Vision2Reality (“Vision2Reality”, “we”, “us” or “our”) is committed to protecting your personal data in accordance with the Nigeria Data Protection Act 2023 (“NDPA”), the Nigeria Data Protection Regulation 2019 (“NDPR”) to the extent it remains applicable, the General Application and Implementation Directive issued by the Nigeria Data Protection Commission (“NDPC”) and, for users in the European Economic Area (“EEA”) and the United Kingdom, Regulation (EU) 2016/679 (the “GDPR”), the UK GDPR and the Data Protection Act 2018.
This Privacy Policy explains how we collect, use, store, share and protect your personal data when you use:
The Services let you enter a prompt and generate a personalised immersive experience (a 360° panoramic image, ambient audio and video), which is delivered to your VR device through the paired Mobile App.
By creating an account and using the Services you confirm that you have read this Privacy Policy. Where we rely on your consent, we will ask for it separately and you may withdraw it at any time.
| Item | Details |
|---|---|
| Data controller | VISION TO REALITY INTERNATIONAL LTD |
| Registered address | HOUSE 8, MANOR CLOSE, BOUIDLONE COURT, CHEVRON DRIVE, LAGOS STATE, NIGERIA |
| Contact email | ANITAIBHAKHOMU@YAHOO.COM |
| Data Protection Officer | ANITA IBHAKHOMU Vizion2realities@gmail.com |
We collect only the data needed to run the Services. It falls into the categories below.
| Category | Examples | Stored in |
|---|---|---|
| Account information | Email address, first name, last name, optional profile picture | Amazon Cognito, Amazon S3 |
| Authentication information | Password (held only as a cryptographic hash, never in plain text), hash of your previous password to prevent reuse, access token | Amazon Cognito, Amazon DynamoDB |
| Content you provide | Text prompts, questionnaire or input responses, optional reference photograph | Amazon DynamoDB, Amazon S3 |
| Generated content | Panoramic image, ambient audio, video, raw prompt, generation metadata (state, progress, stage, stop reason, cancel-request status) | Amazon S3, Amazon DynamoDB |
| Session and usage information | User ID, session ID, login and logout times, session start time, session duration, pause status and duration, session count, streak information | Amazon DynamoDB |
| Device and connectivity information | Device ID, device information, Firebase Cloud Messaging (FCM) token, Bluetooth address, IP address, mobile and VR connection status and heartbeat | Amazon DynamoDB |
| Notification information | Notification status, scheduled notifications, delivery, open and failure timestamps | Amazon DynamoDB |
| Technical records | Record creation and update timestamps | Amazon DynamoDB |
On your phone we keep the minimum needed: your authentication token (in the iOS Keychain or Android Keystore), your user ID, app preferences, playback state and cached experience files. We do not store your password on your device.
We do not collect precise location (GPS), contacts, SMS or call history, payment card or bank details, biometric templates, health records or advertising profiles. If we introduce any of these in future, we will update this Policy first and ask for your consent where required.
We do not intentionally collect sensitive personal data as defined in the NDPA, or special category data under Article 9 GDPR (for example health, religious or political information, genetic or biometric data used for identification). Please do not include such data, or other people’s personal data, in prompts, and do not upload photographs of other people without their permission. A reference photograph you upload is used only in the content-generation workflow and not to identify you.
We process personal data only where one of the lawful bases in the NDPA applies.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Registering you, authenticating you and maintaining logged-in sessions | Account, authentication, session and device information | Performance of a contract |
| Processing your prompts and generating panoramas, audio and video; delivering them to the Mobile App and VR App | Prompts, generated content, generation metadata | Performance of a contract |
| Tracking generation progress, pairing your phone with your VR device and keeping sessions in sync | Device, connectivity and session information | Performance of a contract |
| Service notifications about your generation requests | FCM token, device ID, notification information | Performance of a contract |
| Optional reminders and promotional notifications | FCM token, notification information | Consent |
| Using an optional reference photograph or profile picture | Uploaded images | Consent |
| Usage statistics, session counts and streaks; improving the Services | Session and usage information | Legitimate interests |
| Security monitoring, fraud prevention, troubleshooting and technical support | Session, device, connectivity and technical records | Legitimate interests |
| Complying with Nigerian law and establishing or defending legal claims | Any data reasonably required | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we have assessed that they are not overridden by your fundamental rights and freedoms.
For users in the EEA and the UK, these bases correspond to Article 6(1)(b) (contract), 6(1)(a) (consent), 6(1)(f) (legitimate interests) and 6(1)(c) (legal obligation) of the GDPR, and consent meets the conditions of Article 7.
