Privacy Policy

1. Data we collect

We collect only what we need to operate the service. This includes:

• Account data: names, work email, role, hashed passwords for admins, teachers, students, and parents.
• School data: curriculum documents, lesson notes, slides, quizzes, assignment submissions, and learning analytics generated while using LearnStack.
• Billing data: invoices, plan tier, and transaction references. Card details are never seen by LearnStack; they are handled directly by Paystack on our behalf.
• Technical data: IP address, device, browser, and timestamps. Used to keep the platform reliable, debug issues, and detect abuse.

2. How we use it

We process personal data only to:

• Provide the LearnStack service the school or student has subscribed to.
• Improve teaching quality and learning outcomes through aggregated analytics within the school.
• Send transactional messages (invoices, account notices, security alerts).
• Comply with Nigerian tax, accounting, and data-protection law, and respond to lawful requests from regulators.

We do not sell personal data. We do not share it with advertising networks. We do not use student work to train third-party AI models outside the school's own tenant.

3. Where it's stored

LearnStack data is stored on Supabase infrastructure in the eu-west-1 (Ireland) region. We picked eu-west-1 because it offers the lowest practical latency to Nigeria of any region with an EU-grade data-protection regime, and because cross-border transfers from Nigeria to the EU are recognised under NDPR adequacy provisions.

Backups are encrypted at rest. All connections between your browser and LearnStack are encrypted in transit using TLS.

4. Children's data (NDPR §31)

Most LearnStack students are minors. We follow NDPR §3.1 on the processing of children's personal data:

• Student accounts are only created by an authorised school administrator, after the school has confirmed it has lawful basis (typically parental consent secured by the school as part of enrolment).
• Parents can request a copy of, correction of, or deletion of their child's data at any time via their school administrator or directly to privacy@learnstack.ng.
• We do not market to students, do not run third-party advertising, and do not enrich student profiles from outside data sources.

5. Cookies

We use a small number of first-party cookies that are strictly necessary to keep you signed in, remember your role, and enforce CSRF protection. We do not use marketing or cross-site tracking cookies on the LearnStack platform.

6. Your rights

Under NDPR you have the right to:

• Be informed about how your data is processed (this policy).
• Access a copy of your personal data.
• Correct inaccurate data.
• Request deletion, subject to legal retention obligations.
• Object to processing or withdraw consent where consent is the basis.
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC).

To exercise any of these rights, email privacy@learnstack.ng. We respond within 30 days as required by NDPR.

7. Retention

School data is retained for the duration of the subscription plus 90 days after cancellation to allow the school to export. After that window, tenant data is permanently deleted unless a longer retention is required by law.

8. Contact

Data Protection Officer · privacy@learnstack.ng

We update this policy as our practices evolve. The "Last updated" date at the top tells you when the current version took effect.