Last updated:
AI Class ("we", "us", "our") operates aiclass.com.ng, an AI-powered learning platform for Nigerian secondary schools. This policy explains how we collect, use, store, and protect personal data, including the personal data of children, in accordance with the Nigeria Data Protection Act 2023 (NDPA).
. Who we are
AI Class is the Data Controller for personal data processed through the platform. Schools that subscribe to AI Class are independent Data Controllers for the student data they register and manage within their school account. Where a school registers a student and enters their data, the school is the primary controller and AI Class is the processor acting on the school's instructions.
2. Data we collect
2. From schools
- School name, address, state, phone number, and email
- School administrator's name, email, and phone number
- Class structure and registered topics and sub-topics
- Payment records (processed by Paystack; we do not store card details)
2.2 From students
- Full name, email address, and date of birth
- School affiliation
- Parent or guardian name and phone number (for students under 8)
- Learning activity: lessons viewed, questions asked, assessments taken, progress
- Voice recordings when a student uses voice input (deleted after transcription)
- Code submissions in the coding lab
- Session metadata: device identifier, IP address, login timestamps
2.3 Automatically collected
- Device and browser type
- Pages visited and actions taken on the platform
- Diagnostic logs and error reports
3. Lawful basis for processing
We process personal data on the following bases:
- Consent — for students under 8, verified parental consent is required before any processing. Consent can be withdrawn at any time.
- Contract — to deliver the services a school or student has subscribed to.
- Legitimate interest — to secure the platform, prevent fraud, and improve our services.
- Legal obligation — to comply with Nigerian law.
4. Children's data
The NDPA defines a child as a person under 8 years. We do not process a child's personal data without verified parental or guardian consent, unless the processing is carried out for educational purposes by professionals bound by confidentiality (as permitted by Section 3(4) of the NDPA).
For marketplace courses, which fall outside the classroom education exemption, verified parental consent is always required. Consent is obtained via a one-time code sent to the parent's phone number. We log the time, IP address, and method of consent for audit purposes.
5. How we use your data
- To deliver AI-taught lessons and assessments
- To generate certificates on course completion
- To process payments via Paystack
- To provide parents and schools with progress reports
- To detect and prevent fraud, abuse, and security incidents
- To comply with legal obligations
6. Sharing your data
We share personal data only with:
- Service providers who process on our behalf: OpenAI (lesson and assessment generation), Google Cloud (speech-to-text, text-to-speech, Firebase hosting and database), Paystack (payment processing), Judge0 (code execution sandbox), our SMS provider (OTP delivery).
- Schools — the school that registered a student can view that student's progress within their school account.
- Law enforcement — where required by valid legal process.
We do not sell personal data. We do not share data with advertisers.
7. Data retention
- Student learning records — retained while the student has an active account, then for 90 days after the school leaves the platform, then anonymized.
- Certificates — retained indefinitely in anonymized form so that verification remains possible.
- Consent records — retained for the period required by the NDPA for audit purposes (currently 6 years).
- Voice recordings — deleted immediately after transcription. Only the transcript is retained.
- Payment records — retained per Nigerian financial regulations.
8. Your rights
Under the NDPA, you have the right to:
- Access a copy of your personal data
- Correct inaccurate data
- Request deletion (subject to legal retention requirements)
- Withdraw consent
- Object to processing
- Lodge a complaint with the Nigeria Data Protection Commission (NDPC)
To exercise any right, contact privacy@aiclass.com.ng. We respond within 30 days.
9. Security
We protect personal data with encryption in transit, encrypted storage, strict access controls, and audit logging. All production data is stored in Firebase (Google Cloud) with industry-standard security. Only authorised personnel can access personal data, and only for legitimate operational purposes.
0. International transfers
Some of our service providers (OpenAI, Google Cloud) process data on servers outside Nigeria. We transfer data only where the recipient provides adequate protection, and we require contractual safeguards consistent with NDPA requirements.
. Changes to this policy
We will notify account holders of material changes by email at least 4 days before the change takes effect.
2. Contact
For privacy questions or to exercise your rights:
Data Protection Officer
AI Class
Email: privacy@aiclass.com.ng
Website: aiclass.com.ng