Privacy Policy

1. Introduction & Controller Identity

This Privacy Policy explains how Campus Assistant Nigeria ("we", "us", or "our") collects, uses, stores, and protects your personal data when you use the Campus Assistant Platform.

We are committed to the Data Minimisation Principle (NDPA 2023 §2.1(b)) — we only collect data that is strictly necessary to provide our services.

Campus Assistant Nigeria is the Data Controller for all personal data processed under this Policy. Our Data Protection Officer can be reached at dpo@campusassistant.ng.

2. Data We Collect

3. AI Processing Disclosure

We use Anthropic's Claude AI in two contexts. Under NDPA 2023 §2.4 (automated decision-making disclosure), we are required to inform you about significant automated processing:

4. How We Use Your Data

• ·Service delivery: Account management, task matching, subscription management.
• ·Identity verification: Verifying you are a genuine student at the university you declared using AI plausibility checks and duplicate detection.
• ·Safety & fraud prevention: Velocity monitoring (CBN AML/CFT §6), IP-based rate limiting, fraud scoring, chat safety monitoring, and activity audit logs.
• ·Referral programme: Tracking referrals and calculating commissions for Marketers and inviting Students.
• ·Communications: Transactional emails only — OTP codes, task updates, payment receipts, account alerts. No marketing emails without explicit consent.
• ·Legal compliance: Responding to lawful requests from NDPC, CBN, FCCPC, EFCC, or courts with valid orders.
• ·Platform improvement: Aggregated, anonymised analytics to improve features. No individual profiling for advertising.

5. Data Retention

After a retention period expires, data is securely deleted or anonymised such that it cannot be re-identified.

6. Data Security

• ·Phone numbers encrypted with AES-256-GCM at rest; Wallet balances additionally encrypted.
• ·TLS 1.3 enforced for all API calls and data in transit.
• ·Role-based access control with Row Level Security (RLS) via Supabase / PostgreSQL — each role can only query its own data.
• ·All privileged administrative actions are logged with IP address, timestamp, and user-agent (immutable audit trail).
• ·Optional TOTP two-factor authentication (2FA) available to all users.
• ·Rate limiting on all authentication endpoints to prevent brute-force attacks.
• ·Passwords hashed with bcrypt (cost factor 12) — plain-text passwords are never stored.
• ·AI data submissions are sent over TLS and are not used for model training by Anthropic under our DPA.

7. Third-Party Data Processors

We execute Data Processing Agreements (DPAs) with all processors as required by NDPA 2023 §2.6. Cross-border transfers to non-adequate countries are governed by Standard Contractual Clauses where applicable.

8. Data Sharing

We do not sell, rent, or trade your personal data to third parties for marketing purposes. We share data only in the following circumstances:

• ·With processors: As listed above, under strict DPAs, solely to deliver the Platform.
• ·With other Users (limited): Your username and public profile information are visible to other Users as part of normal Platform operation. Your full name appears on tasks you post or accept. Surnames are visible in the Classmates feature as described in Section 3.
• ·Law enforcement: Where required by a court order, statute, or lawful request from NDPC, CBN, EFCC, FCCPC, or NPF-CSIRT. We will notify you where legally permitted.
• ·Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity under equivalent privacy protections.

9. Your Rights (NDPA 2023 §§3.1–3.7)

• ·Access: Request a copy of all personal data we hold about you.
• ·Correction: Request correction of inaccurate or incomplete data.
• ·Erasure: Request deletion of your data (subject to legal hold obligations and AML/CFT retention requirements).
• ·Portability: Receive your data in a structured, machine-readable format (JSON or CSV).
• ·Restriction: Restrict processing of your data pending resolution of a dispute.
• ·Object: Object to processing based on legitimate interest, including AI-based profiling.
• ·Withdraw consent: Where processing is consent-based, withdraw consent at any time without affecting lawfulness of prior processing.
• ·Human review: Request human review of any significant automated decision affecting your account.

To exercise any of these rights, email privacy@campusassistant.ng with the subject line "Data Rights Request". We respond within 30 days. For complex requests, we may extend by a further 60 days with notice.

10. Users Under 18

The Platform is open to users aged 15 and above. Users aged 15–17 require parental or guardian consent. We do not knowingly create accounts for users under 15. If we learn that personal data has been collected from a user under 15 without consent, we will delete the account promptly. Parents or guardians may contact dpo@campusassistant.ng to request deletion.

11. Cookies

We use a single HTTP-only, secure, SameSite=Lax session cookie (campus_session) for authentication. This cookie is essential for the Platform to function and cannot be opted out of while logged in.

We do not use third-party analytics cookies, advertising pixels, or cross-site tracking technologies. For full details, see our Cookie Policy.

12. Changes to This Policy

We will notify you of material changes to this Privacy Policy via email and in-app notification at least 30 days before the changes take effect. The revised policy will be posted on this page with an updated effective date. Continued use of the Platform after the effective date constitutes acceptance of the revised Policy.

13. Complaints

If you are unsatisfied with how we have handled your personal data, you may first contact our DPO at dpo@campusassistant.ng.

If unresolved, you may lodge a complaint with the National Data Protection Commission (NDPC): ndpc.gov.ng · info@ndpc.gov.ng · +234-9-291-0016.