Where we rely on consent, it will be freely given, specific, informed and unambiguous, and recorded by us. We do not use pre-ticked boxes and we do not make the Services conditional on consent to processing that is not necessary for them. You may withdraw consent at any time in the Mobile App settings or by contacting us. Withdrawal does not affect processing carried out before it.
Your prompts, and your reference photograph if you provide one, are processed by automated AI and media-generation services to create your experience. Outputs are produced automatically and may be inaccurate or unexpected.
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects (Article 22 GDPR).
| Recipient | Role | Purpose |
|---|---|---|
| Amazon Web Services (Cognito, DynamoDB, S3) | Data processor | Identity and authentication, application data, storage of uploaded and generated media |
| Google Firebase Cloud Messaging | Data processor | Delivering push notifications to your device |
| AI and media-generation service providers | Data processor | Generating panoramas, audio and video from your prompts |
| Software development, hosting and support providers | Data processor | Maintaining and supporting the Services under confidentiality obligations |
| Courts, the NDPC, regulators, law enforcement and professional advisers | Independent controller | Where required by law or to protect legal rights |
| A buyer or successor business | Independent controller | In a merger, acquisition or sale of assets, on notice to you |
Processors act only on our written instructions under a data processing agreement that requires confidentiality, security and compliance with the NDPA and, where the GDPR applies, Article 28 GDPR. We do not sell your personal data and we do not share it for third-party advertising.
Our cloud infrastructure is hosted in some region and some providers (such as Google Firebase) may process data in other countries. We transfer personal data outside Nigeria only where:
For personal data of users in the EEA or the UK that is transferred outside those regions (including to Nigeria and the United States), we rely on an adequacy decision (including the EU–US Data Privacy Framework where the recipient participates), Standard Contractual Clauses approved by the European Commission or the UK International Data Transfer Addendum, with supplementary measures where needed, or another safeguard or derogation under Chapter V GDPR. You may request details of the safeguards by contacting us.
We keep personal data only as long as necessary for the purposes above, or as the law requires.
| Data | Retention |
|---|---|
| Active session record (access token, device information, FCM token) | Deleted when you log out; automatically expires after 24 hours in any event |
| Account and profile information, password hashes | While your account remains active; deleted within 30 days of account closure |
| Prompts, reference photograph, generated panoramas, audio, video and generation metadata | One Month from creation, or until you delete them or close your account, if earlier |
| Raw and temporary generation files | Removed once no longer needed by the generation workflow within 7 days |
| Device pairing, connectivity and notification records | 7 days |
| Session statistics | While your account is active, then deleted or anonymised |
| Backups | Overwritten within 7 days |
| Records we must keep by law or for legal claims | For the period the law requires |
When the retention period ends we delete the data or irreversibly anonymise it.
We use appropriate technical and organisational measures to protect your personal data, including authentication through Amazon Cognito, hashed passwords, authenticated API access, access-controlled cloud storage, time-limited access links for generated media, session expiry, secure storage of tokens on your device (iOS Keychain and Android Keystore) and encrypted communication between system components.
If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the NDPC and, where the GDPR applies, the competent EU or UK supervisory authority within 72 hours of becoming aware of it and, where the risk is high, tell you without undue delay and in plain language. No system is completely secure, so please keep your login credentials confidential.
You have the right to:
To exercise a right, contact us using the details in section 15. We may ask you to verify your identity. We will respond within one month, which we may extend by up to two further months for complex or numerous requests, and we will tell you if we do. Under the GDPR these rights are set out in Articles 7(3) and 15 to 22.
You also have the right to lodge a complaint with the Nigeria Data Protection Commission (ndpc.gov.ng) and to seek a judicial remedy. If the GDPR applies to you, you may also complain to the supervisory authority in the EU Member State where you live, work or where the alleged infringement occurred, or, in the UK, to the Information Commissioner’s Office (ico.org.uk). We would appreciate the chance to address your concern first.
The Services are intended for people aged 18 and over. The NDPA treats a person under 14 as a child and requires verifiable parental or guardian consent for processing a child’s data. We do not knowingly collect personal data from children and will delete it promptly if we learn that we have. A parent or guardian who believes their child has provided data should contact us.
The Mobile App and VR App do not use advertising cookies or cross-app tracking. They store only the local data described in section 3.
We may update this Policy from time to time. We will post the updated version in the Mobile App and, for material changes, notify you by in-app message or email before they take effect. The effective date of the latest version appears at the end of this Policy.
For questions, to exercise your rights or to make a complaint, contact our privacy team: