Privacy Policy

1. Who Operates CampusPrep

CampusPrep ("CampusPrep", "we", "us", or "our") operates the website and web application accessible at campusprep.online. CampusPrep is an educational technology platform dedicated to helping Nigerian university and tertiary higher institution students prepare for computer-based tests (CBT), theoretical exams, and group academic studies.

For privacy and data protection inquiries, you may reach our designated data protection coordinator at privacy@campusprep.online.

2. Information We Collect

We only collect personal information that is genuinely necessary to deliver, secure, and improve your academic study experience. We collect information in the following categories:

A. Information Provided During Account Registration

• Full Name: Used to personalize your study profile, leaderboard displays, and exam result certificates.
• Email Address: Used as your unique account credential, to transmit 6-digit email verification codes, send password reset instructions, and deliver important academic updates.
• Password: Handled exclusively as a cryptographically salted one-way hash. We never store or have access to your plaintext password.
• Academic Profile (Optional): Your institution (e.g. University of Benin, University of Lagos), faculty, department, and academic level (e.g. 100L–500L), which helps our platform tailor syllabus-accurate mock exams.

B. Information Collected When You Use the Platform

• Exam Selections & Attempt History: The courses, topics, difficulty levels, and durations you select, along with your submitted answers, test scores, timestamps, and completion metrics.
• Handwritten Exam Submissions: Camera images or photos of handwritten answer scripts that you voluntarily upload for automated rubric-based grading.
• Study Room & Community Activity: Messages and interactions you post inside multiplayer study rooms, Super Rooms, and student discussion feeds.
• Peer Marketplace Transactions: If you sell study notes, we store your chosen bank code, account number, and verified account name to facilitate transfer withdrawals. If you purchase notes, we store transaction receipt references generated by our payment partner. We never store payment card numbers, CVVs, or bank login PINs.
• Essential Technical Logs: IP address, browser user-agent, and session identifiers collected strictly to maintain login security, combat spam, and enforce rate limits.

3. How Authentication and Sessions Work

CampusPrep uses Supabase Authentication for user access control. When you register, a secure user account record is created in our database. Email verification is enforced using 6-digit confirmation tokens or verified email links.

Upon signing in, cryptographic JSON Web Tokens (JWT) are issued to your browser and stored in your browser's standard localStorage (under keys prefixed with sb-). This allows your session to remain securely authenticated across page reloads without exposing your password.

4. How Information Is Stored and Secured

Your account data and exam histories are stored in a managed PostgreSQL database powered by Supabase. We enforce database-level Row-Level Security (RLS) policies so that only you (and authorized system administrators performing support duties) can access your private mock attempts and personal settings.

All data transmitted between your browser and our servers is encrypted using modern Transport Layer Security (TLS/HTTPS). Stored passwords are cryptographically hashed using industry-standard hashing algorithms (Bcrypt/Argon2).

Security Notice: While we implement rigorous, production-grade technical and organizational safeguards, no internet transmission or electronic storage method can ever be guaranteed as 100% impenetrable. We do not make unrealistic absolute security claims, but we continuously audit and patch our infrastructure.

5. Artificial Intelligence (AI) Processing & Third-Party AI Providers

CampusPrep integrates artificial intelligence to generate practice questions, compute model answers, and evaluate student submissions:

• Third-Party AI Service: We utilize Google Gemini APIs (provided by Google LLC / Google Cloud Platform) via secure server-side API requests.
• What Data Is Sent: When you generate a mock test or study room quiz, academic metadata (such as course codes, course titles, academic topics, and difficulty) is sent to the AI API. When you submit a handwritten exam for grading, the uploaded photo of your handwritten work is transmitted to the AI API for multimodal optical text and reasoning analysis against the marking rubric.
• What Is NOT Sent: We never transmit your account password, email address, payment card details, or bank payout credentials to AI models.
• Model Training: Under standard Google Cloud enterprise API terms, customer API inputs and prompts are not used by Google to train public consumer foundational models.

6. Categories of Third-Party Service Providers

We work with trusted third-party cloud service providers to power specific technical functions:

7. International Data Transfers

Because our underlying cloud infrastructure providers (Google Cloud and Supabase) operate enterprise data centers located in Europe and North America, personal data and academic records may be hosted and processed outside the Federal Republic of Nigeria.

Where international transfers occur, we ensure that providers offer robust security assurances, encryption in transit and at rest, and adhere to recognized international data protection benchmarks.

8. Data Retention, Account Deletion & Data Rights

We retain your personal data and study records only for as long as your account remains active. You maintain continuous control over your personal data:

• Immediate Account Deletion: You can permanently delete your account at any time by navigating to Settings > Delete Account. When you confirm deletion by typing "DELETE", our system immediately purges your profile, exam records, mock attempts, study room memberships, notifications, payout details, and authentication record from our live database.
• Data Correction: You can update your full name, university, faculty, department, level, and avatar directly within your Profile and Settings pages.
• Data Access & Portability Requests: You may request an export copy of the personal data associated with your account by contacting our privacy team.

9. User Rights under the Nigeria Data Protection Act (NDPA 2023)

In alignment with the Nigeria Data Protection Act (NDPA 2023) and applicable privacy principles, users retain specific statutory rights:

1. Right to be Informed: Transparent disclosure of how data is processed (as detailed in this Privacy Policy).
2. Right of Access: The right to request confirmation of whether we hold personal data concerning you and obtain a copy.
3. Right to Rectification: The right to correct inaccurate or outdated profile information.
4. Right to Erasure ("Right to be Forgotten"): The right to have personal data deleted when no longer required.
5. Right to Restrict or Object to Processing: The right to object to specific processing activities under certain conditions.
6. Right to Lodge a Complaint: You have the right to contact the Nigeria Data Protection Commission (NDPC) if you believe your privacy rights have been infringed.

10. Minors & Children's Privacy

CampusPrep is designed for students enrolled in tertiary and higher education institutions (universities, polytechnics, and colleges of education). We do not knowingly market to or solicit personal data from children under the age of 13. If you are under the age of 16, you should only use CampusPrep with the guidance and consent of a parent or guardian. If we learn that we have inadvertently collected personal data from a child under 13 without verification of parental consent, we will promptly delete that information.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect operational, legal, or regulatory updates. When changes are made, the "Last Updated" date at the top of this document will be revised. Significant changes will be announced through an in-app banner or via email.

12. How to Contact Us & Leave Claims

If you have questions, feedback, claims, or requests regarding this Privacy Policy or your personal information: