Privacy Policy

1. Information We Collect

We collect several types of information to provide and improve our services:

1.1 Personal Information You Provide

• Account Information: Username, email address, device ID (automatically generated), and display name.
• Profile Information: Full name, email address, phone number (optional, can be updated in the Account page).
• Payment Information: Transaction details for license, material, or wallet purchases processed securely through our payment partners. We do not store full payment card details on our servers.
• Communications: When you contact our support team via chat, WhatsApp, email, or in-app messaging, we collect the content of those messages and your contact information.
• User-Generated Content: When you participate in our Q&A forum, in-app chat features, or learning community, we collect the questions, answers, comments, and messages you post.
• School-Managed Records (via MySchoolPlus): Student names, dates of birth, class levels, guardian contacts, enrollment history, academic records, fee/payment history, and staff records — entered by schools into the School Management System.
• Attendance Data (via ATPass): Attendance records captured via QR code scan or manual entry, linked to student or staff identities.
• Digital Credentials Data: Certificate issuance details, unique credential IDs, and QR verification records.
• AI Inputs: Topics, subtopics, and prompts entered into the AI Teaching Assistant, AI Lesson Plan Generator, or AI CBT Question Generator.
• Payroll Data: Staff salary, allowances, deductions, and payroll records entered by school administrators.
• Parental Consent Records: Confirmation that a parent or guardian has given verifiable consent for a minor to use the platform — collected directly by Edusaint for direct users of EduSaint Learn and Practice, or collected by the school for students enrolled through the EduSaint School Management System.

1.2 Information Automatically Collected

• Device Information: Device ID, device model, manufacturer, operating system version, and unique device identifiers (Android ID on Android, Windows hardware ID on Windows).
• Usage Data: Exam results, practice session data, answer selections, accuracy rates, test completion statistics, and materials accessed.
• License Information: License key, activation status, bound device, purchase date, and expiry date.
• IP Address and Network Information: IP address, connection type (WiFi/Cellular), and network provider.
• App Version and Platform: Version of the app you are using and your platform (Android/Windows).
• Push Notification Tokens: Device tokens used to send you important updates about your account, license, or practice progress.
• AI Usage Data: Prompts submitted to AI features, generation history, and feedback on generated content.
• Credential Verification Logs: Timestamps and device information of certificate or credential verifications.

1.3 Offline Data Storage

• Local Database: Practice sessions, answers, exam history, and user data are stored locally on your device using SQLite.
• Secure Storage: Authentication tokens are stored securely using encrypted local storage.
• Downloaded Materials: Study materials and question images downloaded for offline use are stored on your device.

1.4 App Permissions

The EduSaint CBT Prep app requests the following device permissions, each used solely for the stated purpose:

• Internet Access: To communicate with our servers for account authentication, license verification, content downloads, and payments.
• Network State: To detect whether your device is online so the app can switch between online and offline modes gracefully.

We do not request access to your camera, microphone, contacts, precise location, SMS, call logs, photo gallery, or biometric sensors.

2. How We Use Your Information

We use your information for the following purposes:

• Account Management: Create and manage your account, authenticate your identity, and provide customer support. For minors, this includes verifying that parental or guardian consent has been obtained — directly by Edusaint for Learn and Practice users, or by the school for school-managed students.
• License Management: Process license purchases, activate licenses on your device, and verify license status.
• Service Delivery: Provide CBT practice exams, syllabus content, past questions, and study materials; track performance; generate statistics; and offer personalized recommendations.
• Community Features: Enable the Q&A forum, group chat, learning community, and support messaging between users and our team.
• Offline Functionality: Enable offline access to downloaded study materials and practice sessions.
• Payment Processing: Securely process payments through our payment partners for license, material, and wallet purchases.
• Service Notifications: Send transactional notifications only — license status, account changes, payment receipts, security alerts, practice reminders, and important service updates. We do not send marketing or promotional messages.
• Analytics and Improvements: Analyze usage patterns to improve app performance, fix bugs, and enhance user experience.
• Legal Compliance: Comply with applicable laws, regulations, and legal processes.
• Security: Detect, prevent, and address technical issues or fraudulent activities.
• School Administration: Enable schools to manage student enrollment, results, fees, attendance, timetables, payroll, communications, online classes, and other administrative functions as described in Section 16.
• AI-Assisted Teaching: Generate lesson plans, lesson notes, CBT questions, and student comments using the EduSaint AI Teaching Assistant.
• Attendance Management: Record, track, and report student and staff attendance via ATPass Attendance using QR code and manual methods.
• Digital Credentials: Issue, verify, and store digital certificates and credentials via EduSaint Credentials.
• Payroll Processing: Calculate and manage staff salaries, allowances, and deductions via EduSaint Payroll.
• Digital Wallet & Fees: Process school fee payments, wallet top-ups, and payment records.
• Education Analytics: Generate academic, financial, and operational reports via EduSaint Insight.
• Online Classes & Communication: Support online teaching, class discussions, and communication among administrators, teachers, students, and parents via SMS, email, and chat.

