DRAFT - needs legal review (draft, needs lawyer review). Prepared from an internal research pack, not legal advice. Must be checked by counsel in Nigeria, Ghana, Sierra Leone, The Gambia, Liberia and Switzerland before launch. Items in [brackets] are placeholders.
Privacy notice
GradeRadar helps students revise for WASSCE. Most of our users are under 18, so we collect as little as possible and ask a parent or guardian before we keep a child’s data on our servers.
Version: 2026-10-draft · Effective: [DATE]
Who we are (controller): [COMPANY LEGAL NAME], [REGISTERED ADDRESS], company no. [REGISTRATION NUMBER].
Contact: [PRIVACY EMAIL] · WhatsApp [SUPPORT NUMBER] · Data protection officer: [DPO NAME / FIRM, EMAIL]
Local representative (Nigeria): [NAME, ADDRESS] · (Ghana): [NAME, ADDRESS] · Ghana DPC registration no. [NUMBER] · NDPC registration [NUMBER / not required: confirm DCPMI tier]
The short version (for students)
- You can practise without an account. Your answers stay on your phone.
- If you want a cloud backup and you are under 18, your parent or guardian has to agree first.
- We never sell your data, never show ads, and never show your real name or school publicly.
- You can download or delete everything at any time.
What we collect and why
| Data | When | Why | Legal basis |
|---|---|---|---|
| Practice history, settings, optional name and nickname | Always, on your device only (browser storage) | To run the app offline | Strictly necessary to provide the service you asked for |
| Optional first-party analytics: browser identifier, page and subject categories, and activity counts | Only if you accept the updated cookie banner; stored in GradeRadar’s Cloudflare D1 analytics database | To improve the app | Consent (GAID 2025 Art. 19) |
| Text of a Paper 2 answer, a tutor question or a repair explanation request | Only when AI features are on and you use them | To mark or explain | Consent; for under-18s, a parent’s consent [confirm with counsel] |
| Sign-in phone (WhatsApp) or email | Only if you create a cloud account | To sign you in and stop misuse | Consent / contract [confirm] |
| Nickname, country, whether you are under 18, exam year, practice results | Only with a cloud account | Backup and sync between phones | Consent; for under-18s, verified parental consent (NDPA 2023 s.31) |
| Consent records (what was agreed, which version, when, how) | With a cloud account | To prove consent, as the law requires | Legal obligation |
| Parent or guardian’s sign-in phone or email | When a parent gives consent | To verify and record who consented | Legal obligation (NDPA s.31; Ghana Act 843) |
| Security logs: time, route, status and a keyed one-way hash of your IP | Each AI request | Rate limits and abuse prevention | Legitimate interest [confirm availability for minors] |
We do not collect your real name, date of birth, school, photo, location, contacts or ID documents on our servers. We ask only “are you 18 or older?”.
Children and parental consent
Nigeria’s Data Protection Act 2023 and the GAID 2025 treat everyone under 18 as a child and require a parent’s or guardian’s consent before a child’s data is processed. Ghana’s Data Protection Act 2012 (Act 843) protects children’s data as special personal data [VERIFY age and section]. Sierra Leone, Liberia and The Gambia do not yet have a data protection law in force (The Gambia’s 2025 Act has not yet commenced [VERIFY]); we apply the same under-18 rule there.
How it works: a student under 18 can practise straight away with everything kept on the phone. To back up to the cloud, the student sends a consent link to a parent or guardian. The parent signs in with their own phone or email (a one-time code), reads this notice and agrees. We record the parent’s sign-in, the notice version and the time. Until then the student’s progress is not stored on our servers. A parent can withdraw consent at any time from the same page; we then delete the cloud copy. Accounts still waiting for consent after 30 days are deleted. Schools may confirm parental consent for a class with a teacher join code [requires a data sharing agreement with the school].
AI features and automated marking
AI marking and the AI tutor are provided through [AI PROVIDER NAME] acting as our processor under a data processing agreement with no training on your data and [zero / 30-day] retention. Before text leaves your phone, and again on our server, we remove phone numbers, email addresses and your saved name and nickname. The AI tutor answers only from GradeRadar’s own question bank. AI marks are automated, labelled as such, are never official grades, and are never used alone for anything significant. Low-confidence marks go to a teacher, and you can ask for a human review of any AI mark. You can turn AI off in Settings.
Where your data is stored (international transfers)
Cloud accounts are hosted by [HOSTING PROVIDER, e.g. Supabase Inc.] in [REGION, e.g. EU (Frankfurt)]; the website and AI proxy run on [Vercel / Netlify / Cloudflare]; AI requests go to [AI PROVIDER] in [COUNTRY]. These countries are not on Nigeria’s or Switzerland’s adequacy lists [VERIFY], so we rely on [standard contractual clauses / consent] as required by NDPA ss.41–43 and the Swiss FADP Art. 16.
Who we share data with
- Our processors listed above, only to run the service.
- Your school, only if you join a class with a school code and the school has signed a data sharing agreement.
- Authorities, only where the law requires it.
We never sell data, never use it for advertising, and never send marketing to children. Marketing (if you opt in) goes to adults and parents only, and you can opt out at any time.
How long we keep data
- On your device: until you delete it in Settings or clear your browser.
- Cloud account: until you delete it; accounts unused for [24 months] are deleted after a reminder.
- Pending consent requests: 30 days.
- Consent records: [the period counsel advises] after the account ends, to prove consent.
- Security logs: [30 days].
Your rights
You (or your parent, if you are under 18) can access, correct, export or delete your data, withdraw consent and object to processing. Use Settings → Export all data / Delete all data for this device and Cloud account → Export my data / Delete my account for the cloud. Both take effect immediately. Or write to [PRIVACY EMAIL]; we reply within [30 days].
You can complain to the Nigeria Data Protection Commission (ndpc.gov.ng), the Data Protection Commission of Ghana (dataprotection.org.gh), the Swiss FDPIC (edoeb.admin.ch), or the relevant authority where you live.
Security
Encrypted connections (HTTPS), row-level access control so each account can read only its own data, signed short-lived sessions and rate limits on AI features, and logs that contain no names, contacts or message text. If a breach affects you we will tell you and the regulators as the law requires [NDPA: 72 hours to NDPC].
Analytics choices
Analytics is optional. Declining does not affect practice. No names, answer text, scores, question IDs, IP addresses or full URLs are stored as analytics fields. The owner-only dashboard reports consenting browsers, not verified people. The reporting window is 90 days; older events and browser identifiers inactive for 180 days are removed in bounded batches when the service is used. Cookie settings lets you withdraw and delete data linked to the current analytics cookie. See the storage notice for details.
Cookies and storage
See the cookie and storage notice.
Changes
If we change this notice in a way that affects you, we will tell you in the app and, where consent is needed, ask again.