Privacy policy

You give us:

• Account info — email, username, and (optionally) display name and profile picture.
• List content — the links, titles, descriptions, and images you add to your lists.
• Payout details (creators of paid lists only) — your bank, NUBAN, and verified account-holder name. We pass these to our payment partner; we don’t store your full bank credentials.
• Anything else you send us — e.g. emails to support.

We collect automatically:

• Basic request data — IP address, browser type, pages viewed, timestamps. Used to operate the Service and prevent abuse.
• A session cookie (kurlio_sid) — an anonymous identifier used to count list views without double-counting the same visitor. It doesn’t identify you personally.
• Auth cookies — set by Supabase to keep you signed in.

From third parties:

• Payment partner — when you buy or sell a paid list, our payment provider tells us the transaction succeeded, the amount, and a transaction reference. We don’t see or store your card number.

• Run and improve the Service.
• Authenticate you and keep your account secure.
• Process payments and pay creators.
• Detect fraud, abuse, and violations of our Terms.
• Respond to support requests.
• Comply with legal obligations.

We don’t sell your personal data. We don’t run ads on Kurlio.

By design, your profile, public lists, and the links and descriptions inside them are visible to anyone on the internet. Your email, payout details, private lists, and saved lists are not.

• Supabase — our database, auth, and file storage provider.
• Our payment partner — to process purchases and pay out creators.
• Hosting and infrastructure providers — to serve the site.
• Law enforcement or regulators — when legally required.

Our database is hosted in the EU (Ireland). Your data may be transferred to and processed in countries outside Nigeria, including for payment processing and email delivery. We rely on appropriate safeguards under applicable law for these transfers.

• Account data — for as long as your account is active.
• Public list content — until you delete it or delete your account.
• Transaction records — kept for at least 7 years to meet tax and accounting obligations.
• Logs — typically 30–90 days.

When you delete your account, we delete or anonymise your personal data within 30 days, except where we’re required to keep it (e.g., financial records).

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your account and associated data.
• Object to or restrict certain processing.
• Receive a copy of your data in a portable format.

Email jide.fabanwo@gmail.com to exercise any of these. We may need to verify your identity first.

Kurlio is not intended for children under 13. If you believe a child has given us personal data, email jide.fabanwo@gmail.comand we’ll delete it.

We use HTTPS, encrypted storage at rest, row-level access controls in our database, and least-privilege access for staff and tooling. No system is perfectly secure — if you spot a vulnerability, please email jide.fabanwo@gmail.com before disclosing publicly.

If we make material changes, we’ll notify you by email or in-app at least 14 days before they take effect.

For anything privacy-related: jide.fabanwo@gmail.com.