3. Legal Basis for Processing

We process your personal information based on one or more of the following legal grounds:

• Contractual Necessity: To provide our services and fulfill our agreement with you.
• Legitimate Interests: To improve our services, prevent fraud, and ensure security.
• Legal Obligations: To comply with applicable laws and regulations.
• Consent: When you (or, for a minor, your parent or guardian) have provided explicit consent for specific purposes, such as push notifications. For minors, consent is obtained through one of two paths:
  • Direct users of EduSaint Learn and Practice: the parent or guardian gives verifiable consent directly to Edusaint during signup.
  • School-managed students via EduSaint School Management System: the school obtains consent from the parent or guardian as part of enrollment, and Edusaint relies on that consent as a data processor.

4. Information Sharing and Disclosure

We do not sell your personal information. We may share your information in the following limited circumstances:

• Payment Providers: Transaction details are shared with our payment processors (Flutterwave and, where applicable, Paystack) to complete purchases.
• Hosting and Infrastructure: Our servers are hosted on cloud infrastructure providers who process data on our behalf under contractual data protection obligations.
• License Verification: License status is verified with our server to ensure compliance with license terms.
• Push Notification Providers: Device push tokens are shared with notification infrastructure to deliver service notifications.
• AI Service Providers: Prompts submitted to AI features may be processed by third-party AI model providers solely to generate the requested output. These providers are bound by data processing agreements.
• Payment Partners (Wallet & Fees): Fee and wallet transactions are processed through Flutterwave and Paystack.
• Communication Gateways: SMS and email notifications are delivered through third-party gateways.
• Credential Verification Partners: Credential verification data may be shared with third parties when a certificate is verified via QR code or unique ID.
• Legal Requirements: When required by law, court order, or government regulation.
• Business Transfers: In connection with a merger, acquisition, or sale of assets.
• Protection of Rights: To protect the rights, property, or safety of Edusaint, our users, or the public.
• With Your Consent: When you (or, for minors, your parent or guardian) have explicitly consented to the sharing.

4.5 Law Enforcement and Government Requests

We respond to law enforcement or government requests for personal data only when we are legally compelled to do so by Nigerian law or the law of a jurisdiction with valid authority. Before disclosing data, we:

• Verify the request is legally valid and properly scoped.
• Attempt to redirect overly broad requests to a narrower scope.
• Where legally permitted, notify the affected user or their parent/guardian before disclosure.
• Publish aggregated transparency data about such requests where possible.

5. Data Security

We implement industry-standard security measures to protect your information:

• Encryption: Data transmitted between your device and our servers is encrypted using SSL/TLS technology.
• Secure Storage: Authentication tokens are stored using encrypted local storage on your device.
• Password Hashing: Account passwords are hashed on the server using strong, industry-standard hashing algorithms.
• Access Controls: Strict access controls limit who can access user data.
• Regular Audits: We regularly review our security practices and update them as needed.
• Offline Data Protection: Your local data is protected by your device's built-in security features.

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security.

