Privacy Policy

This policy explains what personal data SabiStudy collects, why, and your rights under the Nigeria Data Protection Act 2023 (NDPA). SabiStudy is operated by Abdulmalik Abdulwakeel, Nigeria, who is the data controller. Contact: support@sabistudy.com.

1. What we collect

• Account: your name, email address, university (optional) and password (stored only as a secure hash).
• Study content: course PDFs you upload and the text read from them, your chats, photos you attach, notes about your lecturer, practice exam answers and scores, and TMA or exam scores you record.
• Payments: the pack, amount, payment reference and status. Card and bank details are handled by Paystack and never reach us.
• Referrals: who invited you, if you used a referral code.
• Technical data: basic logs (such as IP address, browser and error reports) needed to run and protect the service.

2. Why we use it

• To provide SabiStudy: answering questions, reading your course material, marking exams, building reports (contract).
• To manage credits, payments and referrals (contract and legal obligations).
• To send account emails such as confirming your email or resetting your password (contract).
• To keep the service secure, prevent abuse and fix problems (legitimate interest).
• To improve exam reports for a course using questions students asked about it, without names or account details (legitimate interest).

We do not sell your personal data, and we do not use it for advertising.

3. Who processes it for us

We use trusted providers who only process data to run SabiStudy:

• Supabase (database, file storage and login), servers in the European Union (Ireland).
• Cloudflare (website hosting and security), worldwide network.
• OpenAI (AI answers, reading scanned pages and photos). Your questions and the relevant parts of your material are sent to it to produce answers. Under OpenAI's API terms this data is not used to train their models.
• Resend (sending account emails).
• Paystack (payments).

Some of these providers store data outside Nigeria. We only use providers with appropriate safeguards for international transfers, as the NDPA requires.

4. Sharing you choose

• If you share a chat or report by link, anyone with the link can view it until you stop sharing. Photos and your email are never included.
• If another student uploads exactly the same course PDF file you uploaded, they may use its processed version (see our Terms). Your personal content is never shared this way.

5. How long we keep it

We keep your data while your account is open. When you delete your account, your profile, chats, photos, notes, exam results and payment records are deleted from SabiStudy. Paystack keeps its own record of payments, as the law requires of payment providers. A course PDF that other students are using from the shared library may be kept for them, without any link to you.

6. Your rights

Under the NDPA you can:

• ask for a copy of your personal data;
• correct wrong data (most of it you can edit in your profile);
• delete your data (delete your account from your profile, or ask us);
• object to or restrict some uses, and withdraw consent where we rely on it;
• ask for your data in a portable format;
• complain to the Nigeria Data Protection Commission (NDPC).

To use these rights, email support@sabistudy.com. We reply within 30 days.

7. Cookies and storage

We only use what the service needs: a login cookie to keep you signed in, a cookie that remembers a referral code for 30 days, and storage in your browser for your light or dark theme and unfinished practice exams. We do not use advertising or tracking cookies.

8. Security

Data is encrypted in transit (HTTPS). Each student can only access their own data, enforced in the database. Payment details are handled by Paystack. No system is perfectly secure, so please use a strong password.

9. Children

SabiStudy is for students aged 16 and over. Younger students need permission from a parent or guardian.

10. Changes

If we change this policy in an important way, we will tell you in the app or by email.