01 Introduction
ChloeZ ("we", "us", "our") respects your privacy and is committed to protecting the personal data of everyone who uses our website, mobile experience, courses, live classes, AI study tools, exam-prep engine, certificates, and tutor marketplace (together, the "Services").
This Privacy Policy explains what personal data we collect, why we collect it, how it's used and shared, and the choices and rights available to you. It should be read alongside our Terms & Conditions. We process personal data in accordance with the Nigeria Data Protection Act, 2023 ("NDPA") and the oversight of the Nigeria Data Protection Commission ("NDPC").
02 Who This Policy Covers
This Policy applies to Students, Tutors, parents/guardians managing a minor's account, and visitors to our website, regardless of location, though our Services are designed primarily for learners in Nigeria. Where you use the Services on behalf of a school or organisation, that organisation's own privacy terms may also apply to you.
03 Information We Collect
3.1 Information you give us
- Account details: name, email address, phone number, password, school/education level, and date of birth;
- Content you create: chat messages, community posts, notes, and — for Tutors — Course materials, qualifications, and verification documents;
- Tutor payout details: bank account information and identity documents required for payout and know-your-customer (KYC) verification;
- Anything you submit through support requests, surveys, or feedback forms.
3.2 Sensitive information
Some of the information we process — such as a Student's school affiliation, exam or coursework performance, or other education-related data — may be considered sensitive information in certain jurisdictions. Where we process this, we do so with your consent (or, for a minor, a parent or guardian's consent) or as otherwise permitted under the NDPA.
3.3 Information collected automatically
- Learning activity: courses viewed or completed, quiz and CBT/mock-exam scores, time spent studying, streaks, and AI-identified weak areas;
- Live Class data: attendance, participation, and session recordings (see Terms, Section 8);
- AI study companion conversations and prompts;
- Device and usage data: IP address, browser type, device identifiers, operating system, language preference, referring URL, and general location (city/region level) inferred from your IP address;
- Cookies and similar technologies, described in Section 6.
3.4 Information from third parties
We receive limited transaction data (such as payment status and reference numbers) from our payment processors, described further in Section 10, and may receive basic profile information if you choose to sign in using a third-party account such as Google or Facebook, described in Section 9.
Where we use Google APIs (for example, for Google Sign-In), our use and transfer of information received from those APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
04 How We Use Your Information
We use personal data to:
- Provide, operate, and personalise the Services, including tailoring the AI study companion and recommending Courses;
- Process payments, Subscriptions, and Tutor payouts;
- Track learning progress, issue Certificates, and generate performance analytics;
- Maintain the safety, security, and integrity of Live Classes, community features, and CBT exams (including detecting cheating or abuse);
- Communicate with you about your Account, Courses, and transactions, and — where you've opted in — send you marketing communications;
- Improve and develop the Services, including through aggregated or de-identified analytics; and
- Comply with our legal, tax, and regulatory obligations, and enforce our Terms & Conditions.
05 Legal Basis for Processing
Under the NDPA, we rely on one or more of the following legal bases to process your personal data:
- Contract — to create your Account and deliver the Services you've signed up for;
- Consent — for optional features such as marketing emails, certain cookies, and (for users under the applicable digital age of consent) parental consent for a child's Account;
- Legitimate interests — to keep the Platform secure, prevent fraud and exam misconduct, and improve our Services, balanced against your rights and interests; and
- Legal obligation — where we must retain or disclose data to comply with applicable law.
08 AI Features & Your Data
We provide our AI features through third-party AI Service Providers — currently Anthropic and OpenAI, accessed via OpenRouter — who process your input, output, and related personal information on our instructions to generate responses. We may use anonymised or aggregated interaction data to evaluate and improve our AI features.
Please avoid submitting sensitive personal data (such as health information or government ID numbers) in AI chat prompts unless it is necessary for the study help you're seeking.
10 Payment Information
All payments are processed by our payment processors — primarily Paystack, and, for select payment methods, Stripe and NOWPayments (which supports cryptocurrency payments). ChloeZ receives confirmation of payment status and a transaction reference, but we do not receive or store your full card number, CVV, wallet credentials, or bank login details — these are handled directly by our processors under their own security standards and privacy policies.
11 Certificates & Public Verification
When you earn a Certificate, your name, the Course title, and completion date are displayed on a public, individually-linked verification page so that third parties (such as employers or schools) can confirm its authenticity. This page is only accessible to someone who has the specific verification link or ID, and is not indexed for general public search by us.
If you would prefer we display an alternative display name on a Certificate, or wish to request removal of a verification page, contact us using the details in Section 20 — noting that removing a verification page may affect a third party's ability to confirm that Certificate in future.
12 Children's Privacy
Many ChloeZ Students are secondary school learners. Where a User is below the applicable digital age of consent under the NDPA, we require the involvement and consent of a parent or legal guardian before creating an Account or processing that child's personal data, consistent with Terms, Section 1.
We collect no more personal data from children than is reasonably necessary to provide the Services. A parent or guardian may contact us at any time to review, correct, or request deletion of their child's personal data.
13 Data Retention
We retain personal data for as long as your Account is active and as needed to provide the Services. We do not keep personal data for longer than eight (8) months after your Account is closed, except where a longer period is required by law (such as tax or accounting obligations), or, subject to your right to request its removal under Section 11, where needed to keep a previously issued Certificate's public verification page working — that page only ever shows your name, the Course title, and completion date.
14 Data Security
We use industry-standard safeguards to protect personal data, including encryption of data in transit, hashed password storage, access controls limiting staff access on a need-to-know basis, and regular review of our security practices. No system is completely secure, and we cannot guarantee absolute security of information transmitted to us. If we become aware of a data breach affecting your personal data, we will notify you and the NDPC without undue delay, in line with our obligations under the NDPA.
15 International Data Transfers
Some of our service providers (such as cloud hosting or AI infrastructure) may process personal data outside Nigeria. Where this happens, we take steps required under the NDPA to ensure an adequate level of protection, such as relying on providers in jurisdictions recognised as adequate, using standard contractual clauses, or obtaining your explicit consent where required.
16 Your Privacy Rights
Subject to applicable law, you have the right to:
- Be informed about how your personal data is processed;
- Access a copy of the personal data we hold about you;
- Request correction of inaccurate or incomplete data;
- Request deletion of your personal data, subject to the retention needs described in Section 13;
- Object to, or request that we restrict, certain processing;
- Receive your data in a portable format, where technically feasible;
- Withdraw consent at any time, where processing is based on consent, without affecting processing carried out before withdrawal; and
- Lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your rights have been violated.
The quickest way to review or update your Account information is directly from your account settings. For deletion, correction, or any other request, contact us using the details in Section 20. We may need to verify your identity before acting on a request.
17 Do-Not-Track Signals
Most browsers, and some mobile operating systems, include a Do-Not-Track ("DNT") feature you can enable to signal that you don't want your online activity tracked. Because no consistent industry standard for recognising and responding to DNT signals has been finalised, we do not currently respond to DNT signals. If a common standard is adopted that we're required to follow, we'll describe how we respond to it in a revised version of this Policy.
18 Marketing Communications
Where you've opted in, we may send you emails about new Courses, features, or promotions. You can unsubscribe at any time using the link in any marketing email, or from your account notification settings. We will still send you essential transactional messages — such as payment receipts, security alerts, or Class reminders — even if you opt out of marketing.
19 Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes to our practices, the Services, or applicable law. Where changes are material, we will provide reasonable notice, such as an in-app notice or email, before they take effect. The "Last updated" date at the top of this page reflects when this Policy was last revised.
20 Contact Us & Data Protection Officer
If you have questions about this Policy or wish to exercise a privacy right, please contact our Data Protection Officer:
You may also lodge a complaint directly with the Nigeria Data Protection Commission at ndpc.gov.ng.
This document is provided for general informational purposes as part of the ChloeZ platform and does not constitute legal advice.
09 Social Logins
The Services let you register or sign in using a third-party social media account — currently Google or Facebook. If you choose to do this, we receive certain profile information from that provider, typically your name, email address, and profile picture, along with any other information you've made public on that platform.
We use this information only as described in this Privacy Policy. We do not control, and are not responsible for, how your social media provider itself handles your information — we recommend reviewing their own privacy policy and privacy settings.