5.5 Data Protection Impact Assessments

We carry out Data Protection Impact Assessments (DPIAs) before commencing any high-risk processing activity — including AI-assisted teaching tools and any new integration between EduSaint Learn and Practice and EduSaint School Management System. DPIAs identify and mitigate risks to data subjects and are reviewed annually.

6. Data Retention

We retain your personal information as follows:

• Account Information: As long as your account is active or as needed to provide services.
• Practice Data: Retained to track your progress and provide performance analytics.
• License Information: Retained for the duration of your license plus a reasonable period afterward for legal and tax purposes.
• Payment Records: Retained for 7 years to comply with financial regulations and tax laws.
• User-Generated Content: Forum posts, chat messages, and support conversations are retained while your account is active. Removed within 30 days of account deletion, unless required for legal purposes.
• Parental Consent Records: Retained for as long as the minor's account remains active, plus 2 years afterward, in case of regulatory audit.
• Deleted Accounts: When you or your parent/guardian request account deletion, we will remove your personal information within 30 days, except where retention is required by law.

7. Your Rights and Choices

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal information.
• Correction: Update or correct inaccurate information in your account.
• Deletion: Request deletion of your account and personal information (see Section 7.1 below for the step-by-step process).
• Portability: Receive your data in a structured, machine-readable format.
• Restriction / Objection: Request that we restrict or object to certain processing.
• Opt-Out: Opt out of certain data collection, such as push notifications or analytics.
• Withdraw Consent: Withdraw your consent (or, for minors, withdraw parental consent) for processing where applicable.
• Lodge a Complaint: File a complaint with the Nigeria Data Protection Commission (NDPC) or your local data protection authority.

7.1 Account Deletion (EduSaint Learn and Practice)

You (or, for minors, your parent or guardian) can request deletion of your EduSaint Learn and Practice account (the account used in the EduSaint CBT Prep app) and all associated data at any time. There are two ways to request deletion:

Option 1: In-App Request

1. Open the EduSaint CBT Prep app (part of EduSaint Learn and Practice).
2. Navigate to Account from the sidebar or home menu.
3. Scroll to the Data Removal section.
4. Tap "Request Removal via WhatsApp".
5. Send the pre-filled message to our support team. Your request is logged and processed within 24 hours.

Option 2: Web Request

Visit https://edusaint.ng/account-deletion and follow the instructions to submit a deletion request from any browser, without needing to install or open the app. You can also email privacy@edusaint.ng with "Account Deletion Request" in the subject line.

What Will Be Deleted

• Your account profile (name, username, email, phone number).
• Your practice sessions, exam results, and performance history.
• Your forum posts, chat messages, and support conversations.
• Your device binding and license association.
• Local app data on your device (when you uninstall or clear data after deletion).

What Will Be Retained

• Anonymized usage statistics (aggregated, no longer linked to you).
• Transaction records retained for 7 years to comply with Nigerian financial regulations.
• Data required by law or needed to resolve open disputes.

Note: Deleting an EduSaint Learn and Practice account does not delete the same person's record in an institution's EduSaint School Management System. That data is owned by the school — see Section 16.6 for how to request deletion of school-managed records.

7.2 Consent Withdrawal (Including Parental Consent)

Where we rely on your consent (or parental consent for a minor) to process data, you can withdraw it at any time. Withdrawal is as simple as giving consent, and can be done through:

• In-app settings: toggle push notifications and analytics off in the Account page.
• Written request: email privacy@edusaint.ng with "Withdraw Consent" in the subject line.
• Parental withdrawal: a parent or guardian may withdraw consent for a minor by contacting us using the same email address they used to give consent.

Withdrawing consent does not affect the lawfulness of processing that already took place before withdrawal, and does not affect processing based on other legal grounds (e.g., contractual necessity for your account).

7.3 Data Subject Access Request Timelines

We respond to data subject access requests (access, correction, deletion, portability) within one calendar month of receipt, in accordance with the Nigeria Data Protection Act 2023. Complex requests may be extended by up to two further months, and we will inform you of any such extension within the first month.

