This document is provided for general information. It does not replace professional legal advice. If you need advice about your specific circumstances, please consult a qualified lawyer.
1. Introduction
his Privacy Policy explains how The Breej Global Limited (RC 1861385), a company registered in Nigeria collects, uses, shares and protects personal information when you use the MindStep mobile application, the MindStep web application at app.usemindstep.com, this website and related services (together, the “Services”).
We care about your privacy and want you to understand what happens to your information. By using the Services you acknowledge that you have read this policy. If you do not agree with it, please do not use the Services.
2. Scope
This policy applies to personal information we process about users of the Services and visitors to our website. It does not apply to third-party websites, apps or services that the Services may link to, which have their own privacy practices.
We process personal information in line with applicable Nigerian data protection law, including the Nigeria Data Protection Act 2023 (NDPA) and regulations issued under it, to the extent they apply to us.
3. Information we collect
Depending on how you use the Services, we may collect the following categories of information.
Account information
Your name, email address, phone number, password (stored in protected form), profile photo and preferences.
Student information
Your institution, faculty, department or level, and information we may ask for to confirm that you are a student or to personalise campus communities and events.
Financial information
Wallet balances, funding and withdrawal details, and limited payment information such as the last digits of a card or the bank account used. We do not store your full card number or card security code. Card and bank payments are handled by our payment processors (see below).
Transaction data
Records of bill payments, marketplace orders, tutoring bookings, event tickets, disputes, fees and rewards, including amounts, dates and counterparties.
Content and communications
Listings, posts, comments, poll responses, messages and group chats you create in the Services, and your messages to our support team.
Device information
Device type, operating system, app version, language, unique device or advertising identifiers, and crash and performance data.
IP and log information
IP address, timestamps, pages or screens viewed, actions taken and error logs, which we use for security, fraud prevention and troubleshooting.
Location information
Where you allow it, we may use approximate or precise location to show relevant campus events and listings. You can control location permissions in your device settings. We may also infer approximate location from your IP address.
4. How we collect information
- Directly from you, when you register, complete your profile, make a transaction, post content or contact us.
- Automatically, through your use of the Services, using logs, cookies and similar technologies.
- From third parties, such as payment processors, bill and service providers and identity or fraud-prevention partners, where relevant.
- From other users, for example when someone sends you money, reviews a tutor or reports content.
5. How we use information
We use personal information to:
- Create and manage your account and provide the Services you request;
- Process payments, bill purchases, marketplace orders and tutoring bookings;
- Verify your identity and eligibility, and prevent fraud, abuse and security incidents;
- Resolve disputes, enforce our Terms of Service and meet legal and regulatory obligations;
- Communicate with you about your account, transactions, security and support requests;
- Send service updates and, where permitted, information about features that may interest you (you can opt out);
- Run the ambassador programme, including rewards;
- Understand how the Services are used and improve their performance, safety and design.
We rely on one or more lawful bases under applicable law, including performance of a contract with you, compliance with legal obligations, our legitimate interests (such as security and service improvement) and, where required, your consent.
6. Service providers and payment processors
We use trusted third parties to help us operate the Services, such as cloud hosting, analytics, customer support, messaging, identity checks and fraud-prevention providers. They may only process personal information on our instructions and for the purposes we specify.
Payment processors
Where applicable, payments into and out of MindStep are processed by third-party payment processors including Paystack and Flutterwave. When you make a payment, the relevant processor collects and processes your payment details under its own terms and privacy policy. We receive limited information about the transaction, such as its status, amount and a reference, but not your full card details.
We may add or change payment and service providers from time to time. Where we do, they will be subject to equivalent obligations.
8. Security
MindStep is designed with security and transparency in mind. We use technical and organisational measures intended to protect personal information against unauthorised access, loss, misuse or alteration, including access controls and encryption in transit where appropriate.
No system can be guaranteed to be completely secure. You play an important part too: keep your password and passcode private, never share OTPs or PINs, use a strong unique password and tell us promptly at support@usemindstep.com if you suspect unauthorised access.
10. Data retention
We keep personal information for as long as needed to provide the Services and for the purposes described in this policy. Retention periods depend on the type of information and why we hold it.
Some information, particularly financial and transaction records, may need to be kept for a period required by law, for accounting or audit purposes, to prevent fraud, to resolve disputes or to enforce our agreements. When information is no longer needed, we delete or anonymise it.
11. Account deletion
You can delete your account in the app at Settings → Account → Delete Account, or request deletion through our Delete Account page. When we process a deletion request, we delete or anonymise personal information associated with your account, except where we must or may retain it.
Some information may be retained where required by law, to prevent fraud, resolve disputes, enforce agreements, or maintain necessary financial records. Backups are overwritten on a rolling basis and may contain your information for a limited time.
12. Student eligibility and children
MindStep is intended for students in higher institutions. To use features such as the wallet and payments, you must meet the eligibility requirements in our Terms of Service, which include being at least 18 years old (or having the consent of a parent or legal guardian where the law permits).
We do not knowingly collect personal information from children where the law requires parental consent that has not been given. If you believe a child has provided us with personal information without appropriate consent, contact us at privacy@usemindstep.com and we will take appropriate steps, including deleting the information.
13. International transfers
Some of our service providers, such as cloud hosting and analytics providers, may process information outside Nigeria. Where we transfer personal information across borders, we take steps to ensure it remains protected in line with applicable law, for example through contractual safeguards.
14. Your rights
Subject to applicable law and certain exceptions, you may have the right to:
- Access the personal information we hold about you;
- Correct information that is inaccurate or incomplete;
- Delete your information, subject to the retention exceptions above;
- Object to or restrict certain processing, including direct marketing;
- Data portability, receiving your information in a structured, commonly used format where applicable;
- Withdraw consent where processing is based on consent, without affecting earlier processing; and
- Complain to the Nigeria Data Protection Commission or another competent authority.
15. Privacy requests
To exercise your rights, email us at privacy@usemindstep.com or use the in-app settings. We may need to verify your identity before acting on a request, and we will respond within the time required by law. You can submit an account deletion request on our Delete Account page.
16. Changes to this policy
We may update this policy from time to time. When we make material changes we will update the “Last updated” date and, where appropriate, notify you in the app or by email. Continued use of the Services after changes take effect means you accept the updated policy.
17. Contact us
If you have questions about this policy or how we handle personal information, contact:
The Breej Global Limited (MindStep)
Privacy enquiries: privacy@usemindstep.com
General support: support@usemindstep.com
Or use our contact form.