Who controls your data
GospelMaker (gospelmaker.com) is an AI-assisted Christian teaching and media studio operated from Lagos, Nigeria. The operator of gospelmaker.com is the data controller for the personal data described here and can be reached at support@gospelmaker.com. This policy is written to meet the Nigeria Data Protection Act 2023 (NDPA) and, for users in the UK and EEA, the UK GDPR and EU GDPR.
What we collect
Account data: email address, display name, country and language.
Project content: the briefs, documents and edits you create, and the projects and folders you organise them into.
Media: images, audio and video files you upload or generate, stored in private storage buckets tied to your account.
Credit & payment records: your credit balance and transaction history, and records of payments and refunds (not your card details — see "Payments" below).
Who processes it (our sub-processors)
Supabase / Lovable Cloud — our database, authentication and file storage provider. It holds your account, project and media data.
Lovable AI Gateway and the underlying model providers — receive the prompt text (and, for image/audio jobs, the relevant prompt content) needed to generate the specific thing you asked for. They do not receive your password, payment details or account admin data.
Paystack — processes payments. Paystack handles your card and payment details directly; GospelMaker never receives or stores your full card number.
Email provider — not yet configured. Until it is, GospelMaker does not send transactional email through a third-party sender; this page will be updated once one is connected.
Data minimisation for AI generations
Only the text actually needed to fulfil the specific generation you requested is sent to an AI provider — for example, your brief and any Bible reference you supply. Your password, payment details, authentication tokens and administrative account data are never sent to an AI provider.
Product analytics
We keep first-party usage analytics (like which features are used and how often) in our own database. We do not use third-party trackers or ad pixels, we do not log your IP address for analytics, and we do not include your prompt content in analytics records.
Retention
We keep your account and project data for as long as your account is open, plus a limited period after deletion to handle support, fraud and legal obligations. Credit and payment transaction records are kept for accounting and dispute-resolution purposes.
Why we are allowed to use it (legal bases)
Performance of a contract: creating your account, storing your projects and media, running the generations you request, and handling credits and payments.
Legitimate interests: keeping the platform secure, preventing abuse and credit-limit circumvention, and understanding first-party product usage so we can improve the service.
Legal obligation: keeping payment, tax and dispute records for the period the law requires.
Consent: optional communications and any future feature that asks for it. You can withdraw consent at any time without affecting processing already carried out.
Your rights
You can review and correct your profile details, and request deletion of your account and data, from Settings. Account deletion runs on a 14-day cooling-off period, after which your data is purged apart from records we must keep for accounting or fraud purposes.
Under the NDPA and the UK/EU GDPR you may also request access to your data, a portable copy, restriction of processing, or object to processing based on legitimate interests. Email support@gospelmaker.com and we will respond within 30 days.
If you believe we have handled your data wrongly, you can complain to the Nigeria Data Protection Commission, or — if you are in the UK or EEA — to your national supervisory authority (for example, the UK Information Commissioner's Office).
Security
Data is stored in access-controlled databases with row-level security so one account cannot read another's data, media lives in private storage buckets, and payment card details never reach our systems. No system is perfectly secure; if a breach affects your personal data we will notify you and the relevant regulator as required by law.
International transfers
Our processors operate infrastructure in multiple countries, so your data may be processed outside the country you live in. We choose processors that offer appropriate safeguards for the type of data involved.
Children
GospelMaker is not directed at children and is not knowingly used to collect data from children under the age required by local law to consent to data processing. If you believe a child has created an account, contact us and we will remove it.
Provider rights notice
See our Terms of Service and AI Disclaimer for how AI provider terms affect the content you generate, separate from how we handle your personal data.
Contact
Privacy questions or requests: support@gospelmaker.com.