8. Children's Privacy

EduSaint products are used by secondary school students, some of whom are minors. Parents and guardians give consent for their children to use the platform. Our practices differ depending on how a student accesses the platform:

8.1 Direct Users — EduSaint Learn and Practice

When a student signs up for EduSaint Learn and Practice (including the EduSaint CBT Prep app) independently — without their school providing the account — the parent or guardian gives consent directly to Edusaint:

• Verifiable parental consent: During signup for a minor account, we collect verifiable parental or guardian consent as required by the Nigeria Data Protection Act 2023 (Section 31) and COPPA. Verification is done through email confirmation sent to the parent/guardian, or in-person verification arranged by our team where email is not available.
• Parent/guardian account: The parent or guardian of record is associated with the minor's account and can view, correct, or delete the minor's data.
• Withdrawal: Parents and guardians may withdraw consent at any time (see Section 7.2).

8.2 School-Managed Students — EduSaint School Management System

When a student is enrolled in a school that uses the EduSaint School Management System (MySchoolPlus, ATPass Attendance, EduSaint CBT, etc.), the school — not Edusaint — is responsible for obtaining parental consent:

• The school obtains parental consent from the parent or guardian as part of the student's enrollment in the school and its digital systems. The school is the data controller for these records.
• Edusaint relies on the school's consent record. We process the student's data as a data processor based on the school's instruction and the school's collection of parental consent.
• Parental rights through the school: Parents and guardians should direct access, correction, and deletion requests to their child's school in the first instance. If the school is unable to resolve the request, contact us at privacy@edusaint.ng and we will assist (see Section 16.6).

8.3 Under US Law (COPPA)

• For US users under 13 (whether direct users or school-managed), we comply with COPPA and only collect minimal personal information (username, device ID, academic records).
• Verifiable parental consent is obtained before collection — by Edusaint directly for Learn and Practice users, or by the school for school-managed students.

8.4 Practices Applicable to All Children

• No Advertising Identifiers: We do not collect or use the Android Advertising ID (AAID) or similar persistent identifiers from children.
• No Third-Party Ads: We do not serve third-party advertising to children.
• No Marketing: We do not send marketing or promotional messages to children or to their parents about the child's account.
• No Behavioural Profiling: We do not use children's data for profiling or automated decision-making beyond the practice-score tracking that is essential to the service.
• Limited Sharing: We do not share children's personal information with third parties except as necessary to provide our services (payment processors, hosting) or with the school that manages the child's account.
• Parental Access: Parents and guardians may request access to, correction of, or deletion of their child's information by emailing privacy@edusaint.ng.

If you believe we have collected information from a child without proper consent, please contact us immediately at privacy@edusaint.ng and we will investigate and, where appropriate, delete the data within 7 days.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your own, including through our cloud hosting and payment partners. These countries may have data protection laws different from your country. We take appropriate safeguards to ensure your data is protected, including using standard contractual clauses approved by relevant authorities.

10. Third-Party Services

Our platform integrates with the following third-party services:

• Flutterwave: Processes payments for license, material, and wallet purchases. See Flutterwave's Privacy Policy.
• Paystack (where applicable): Alternative payment processor for certain transactions. See Paystack's Privacy Policy.
• Google Play Store: For app distribution and updates. See Google's Privacy Policy.
• Push Notification Infrastructure: For delivering service notifications to your device.
• Cloud Hosting Provider: For server-side storage and processing.
• WebView: Opens edusaint.ng pages inside the app for study material access.
• AI Model Providers: For generating lesson plans, notes, CBT questions, and student comments.
• Email and SMS Gateways: For service notifications and school-to-parent communication.
• WhatsApp (Meta): When you tap "Request Removal via WhatsApp" in the Account page, WhatsApp opens externally and Meta's privacy policy applies to that interaction. See WhatsApp's Privacy Policy.

These third-party services have their own privacy policies, and we encourage you to review them.

