Privacy Policy for Ace Acad

Effective Date: August 17, 2026

Last Updated: August 17, 2026

Version: 1.0.0

1. INTRODUCTION

Ace Acad (“Ace Acad”, “we”, “us”, or “our”) is an educational mobile application developed and operated by WSTAR (“World of Science, Technology, Advancement & Research”), located at Ahmadu Bello University, Zaria, Kaduna State, Nigeria.

Ace Acad helps university undergraduates manage coursework, access curated study paths, review course materials offline, and test their academic knowledge through structured session quizzes. We are firmly committed to respecting and protecting student data privacy in strict compliance with the Nigeria Data Protection Act 2023 (NDPA).

2. DATA CONTROLLER & CONTACT DETAILS

Data Controller: WSTAR (World of Science, Technology, Advancement & Research)
Physical Address: Ahmadu Bello University, Zaria, Kaduna State, Nigeria
General Inquiries: wstar5552@gmail.com
Data Protection & Support: support@wstartech.ng / privacy@wstartech.ng

3. PERSONAL DATA WE COLLECT

We strictly adhere to the principle of data minimization under Section 24 of the NDPA 2023. We collect only the information necessary to deliver and personalize your academic experience:

3.1 Information You Provide Directly

  • Full Name: To personalize your student dashboard and academic records.
  • Email Address: Used as your unique account identifier, for authentication, password recovery, and service notices.
  • Password: Handled securely via Google Firebase Authentication in salted and hashed form. We never store or view plain-text passwords.
  • Academic Information: Faculty (e.g., Engineering, Science), Department (e.g., Mechatronics Engineering), and Year of Admission (e.g., 2025, 2026) to match you with foundational course syllabi.
  • Feedback & Messages: Bug reports, feature suggestions, and inquiries submitted via the in-app feedback tool or email.

3.2 Information Collected Automatically

  • Study Progress: Enrolled courses, completed syllabus topics, quiz scores, and daily study activity timestamps (to power the 7-day study rhythm tracker).
  • App Telemetry (Firebase Analytics): Screen view events, session duration, login/signup method, and device metadata (operating system version, device model) for stability monitoring and diagnostics.
  • Account Timestamps: Account creation timestamp and last active session date.

3.3 What We DO NOT Collect

To ensure transparency, Ace Acad does NOT collect:

  • ❌ GPS or precise geolocation data (no location permissions are requested).
  • ❌ Device photos, camera, microphone, or external storage access.
  • ❌ Payment card details, BVN, or financial data (Ace Acad MVP is 100% free).
  • ❌ Sensitive biometric, health, or political data.

4. LAWFUL BASES FOR PROCESSING (NDPA SECTION 25)

  • Performance of a Contract (Sec 25(1)(b)): Necessary to provide your user account, deliver personalized study paths, record quiz progress, and sync offline study packs.
  • Legitimate Interests (Sec 25(1)(f)): Platform stability diagnostics, crash reporting, and cybersecurity protection.
  • Consent (Sec 25(1)(a)): Optional feedback submissions and support requests.
  • Legal Obligation (Sec 25(1)(c)): Compliance with statutory directives under Nigerian law.

5. ON-DEVICE STORAGE & OFFLINE CACHING

To enable seamless study in low-connectivity campus environments:

  • Downloaded Course PDFs: Saved in Android's sandboxed private app directory (inaccessible to other non-root applications).
  • Drift SQLite Database: An on-device database (db.sqlite) indexes downloaded materials for instant offline verification.
  • Local Preferences: SharedPreferences store your theme selection (Light/Dark) and cached course listings.
  • User Control: You can clear all cached course PDFs at any time via the in-app Download Manager or More > Clear Offline Cache.

6. THIRD-PARTY SUB-PROCESSORS

We do not sell or monetize student data. We share data solely with verified technical cloud providers under binding Data Processing Addenda:

  • Google LLC (Firebase): Authentication, Cloud Firestore database, Firebase Storage for courseware, and Firebase Analytics. Governed by Google Cloud Data Processing Addendum and Standard Contractual Clauses (SCCs).
  • Google Sign-In: Federated OAuth 2.0 social login.

7. CROSS-BORDER DATA TRANSFERS (NDPA PART VIII)

Google Firebase servers are hosted in secure data centers globally (primarily US and EU). In compliance with Sections 41–43 of the NDPA 2023, transfers are safeguarded by enterprise Standard Contractual Clauses, contractual necessity for syncing your cloud account, and your explicit acknowledgement during registration.

8. DATA RETENTION & PURGE SCHEDULE

  • Active Account Data: Retained while your account remains active.
  • Account Deletion: Upon receiving an account deletion request (via the app or web portal), all profile records, enrollments, progress, and authentication credentials are permanently purged within 14 calendar days.
  • Inactivity: Accounts inactive for more than 24 consecutive months are scheduled for deletion following email notification.

9. YOUR STATUTORY DATA SUBJECT RIGHTS

Under the Nigeria Data Protection Act 2023 (Sections 34–40), you have the right to:

  • Access: Request a copy of all personal records we hold about you.
  • Rectification: Correct inaccurate faculty, department, or profile info.
  • Erasure: Permanently delete your account and all associated data.
  • Data Portability: Export your study data in a machine-readable JSON format (available self-service in-app under More > Export My Data).
  • Restriction & Objection: Restrict or object to processing for legitimate interest grounds.

To exercise your rights, use the in-app controls or email our compliance team at privacy@wstartech.ng. We respond within statutory timelines (30 days).

10. CHILDREN & MINORS (NDPA SECTION 31)

Ace Acad is designed for university undergraduate students. Under Nigerian law, individuals under 18 are minors. Students aged 16–17 entering 100-Level affirm during registration that they have obtained parental or guardian permission to register and use the service. We do not knowingly collect data from children under 13.

11. REGULATORY AUTHORITY COMPLAINTS

You have the statutory right to lodge a complaint with the national supervisory authority:

Nigeria Data Protection Commission (NDPC)
Website: https://ndpc.gov.ng
Email: info@ndpc.gov.ng
Address: No. 5, Donau Crescent, Off Amazon Street, Maitama, Abuja, Nigeria

12. CONTACT US

For privacy inquiries, contact: WSTAR Data Protection Lead
Email: privacy@wstartech.ng / support@wstartech.ng
Website: https://www.wstartech.ng