Privacy Policy

ScholarsCrib is an online learning service that helps Nigerian students prepare for school and exams such as WAEC, NECO and JAMB. In this policy, “we”, “us” and “ScholarsCrib” means ScholarsCrib, of 10b Falola Close, Oke-Yidi, Abeokuta, Ogun State, Nigeria.

We are the data controller for the personal data described here. This policy follows the Nigeria Data Protection Act 2023 (the “NDPA”) and the directives of the Nigeria Data Protection Commission (the “NDPC”).

For any question about your personal data, or to use your rights, contact us at privacy@scholarscrib.com.

You give us:

• Account details: first and last name, email address, phone number, and a password (we store only a hashed version, never the password itself).
• Profile details: class level, exam track, state, school, and an optional profile picture.
• Messages you send to our AI tutor and details you send us when you contact support.

Created as you learn:

• Answers to practice questions, scores, weak areas, flashcard reviews, study plans, streaks, points and achievements.
• Lessons and materials you open, and notes you make.

Collected automatically:

• Device and sign-in information: a device label, the time you were last active, IP address, browser type, and session records used to enforce the device limit in our terms.
• A push-notification subscription, only if you turn notifications on.

From third parties: if you sign in with Google, we receive your name, email address and profile picture from Google. When you pay, Paystack tells us whether the payment succeeded. We do not see or store your card or bank details.

We do not intentionally collect “sensitive personal data” as the NDPA defines it (for example health, religion, ethnic origin or biometric data). Please do not put it in tutor messages or support requests.

The NDPA requires a lawful basis for each use of personal data. Ours are:

• Contract — to create your account, sign you in, deliver lessons, practice and study plans, and process payments for paid plans.
• Consent — for optional things such as push notifications, marketing messages, and any use of a child’s data where a parent or guardian’s consent is needed. You can withdraw consent at any time (see section 9).
• Legitimate interests — to keep the service secure, prevent account sharing and abuse, fix bugs, and understand and improve how ScholarsCrib is used, where this does not override your rights and freedoms.
• Legal obligation — to keep financial records and respond to lawful requests from Nigerian authorities.

We use your learning data to personalise what you see, such as which questions come next and when topics are due for review. This personalisation does not make decisions with legal or similarly significant effects on you.

We do not sell your personal data.

Many of our students are under 18. Under the NDPA, we need the consent of a parent or legal guardian to process a child’s personal data, and we must take reasonable steps to verify that consent.

If you are under 18, please ask a parent or guardian to read this policy and approve your account. We record that approval when you register. We may ask for further confirmation, and may suspend an account if we cannot confirm it.

We do not use children’s data for advertising or profiling for marketing. We collect only what we need to teach them. A parent or guardian can ask to see, correct or delete their child’s data at any time using the contact details in section 12.

We share personal data only with service providers (“processors”) who handle it on our instructions under written agreements, and only as needed for the purpose:

• Paystack — payment processing.
• Google — optional “Sign in with Google”.
• Cloudinary — storing profile pictures and study images.
• Cloud hosting and database providers — running the app and storing data.
• Upstash — rate limiting and caching to protect the service.
• AI and search providers — to power the AI tutor. Your tutor messages and the study context needed to answer them are sent to language-model providers (such as OpenAI, Anthropic or Google), and to our vector-search and monitoring services. We do not send your name, email or phone number for this purpose.
• Messaging providers — to send emails, SMS and push notifications.

We may also disclose data where the law requires it, to protect someone’s safety, or in a sale or restructuring of our business (in which case this policy will continue to protect your data).

Some of our providers store or process data outside Nigeria. We transfer personal data abroad only where the NDPA allows it: where the destination is covered by an adequacy decision from the NDPC, or where we have appropriate safeguards in place (such as standard contractual clauses), or another lawful ground under the NDPA applies. You can ask us for details of the safeguards for a particular transfer.

• Account and learning data: while your account is open, and for up to [12] months after it closes, so you can come back, then deleted or anonymised.
• Payment records: [6] years, to meet tax and accounting obligations.
• AI tutor conversations: [12] months, or until you delete them.
• Security and sign-in logs: up to [12] months.
• Support requests: [24] months after they are resolved.

We may keep anonymised data that can no longer identify you, for example to measure how well lessons work.

We use encryption in transit, hashed passwords, access controls that limit staff to what they need, separate admin authentication, rate limiting, and regular backups. No online service is perfectly secure, so please also keep your password private.

If a breach is likely to put your rights and freedoms at risk, we will notify the NDPC within 72 hours of becoming aware of it. If it is likely to cause you a high risk of harm, we will tell you directly and without undue delay, explaining what happened and what you can do.

Under the NDPA you have the right to:

• be informed about how we use your data (this policy);
• access the personal data we hold about you and get a copy;
• have inaccurate or incomplete data corrected;
• have your data erased where we no longer need it or you withdraw consent;
• restrict how we use your data in certain cases;
• receive your data in a structured, commonly used, machine-readable format and have it sent to another controller (portability);
• object to processing based on legitimate interests, and to direct marketing at any time;
• not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you, and ask for a person to review such a decision;
• withdraw consent at any time. This does not affect processing done before you withdrew it.

To use any of these rights, email privacy@scholarscrib.com. We may need to confirm who you are first. We will respond within one month. We do not charge a fee unless a request is clearly unfounded or excessive. You can change most profile details and notification settings yourself in Settings.

We use cookies and local storage that are strictly necessary to keep you signed in, protect your account and remember your preferences. If we add analytics or advertising cookies, we will ask for your consent first.

ScholarsCrib can be installed as an app on your device and can work offline. It stores some lessons and settings on your device for this. You can clear this in your browser settings.

We would like the chance to fix any concern first, so please contact us. You also have the right to lodge a complaint with the Nigeria Data Protection Commission at ndpc.gov.ng, and to seek a judicial remedy.

We may update this policy. When we make an important change we will tell you in the app or by email before it takes effect, and will ask for your consent again where the law requires it.

Questions about this policy or your data? Email privacy@scholarscrib.com or contact us.