Privacy Policy

1. Who is responsible

Nonofo Technologies Limited (RC 9905828) operates Nonofo Academy and is the data controller for the personal information described here. Registered office: No. 25, Aseyinku Area, Ibadan, Oyo State, Nigeria. Nonofo Academy is for people aged 18 and over. Where a tutor grades their own course, the tutor is responsible for that grading decision.

2. Information we collect

• Account details: name, email address, password (stored in protected form), role, account status, and your confirmation that you are 18 or over.
• Learning records: enrolments, lessons opened, watch progress, project evidence, assessments, feedback, ratings, certificates and portfolio entries.
• Instructor information: application details, qualifications, profile picture and introduction video.
• Live learning records: bookings, attendance, readiness-check results and ratings. Live classes may be recorded; you will be told before a recording starts.
• Support messages: messages you send through the Help form, or to Nonofo on WhatsApp, Facebook Messenger, Instagram or Telegram, with the name and account ID that channel shares with us.
• Purchase records: what you bought, the price, the date, the Paystack payment reference, and a record that you accepted the refund terms at checkout (the time and the policy version). Your card details are handled by Paystack on Paystack's own pages. We never see or store your full card number.
• Payout records (tutors and affiliates, when available): the payout account you set up with Paystack, your earnings and payout history.
• Safety and audit records: reports, moderation decisions, warnings, suspensions, appeals and a history of important account actions.
• Security records: sign-in times, two-step sign-in information, security notices, protected one-way codes used to stop repeated wrong sign-in attempts, and logs of administrative actions.
• Country and campaign source: your country only, from our network provider's country signal, and the campaign tags on the link you followed to sign up. These are used only for totals; groups smaller than five are merged.

3. What we do not collect or store

We do not store your internet (IP) address on your account, your precise location, city or GPS, a device fingerprint, recordings of your screen, or raw camera or microphone recordings from readiness checks. We do not sell personal data. For signed-out visitors who use our assistant Leo, we keep a scrambled (hashed) form of the internet address for up to 30 days, only to stop abuse.

4. Cookies and advertising

We use essential cookies to keep you signed in and secure. These do not require consent. With your separate consent for "Advertising", we may load the Meta Pixel from Meta Platforms Ireland Ltd / Meta Platforms Inc. (USA) only after you select "Accept" for Advertising in our cookie banner. When loaded, it may collect your IP address, device ID, and actions like PageView, CompleteRegistration, InitiateCheckout and Purchase to measure and optimise our Facebook/Instagram campaigns. No lesson content, project work or messages are sent to Meta. Meta data is retained for up to 90 days and may be transferred outside Nigeria to the US under Meta's contractual safeguards. You can withdraw your consent at any time via the cookie icon or Cookie settings, which will block future loading. You can also exercise your rights to access, delete and more through our Data Protection Officer at dpo@nonofo.com.

5. Why we use information, and our legal bases

• To provide courses, live classes, certificates and the services you ask for: performance of our contract with you.
• To process payments, refunds and payouts, and to respond to payment disputes: contract, and legitimate interests (preventing fraud and defending disputes).
• To keep the platform safe, prevent abuse and fraud, and keep audit records: legitimate interests and legal obligations.
• To meet tax, accounting and other legal duties: legal obligation.
• To measure adverts and send marketing: your consent, which you can withdraw at any time.

6. Uploads and screening

Uploaded files and user content may be screened for safety, malware, contact details, links, QR codes, text, audio and video content before anyone else can see them. Screening is a strong protection layer, not a guarantee.

7. Private media links

Course videos and private files are shown through short-lived links that expire. They are never public permanent links.

8. Who can see your information

• You can see your own account, learning records, purchases, feedback and uploads.
• Tutors see only what is needed to support learners in their own courses or sessions. They do not see which affiliate brought which learner.
• Affiliates (when available) see only order references and amounts for their own sales, never buyers' names or contact details.
• Our staff and administrators can see information needed to run, review and protect the platform. Their access is limited by role and their actions are recorded.
• The public sees only what you choose to publish, such as a public portfolio page, and approved instructor profiles.

9. Portfolio pages

Portfolio entries are private until you choose Link only or Public. You can unpublish, set an expiry, reset the link or delete an entry at any time.

10. AI processing

Leo, our AI assistant, and AI-assisted screening, course review and grading process content inside the platform. AI never makes the final decision on suspensions, certificates, payments, refunds or course approvals; a person does. You can ask for a human review. Questions you type to Leo on the website are not kept as text in your account history. The optional job assistant sends the CV details you enter to an AI provider to draft CVs and cover letters, only after you confirm.

11. Service providers and international transfers

We use trusted providers to run Nonofo. They process information only to provide their service to us:

• Hosting, database and storage: Lovable Cloud (built on Supabase).
• Network and security: Cloudflare.
• AI: Lovable's AI service (using OpenAI models), with Google Gemini as a backup.
• Payments: Paystack.
• Email: Lovable's email service for sending account and service emails, and a mail-forwarding service for messages sent to our addresses.
• Messaging channels you choose to use: Meta (WhatsApp, Facebook Messenger, Instagram) and Telegram.
• Advertising measurement (only with your consent): Meta.

Some of these providers process data outside Nigeria. We transfer data only where the Nigeria Data Protection Act 2023 allows it: where it is needed to provide the service you asked for, or with appropriate safeguards such as contractual clauses with the provider. We check that providers protect data adequately, and we keep a record of what data is transferred, to whom and to which country.

12. How long we keep information

• Account details and learning records: while your account is active, plus a 30-day grace period after you ask us to delete it.
• Certificate verification records: as long as the certificate can be verified, unless you ask for removal.
• Purchase and payout records: 6 years after the transaction (accounting law).
• Payment dispute evidence: 7 years after the dispute is resolved.
• Support conversations: 2 years after the case closes.
• Safety and moderation records: 7 years after the action.
• Audit logs: 7 years. Security logs: 2 years.
• Error records (no personal content): 30 days.
• Marketing consent: until you withdraw it, plus proof of consent for 2 years.

After these periods we delete or anonymise the information. Deletion of an account may be delayed while a payout, refund, dispute or safety case is open.

13. Your rights

You can access, correct, download and delete your data, object to certain uses, withdraw consent, and ask about automated decisions. Your account's Security and privacy page includes "Download my data" and "Delete my account". You can also write to our Data Protection Officer at dpo@nonofo.com, or to support@nonofo.com with "Data protection" in the subject. We reply within the time the law requires.

14. Security

Private storage, short-lived links, role-based access, two-step sign-in for staff and administrators, limits on repeated sign-in attempts, second-person approval for high-risk actions and an audit history protect your data. No system is perfectly secure. If a breach is likely to put you at risk, we will tell you and the Nigeria Data Protection Commission as the law requires (within 72 hours where required). See our Security and trust page.

15. Complaints

If you are unhappy with our reply, you may escalate to an administrator through the Help page, and you may complain to the Nigeria Data Protection Commission (or your local data protection authority).

16. Changes

We will publish any new version with its effective date and a summary of changes.