Privacy Policy
Last updated: May 14, 2026
Privacy Self-Service Center
Signed-in scholars can request a machine-readable account export or submit an account deletion request directly from this page.
Sign in first to access privacy self-service actions and compliance tracking.
1. Introduction
AkademyDraft ("we," "our," "us"), a platform under the Elite Workforce Impact Nigeria (E-WIN) Project Ecosystem, is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our academic Results as a Service (RaaS) platform accessible at akademydraft.ewinproject.org.
This policy complies with the Nigeria Data Protection Regulation (NDPR) 2019, the Nigeria Data Protection Act 2023, and applicable provisions of the General Data Protection Regulation (GDPR) for users within the European Economic Area.
2. Data We Collect
2.1 Personal Identification Information
- Full Name — Required for account identification and document attribution
- Email Address — Used as your primary account identifier and for service communications
- National Identification Number (NIN) — Collected for institutional compliance and account verification
- Date of Birth — Used for identity verification and age eligibility
2.2 Contact & Location Data
- WhatsApp Number and Mobile Number
- Residential Address
- State of Residence and State of Origin
- Local Government Area (LGA)
2.3 Academic & Platform Data
- Project topics, research materials, and generated academic content
- Institution name and academic level
- Payment history and subscription status
- Platform usage analytics and session data
2.4 Automatically Collected Data
- Browser type, device information, and IP address
- Session identifiers and authentication timestamps
- Page interaction data for platform improvement
3. How We Use Your Data
We process your personal data for the following lawful purposes:
- Service Delivery: To generate, format, and deliver academic documents as requested
- Authentication & Security: To verify your identity via Firebase Authentication and protect your account from unauthorized access
- Payment Processing: To process subscription payments through Flutterwave/Paystack
- Communication: To send project updates, payment receipts, and platform notifications via email (Resend) and WhatsApp
- Institutional Compliance: To verify academic eligibility and prevent academic misconduct
- Platform Improvement: To analyze usage patterns and improve our AI agent pipeline
- Legal Obligations: To comply with applicable Nigerian laws, court orders, and regulatory requirements
4. Third-Party Services & Data Sharing
We use the following third-party services that may process your data:
| Service | Purpose | Data Shared | Location |
|---|---|---|---|
| Firebase Auth (Google) | User authentication | Email, Unique ID, security keys | Global (Google Cloud) |
| Convex | Central system storage & real-time sync | All platform data | EU (eu-west-1) |
| Flutterwave | Payment processing (NGN) | Name, email, transaction amount | Nigeria |
| Resend | Email notifications | Email address, notification content | US |
| Cloudflare (Global Delivery Network) | Hosting & CDN | IP address, request data | Global |
We do not sell, rent, or trade your personal data. Data is shared only as necessary to deliver our services or comply with legal requirements.
5. Data Retention
We retain your personal data for as long as your account is active or as needed to provide services:
- Account Data: Retained for the lifetime of your account plus 90 days after deletion
- Project Data: Retained for 12 months after project completion, then archived
- Payment Records: Retained for 7 years per Nigerian tax regulations
- Session Logs: Automatically purged after 7 days of inactivity
- Rate Limit & Cache Data: Automatically expired (1 hour to 24 hours)
6. Your Rights (NDPR & GDPR)
Under the Nigeria Data Protection Regulation and applicable laws, you have the right to:
- Access: Request a copy of your personal data we hold
- Rectification: Correct inaccurate or incomplete data
- Erasure: Request deletion of your personal data ("right to be forgotten")
- Restriction: Limit how we process your data
- Portability: Receive your data in a structured, machine-readable format
- Objection: Object to processing based on legitimate interests
- Withdraw Consent: Withdraw consent at any time without affecting prior lawful processing
To exercise any of these rights, contact us at the details provided in Section 10.
7. Data Security
We implement enterprise-grade security measures to protect your data:
- Secure sign-in with encrypted key exchange
- Central system with secure access control and data verification
- High-grade encryption (TLS 1.3) for all data in transit
- Token-bucket rate limiting to prevent brute-force and abuse
- Automated session cleanup and garbage collection
- Content Security Policy (CSP) headers to prevent XSS attacks
- Regular security audits and dependency updates
8. Cookies & Tracking
We use essential cookies and local storage for authentication, session management, and platform functionality. We do not use third-party tracking cookies for advertising purposes.
Your browser's local storage is used to persist your session identifier and authentication state. These are cleared when you sign out.
9. Children's Privacy
AkademyDraft is intended for tertiary-level students and academic professionals. We do not knowingly collect data from individuals under 16 years of age. If we become aware of such data, we will delete it promptly.
10. Contact Us
For privacy-related inquiries, data access requests, or to exercise your rights:
Email: [email protected]
Website: https://ewinproject.org
You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.
11. Policy Updates
We may update this Privacy Policy periodically to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes via email or platform notification. Continued use after changes constitutes acceptance.