This policy explains how WITIWORLD SOLUTIONS ("we", "us"), which runs AICLUBAFRICA, collects and uses personal data. It is written to meet the Nigeria Data Protection Act 2023 (NDPA) and the NDPC General Application and Implementation Directive, and also the EU/UK GDPR for learners outside Nigeria.
1. Who is responsible for your data
WITIWORLD SOLUTIONS, Lagos, Nigeria, is the data controller for accounts people create directly on aiclubafrica.ng. When a partner school registers or manages its students, the school also decides how its students' data is used, and we act on its instructions for that data (see our School & Teacher Terms).
Data protection contact: info@aiclubafrica.ng (subject: "Data request"), or WhatsApp +234 802 293 0602.
2. What we collect
•Account details: name, phone number, email address, password (stored only as a one-way hash), school, class/grade, class arm, state, preferred language, and for students optionally a parent or guardian's email address.
•Learning activity: lessons opened and completed, quiz answers and scores, assignment answers and AI feedback, XP, streaks, badges, league and leaderboard position, certificates, Code Lab projects, hackathon projects and votes, and AI Lab / Testing Lab progress.
•Kids section (ages under 9): only a first name or nickname, an avatar and progress, created by the child's teacher. We do not collect a child's contact details, photo or location.
•Teacher and school data: teacher names, contact details, subjects, roles, schemes of work they upload and lesson notes they generate; school name, address, administrator contact details.
•Payments: amount, date, transaction reference and status. Card and bank details are entered on Flutterwave's checkout and never reach us.
•Technical data: IP address, device and browser type, and server logs, used for security, rate limiting and fixing faults.
•Camera and microphone: the AI Lab and Testing Lab can use your camera or microphone. Images and sound are processed only inside your browser and are never uploaded or stored by us.
3. Why we use it, and our legal basis
•To provide the service you signed up for — accounts, courses, scoring, certificates, leaderboards (contract).
•To take payments and keep financial records (contract and legal obligation).
•To send service messages: in-app notices, emails, push notifications you allowed, and progress reports to the parent email you gave us (contract and legitimate interests). We send SMS only for important account matters and never for marketing without consent.
•To keep the platform fair and safe: detecting cheating, XP manipulation, abuse and attacks (legitimate interests).
•To improve courses and fix problems, using aggregated or de-identified data where we can (legitimate interests).
•Where we rely on consent (for example push notifications), you can withdraw it at any time in your browser or account settings.
4. Automated decisions and AI
Some decisions are made by software: quiz scores are calculated automatically; written assignments are reviewed by an AI model, which can decline answers that appear copied from a chatbot; and our systems may hide accounts from leaderboards when activity looks fraudulent. You can ask for any of these to be reviewed by a person by contacting us — see our AI Transparency Notice for details.
5. Who we share it with
We do not sell or rent personal data, and we do not use advertising or tracking cookies. We share only what is needed with:
•Your school: if you joined through a school, its administrators and your teachers can see your profile, progress and results.
•Parents/guardians: progress reports go to the parent email saved on a student's account.
•Flutterwave (payments), Termii (SMS delivery), Groq and OpenRouter (AI processing of the text you type into AI features), Contabo (server hosting) and Cloudflare (encrypted backups).
•Public pages you choose to publish: shared Code Lab portfolio projects, hackathon gallery entries and certificate verification pages show the name and work attached to them.
•Authorities, when Nigerian law, a court order or a regulator requires it, or to protect someone's safety.
6. International transfers
Our servers are hosted by Contabo in the European Union, our encrypted backups are stored with Cloudflare, and our AI providers process text in the United States. When data leaves Nigeria we rely on the transfer grounds in Part VIII of the NDPA, including adequacy of the destination's laws, contractual safeguards and, where needed, your consent. We send AI providers only the text needed for the task — not your phone number or email.
7. How long we keep it
•Account and learning records: while your account is active. If you ask us to delete your account we do so within 30 days.
•Certificate verification records (name, course, date and certificate number): kept after deletion so that certificates already issued can still be verified, unless you ask us to revoke the certificate.
•Payment records: 6 years, as required by Nigerian tax law.
•Backups: encrypted copies roll off automatically within 12 months.
•Server logs: kept for a short period for security and then deleted.
8. Your rights
Under the NDPA (and the GDPR where it applies) you can ask to: access a copy of your data; correct it; delete it; restrict or object to how we use it; receive it in a portable format; withdraw consent; and not be subject to a decision based solely on automated processing that significantly affects you.
Send requests to info@aiclubafrica.ng. We will verify your identity (usually by replying from your registered phone or email) and respond within 30 days. Parents and guardians can make requests for their children. A school can make requests for students it manages.
If you are unhappy with our response you may complain to the Nigeria Data Protection Commission (ndpc.gov.ng), or to your local data protection authority if you live outside Nigeria.
9. Security
Passwords are hashed with bcrypt; sessions use signed, HTTP-only cookies; all traffic is encrypted with HTTPS; our database is not publicly accessible and its console is protected by an IP allowlist and two-factor authentication; logins are rate-limited; and backups are encrypted. If a breach puts your rights at risk we will notify the NDPC within 72 hours and tell affected users without undue delay.
10. Children
Many of our learners are under 18. Under the NDPA, a child's data needs the consent of a parent or guardian — see our Children's Privacy Notice for how we handle this.
11. Changes
We will post any update here with a new date, and tell users in-app or by email before material changes take effect.