Privacy Policy

1. Information We Collect

We collect information that identifies or relates to you in the following ways:

• Account Data: Full name, email address, phone number, date of birth, institutional affiliation, and a government-issued student ID or matriculation number where required for verification.
• Financial & Transaction Data: Wallet balance, transaction history, peer payment records, and tutoring session payouts. Card and bank account details are collected and processed directly by our licensed, PCI-DSS compliant payment processing partner(s) — MindStep does not store full card numbers on its own servers.
• Academic & Tutoring Data: Course/subject information, tutor ratings and reviews, session bookings, and messages exchanged through in-app tutoring or community features.
• Device & Usage Data: IP address, device identifiers, operating system, app version, crash logs, and general usage analytics.
• Location Data (optional): Approximate location, where you enable it, to support campus-specific features.

2. Legal Basis for Processing

Under the NDPA and applicable data protection principles, we process your information on one or more of the following bases:

• Consent — where you have explicitly agreed, such as enabling location services or marketing communications.
• Contractual necessity — to create your account, process wallet transactions, and facilitate tutoring bookings.
• Legal obligation — to comply with financial recordkeeping, tax, and anti-fraud requirements.
• Legitimate interest — to secure the platform, prevent abuse, and improve the Services, balanced against your rights.

3. How We Use Your Information

• To deliver, maintain, and enhance MindStep services.
• To process wallet top-ups, peer payments, tutor payouts, and refunds via our licensed payment partner(s).
• To match students with tutors and facilitate bookings and session communication.
• To ensure security, authenticate logins, and detect or prevent fraud.
• To send you service-related notifications (transaction alerts, booking confirmations) and, where you have opted in, marketing communications.
• To comply with regulatory obligations and enforce our Terms of Service.

4. How We Share Your Information

We do not sell your personal data. We share information only in the following circumstances:

• Licensed payment processors — to process wallet funding, peer transfers, and tutor payouts. MindStep is a technology platform and is not itself a deposit-taking bank; funds are held and moved through our regulated payment partner(s).
• Cloud infrastructure & analytics providers (e.g., Firebase/Google Cloud) — to host data, send notifications, and monitor app stability and usage.
• Other users — a tutor and student in a booked session can see limited profile information necessary to complete that session.
• Regulators & law enforcement — where required by Nigerian law, court order, or to investigate fraud.
• Business transfers — in connection with a merger, acquisition, or asset sale, subject to continued protection of your data under this Policy.

5. Data Retention

We retain personal data only as long as necessary for the purposes described in this Policy. Account data is retained while your account is active and for a limited period after closure to comply with legal, tax, and anti-fraud obligations. Transaction records are retained for the period required under applicable Nigerian financial recordkeeping requirements. You may request earlier deletion subject to Section 8 below.

6. Cookies & Tracking Technologies

Our web platform uses cookies and similar technologies to keep you signed in, remember preferences, and understand how the Services are used. You can control cookies through your browser settings; disabling them may limit some functionality.

7. International Data Transfers

Some of our service providers (including cloud hosting) process data on servers located outside Nigeria. Where this occurs, we take steps required under the NDPA to ensure an adequate level of protection, including relying on providers with recognized data protection safeguards.

8. Your Rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion of your account and associated data.
• Withdraw consent for optional processing (e.g., marketing, location).
• Object to certain processing based on legitimate interest.
• Request a copy of your data in a portable format.
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your rights have been violated.

To exercise these rights, contact us using the details in Section 14, or use the account deletion flow below.

10. Children's Privacy

The Services are intended for university students and are not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a minor has provided us with personal data, please contact us so we can investigate and, where appropriate, delete it.

11. Data Security & Breach Notification

We employ TLS encryption in transit and AES-256 for data at rest, alongside access controls and monitoring. No system is completely secure; in the event of a data breach likely to result in risk to your rights, we will notify affected users and the NDPC in accordance with applicable law and timeframes.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the app or by email before they take effect. Continued use of the Services after changes take effect constitutes acceptance of the updated Policy.

13. Governing Law

This Privacy Policy is governed by the laws of the Federal Republic of Nigeria, including the Data Protection Act, 2023, without regard to conflict-of-law principles.