Privacy Policy

1. Who Controls Your Data

SparkL ("we", "us", "our") is the data controller for personal data collected through this Service. You can reach us through the contact details at the bottom of this page.

2. Personal Data We Collect

2.1 Account and Identity Data

• Name or display name.
• Email address and/or phone number.
• Password credentials in protected form, or authentication-provider identifier.
• Profile photo, bio, institution, country, department, programme, academic stage, semester, and selected courses.
• Verification information where you request or receive a verified status.
• Support messages and account preferences.

2.2 Learning and Usage Data

• Courses viewed or followed.
• Past questions and resources opened.
• Practice attempts, answers, scores, saves, and progress.
• Searches, clicks, timestamps, referrals, and notification preferences.
• Community activity, reports, reputation, and moderation history.

2.3 User Content

We process questions, answers, comments, images, PDFs, notes, documents, profile information, and other material you upload or post. Public User Content may be visible to other users depending on your settings and the feature.

2.4 Payment and Transaction Data

Payment processors may provide us with transaction references, plan, amount, currency, status, last four digits or payment-token information, and billing dates. We do not store your full card number, PIN, CVV, or banking password.

2.5 Device, Technical, and Security Data

• IP address and approximate location derived from IP.
• Browser, operating system, device type, language, and app version.
• Cookies, local storage, session identifiers, and similar technologies.
• Logs, error reports, crash data, and performance information.
• Security signals such as unusual login, scraping, or abuse patterns.

2.6 Communications and Support

We collect messages you send to support, feedback and survey responses, and records needed to handle rights requests, complaints, payments, and safety investigations.

We do not intentionally collect sensitive personal data unless necessary, lawful, and adequately protected. Do not upload medical records, government ID, financial credentials, or another person's sensitive data to a public course or community space.

3. How We Collect Data

We collect data:

• directly when you create or update an account;
• when you use the Service, viewer, practice tools, or community;
• when you upload, post, report, or contact us;
• from payment, authentication, hosting, analytics, and security providers; and
• from institutions or moderators where they lawfully provide relevant information.

4. Why We Use Your Data

We use data to:

1. create and secure accounts;
2. personalise institution, programme, level, semester, and course content;
3. provide document viewing, search, practice, progress, community, upload, and support features;
4. process subscriptions, trials, payments, cancellations, refunds, and fraud checks;
5. communicate service notices, safety alerts, trial reminders, and support responses;
6. moderate content, enforce rules, protect examination integrity, and investigate abuse;
7. detect scraping, account sharing, malware, fraud, and security incidents;
8. measure performance, improve features, debug errors, and develop new services;
9. comply with law, court orders, regulatory requests, and rights notices; and
10. protect the rights, safety, and property of SparkL, users, institutions, and the public.

We may use de-identified or aggregated information for analytics, research, and product improvement. We will not use it to identify you.

5. Lawful Bases for Processing

We process your personal data in line with the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Regulation (NDPR), relying on:

• Performance of a contract — to provide the Service you request.
• Consent — where law requires it or where we request optional marketing or non-essential cookies.
• Legitimate interests — such as safety, fraud prevention, service improvement, and rights enforcement, balanced against your rights.
• Legal obligations — where required by applicable law.

You may withdraw consent at any time where consent is the basis. Withdrawal does not affect processing already carried out lawfully before withdrawal and may mean a particular feature is no longer available.

6. Public and Private Information

Your display name, profile image, institution and programme labels, public questions, answers, comments, uploads, reactions, and reputation may be visible to other users. Do not post anything you expect to remain private.

Private account, payment, security, support, and learning records are not intended to be public, but no internet transmission is guaranteed to be completely secure.

7. Cookies

We use strictly necessary cookies for login, security, session management, and preferences. With your consent where required, we may use analytics or similar technologies to understand usage and improve the Service. You can control cookies through your browser or device settings, but disabling necessary cookies may prevent some features from working.

8. Who We Share Data With

We do not sell your personal data. We may share data with:

• Cloud hosting, storage, CDN, document-processing, OCR, and security providers (including Supabase and Vercel).
• Authentication, email, and SMS providers.
• Payment processors and fraud-prevention providers.
• Analytics, customer-support, and error-monitoring providers.
• Moderators, trusted contributors, and institution administrators, only as needed for a feature or safety process.
• Professional advisers, auditors, and insurers under confidentiality obligations.
• Law enforcement, courts, regulators, or rights holders where required or permitted by law.
• Other users, only where you make content or profile information public through the Service.

We do not permit advertising partners to use student learning activity for unrelated targeted advertising.

9. Data Retention

We keep personal data only as long as reasonably necessary for the purposes described, including account operation, learning history, security, dispute resolution, legal obligations, and rights enforcement.

• Active account and profile — retained while your account is active.
• Public community content — retained until deleted or removed; backup copies may persist temporarily.
• Payment and transaction records — retained as required for tax, accounting, fraud, and legal obligations.
• Deleted account data — removed or anonymised within a reasonable period, except where retention is legally required.
• Rights and takedown records — retained as needed to demonstrate compliance and defend claims.

10. Security

We use reasonable technical and organisational measures, which may include access controls, encryption in transit, private storage, expiring tokens, watermarked document rendering, logging, backups, rate limits, and staff access restrictions. No system is perfectly secure. Do not reuse your SparkL password elsewhere.

If we become aware of a personal-data incident, we will assess it and notify affected people and authorities where required by law.

11. Your Privacy Rights

Under the NDPA, and subject to applicable law and reasonable verification, you may have the right to:

• know whether we process your personal data;
• access a copy of personal data we hold;
• request correction of inaccurate or incomplete data;
• request deletion or erasure;
• restrict or object to certain processing;
• withdraw consent;
• request data portability where applicable;
• object to direct marketing; and
• complain to the Nigeria Data Protection Commission.

To exercise these rights, contact us using the details at the bottom of this page. We may need to verify your identity and may lawfully refuse or limit a request. We will respond within the period required by applicable law.

12. Account Deletion

You may request account deletion through your account settings or by contacting us. Deletion removes your profile and personal data from active systems. We may retain limited information where required for legal compliance, fraud prevention, security, payment records, or dispute resolution. Where your public contributions are part of a community thread, we may anonymise rather than delete them where reasonably possible.

13. Children's Privacy

SparkL is intended for tertiary institution students. We do not knowingly collect personal data from children below the minimum age permitted by law without the required consent. If we learn that we collected such data, we will take reasonable steps to delete it.

14. Third-Party Links

The Service may link to third-party sites. Their privacy practices are independent of SparkL. Review their policies before submitting personal data.

15. Changes to This Policy

We may update this Privacy Policy as the Service, law, or our data practices change. We will post the updated version with a new "Last updated" date. For material changes, we will provide additional notice where required by law.

16. Contact

For privacy requests, questions, or complaints, contact SparkL through the support channel available in your account settings or on our website. We will respond as promptly as we can.