11. Cookies and Tracking Technologies

EduSaint Learn and Practice, including the EduSaint CBT Prep app, does not use cookies directly. However, our website (edusaint.ng) and the EduSaint School Management System web platform use cookies. We use four categories of cookies:

• Strictly necessary cookies: Required for login sessions and security. These are set automatically and cannot be disabled while using the platform.
• Preference cookies: Remember your language and UI settings. You can disable these in your browser.
• Analytics cookies: Help us understand how the platform is used. These are only set with your consent via the cookie banner.
• Marketing cookies: Used to measure the effectiveness of our campaigns. These are only set with your consent.

On your first visit to the website, you will see a cookie consent banner where you can accept all cookies, reject non-essential cookies, or customize your preferences per category. You can change your cookie preferences at any time via the "Cookie Settings" link in the website footer, or by clearing cookies in your browser.

12. Offline-First Architecture (EduSaint Learn and Practice)

EduSaint Learn and Practice — including the EduSaint CBT Prep app — is designed as an offline-first platform. This means:

• Your practice data is stored locally on your device by default.
• You can use the app without an internet connection after initial download.
• Your data is transmitted to our servers only when you: add an email address to your account, purchase a license, sync your progress, use community features, or request account deletion.
• This design minimizes the amount of personal data transmitted over the internet.

12.5 AI-Assisted Features — Transparency

The EduSaint AI Teaching Assistant and AI CBT Question Generator are decision-support tools. They generate draft content (lesson plans, notes, questions, student comments) that a human teacher or administrator reviews before use. AI does not make final decisions that affect students' grades, placement, or disciplinary outcomes.

Because AI outputs are reviewed by humans before taking effect, no automated decision-making within the meaning of NDPA Section 37 occurs. If we ever introduce a feature where AI materially affects a decision about a data subject without human review, we will:

• Notify affected users (or their parents/guardians) in advance.
• Explain the logic involved in the automated decision.
• Offer a right to request human intervention or contest the decision.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes through:

• Email notification (if you have provided an email address).
• In-app notification when you open the app.
• Updating the "Last Updated" date at the top of this policy.
• For minors, notification to the parent or guardian of record.

Your continued use of EduSaint products after any changes indicates your acceptance of the updated Privacy Policy.

14. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will:

• Notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of the breach, as required by NDPA Section 40.
• Notify affected users (or their parents/guardians for minors) within 72 hours via email (where we have an email address) or in-app notification, describing the nature of the breach, the likely consequences, and the steps we have taken and that you can take.
• Notify affected schools where the breach involves school-managed records, so the school can take any additional action required on its own side.
• Maintain a breach register documenting all personal data breaches, whether or not they require notification.

If you suspect a breach has affected your account, contact us immediately at privacy@edusaint.ng.

18. California Privacy Rights (CCPA)

If you are a California resident, you have the right to:

• Request disclosure of categories and specific pieces of personal information collected.
• Request deletion of personal information.
• Opt-out of the sale of personal information (we do not sell personal information).
• Not be discriminated against for exercising your privacy rights.

To exercise these rights, contact us at privacy@edusaint.ng with "CCPA Request" in the subject line.

19. GDPR Rights (European Economic Area)

If you are located in the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR), including the right to restrict processing, object to processing, and data portability. Our legal basis for processing your data is primarily contractual necessity and legitimate interests. You have the right to lodge a complaint with a supervisory authority.

20. Do Not Track Signals

Our platform does not respond to "Do Not Track" (DNT) signals at this time, as we do not track users across third-party websites.

20.5 Data Protection Officer (DPO)

Edusaint has designated a Data Protection Officer responsible for overseeing compliance with this policy and with NDPA, GDPR, and COPPA. You can reach the DPO at:

You may contact the DPO directly for any data protection question, complaint, or exercise of your rights under this policy.

20.6 Data Controller Registration

Edusaint is registered with the Nigeria Data Protection Commission (NDPC) as a data controller of major importance, in accordance with NDPA 2023 and its implementing regulations. Our registration details are available on request via privacy@edusaint.ng.

20.7 Complaints to the Regulator

If you believe we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng, or with your local supervisory authority if you are located in the EEA, UK, or another jurisdiction with data protection law. We ask that you contact us first at privacy@edusaint.ng so we can attempt to resolve the matter.

21. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: