permanently and irreversibly deleted from Dyalect's systems. Audit trail data (created_by, edited_by, and timestamps) is part of the individual record and is deleted with it — it is not retained separately.

8. International Data Transfers

Dyalect's primary infrastructure providers (Supabase and Railway) may store or process data on servers located outside Nigeria. Where this occurs, Dyalect ensures that appropriate safeguards are in place, including contractual protections and, where applicable, compliance with the NDPA's provisions on cross-border data transfers.

Dyalect will configure its infrastructure to minimise unnecessary cross-border data transfers and will prioritise data residency options within Africa where technically available and commercially practicable.

You may request information about the specific data transfer safeguards applicable to your data by contacting privacy@wavset.co.

9. Your Rights Under the NDPA 2023

Nigeria's Data Protection Act 2023 grants you the following rights in relation to your personal data held by Dyalect. You may exercise any of these rights by contacting info@dyalectstudio.com. We will respond within 30 days of receiving your request, and within a reasonable extended period where the request is complex.

9.1 Right of Access

You have the right to request a copy of the personal data we hold about you and to receive information about how it is being processed. We will provide this in a clear and intelligible format.

9.2 Right to Correction

If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or complete it. For financial records you have entered yourself, you may edit these directly within the Platform at any time.

9.3 Right to Erasure

You have the right to request the deletion of your personal data where:

• The data is no longer necessary for the purposes for which it was collected;
• You withdraw your consent and there is no other lawful basis for processing;
• You object to processing and there are no overriding legitimate grounds;
• The data has been unlawfully processed.

You may request erasure of your account and all associated data by contacting support@wavset.app. Erasure will be carried out in accordance with the data retention periods in Section 7 above. Note that we may retain certain data where required by law (for example, transaction records required by applicable financial regulations).

9.4 Right to Restriction of Processing

You have the right to request that we restrict the processing of your data in certain circumstances, including while a correction request is being verified, or while an objection is being considered.

9.5 Right to Data Portability

You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format (such as CSV or JSON), and to transmit that data to another service provider where technically feasible. To request a data export, contact support@wavset.app.

9.6 Right to Object

You have the right to object to the processing of your personal data where we rely on legitimate interest as our lawful basis. We will consider your objection and cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

9.7 Right to Withdraw Consent

Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.

9.8 Right to Lodge a Complaint

If you believe that Dyalect has violated your data protection rights, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC):

We encourage you to contact us first at info@dyalectstudio.com so that we can attempt to resolve any concerns before you approach the NDPC.

10. Cookies and Tracking

wavset uses only the cookies and local storage that are strictly necessary to operate the Platform, including:

• Session authentication cookies, to keep you logged in to your account;
• Security cookies, to prevent cross-site request forgery and other security threats.

We do not use advertising cookies, third-party tracking cookies, or cookies that build behavioural profiles for marketing purposes. We do not share cookie data with advertising networks.

You may configure your browser to reject or delete cookies, but note that disabling session cookies will prevent you from accessing your account.

11. Children's Privacy

The wavset Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If you believe that we have inadvertently collected data from a person under 18, please contact support@wavset.app and we will promptly delete that data.

12. Aggregated and Anonymised Data

Dyalect may derive anonymised, aggregated, non-identifiable insights from the Platform (for example, general trends in music income categories across all users). This aggregated data does not identify any individual artist. Dyalect may use such aggregated data for:

• Internal product development and feature prioritisation;
• Published insight reports about the independent music economy in Africa (for example, average income splits across income categories).

No individual artist is identifiable in any aggregated data. Aggregated data is not personal data under the NDPA and is not subject to the rights set out in Section 9.

13. Changes to This Privacy Policy

Dyalect may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or Platform features. Where changes are material, we will notify you by email to your registered address at least fourteen (14) days before the changes take effect. We will also update the "Effective Date" at the top of this document.

We encourage you to review this Privacy Policy periodically. The current version will always be available at wavset.co/legal/privacy. Continued use of the Platform after the effective date of an updated Privacy Policy constitutes acceptance of the revised terms.

14. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact:

We are committed to responding to all privacy requests promptly and in accordance with our obligations under the Nigeria Data Protection Act 2023.