Privacy Policy
Last updated: June 13, 2026
1. Introduction
Echelong Tech Ltd. ("we", "us", "our"), a company registered with the Corporate Affairs Commission (CAC) of Nigeria, operates GradeBoost AI ("the Platform"), an AI-powered educational tutoring service for secondary school students.
This Privacy Policy explains how we collect, use, store, share, and protect your personal data in compliance with the Nigeria Data Protection Act (NDPA) 2023, the General Application and Implementation Directive (GAID) 2025, the Child Rights Act 2003, and other applicable Nigerian laws.
Because our Platform serves secondary school students (typically aged 10–18), who are classified as children under Nigerian law, we take special care to protect their personal data as required by the NDPA and the Child Rights Act.
2. Data Controller
Echelong Tech Ltd. is the data controller responsible for your personal data. For any data protection inquiries, you may contact us at:
- Email: compliance@gradeboostapp.com
- Address: Block 4 Flat 3A, Lagos HOMS Estate, Durbar Road, Lagos State, Nigeria
3. Personal Data We Collect
We collect the following categories of personal data depending on your role:
3.1 Parents / Guardians
- Full name (first, middle, last)
- Email address
- Phone number
- Password (stored in encrypted form)
- Payment information (processed securely via Paystack — we do not store card details)
- Referral codes used
3.2 Students
- Full name (first, middle, last)
- Email address
- Age
- School and class level
- Academic performance data (report cards uploaded by parents)
- AI tutoring session history (questions asked, lessons completed, Q&A interactions)
- Performance analytics and progress data
3.3 School Administrators
- Full name
- Email address
- Phone number
- School name, address, and state
3.4 Automatically Collected Data
- IP address
- Browser type and version
- Device information
- Pages visited and usage patterns
- Cookies and similar tracking technologies
4. How We Use Your Data
We process your personal data for the following purposes:
| Purpose | Lawful Basis (NDPA Section 25) |
|---|---|
| Providing AI-powered tutoring and lessons | Performance of contract; Parental consent for children's data |
| Processing subscription payments | Performance of contract |
| Generating performance analytics and progress reports | Performance of contract; Parental consent |
| Sending transactional emails (receipts, notifications) | Performance of contract |
| Improving our Platform and AI content quality | Legitimate interest |
| Complying with legal and regulatory obligations | Legal obligation |
5. AI Data Processing
GradeBoost AI uses artificial intelligence to generate personalised lessons, Q&A sessions, and performance analytics. This involves the following:
- Data sent to AI providers: Student academic data (including report card content and performance information) is sent to third-party AI providers (OpenAI, Anthropic) via their APIs to generate personalised educational content.
- Storage: AI-generated content and conversation history are stored in our database to enable continuity of learning and progress tracking.
- No AI training: Your personal data is NOT used to train third-party AI models. Data is sent to AI providers solely for generating responses and is not retained by them beyond API request processing.
- Automated decision-making: The Platform uses AI to recommend lessons and assess understanding. These are educational aids and do not produce legal or similarly significant effects on any data subject. You may request human review of any AI-generated assessment by contacting us.
In accordance with NDPA Section 28, we have conducted a Data Protection Impact Assessment (DPIA) for our AI processing activities, given that we process children's data using innovative technologies.
6. Third-Party Service Providers
We share your data with the following third-party processors, each bound by data processing agreements:
| Provider | Purpose | Data Shared |
|---|---|---|
| Paystack | Payment processing | Parent name, email, payment details |
| OpenAI | AI content generation | Student academic data (anonymised where possible) |
| Anthropic | AI content generation | Student academic data (anonymised where possible) |
| Resend | Transactional emails | Email addresses, notification content |
7. Cross-Border Data Transfers
Our Platform is hosted on servers located outside Nigeria. Additionally, our third-party AI and email providers operate servers outside Nigeria. In accordance with NDPA Sections 43–44, we ensure that appropriate safeguards are in place for all cross-border data transfers, including:
- Data processing agreements with all third-party providers
- Selection of providers in jurisdictions with adequate data protection frameworks
- Technical security measures (encryption in transit and at rest)
By using our Platform and providing your consent during enrolment, you acknowledge and agree to the transfer of your data outside Nigeria subject to these safeguards.
8. Data Retention
We retain your personal data in accordance with the following schedule:
| Data Category | Retention Period |
|---|---|
| Active account data | Duration of your subscription |
| Cancelled/deleted account data | Deleted within 90 days of account closure |
| Payment and transaction records | 6 years (as required by the Federal Inland Revenue Service for tax compliance) |
| AI session logs | Deleted with account data upon closure |
After the retention period expires, your data is permanently and irreversibly deleted from our systems. The GAID 2025 default maximum retention period of six months after the original processing purpose has been accomplished applies unless a longer period is required by law.
9. Children's Data
Under the NDPA 2023 and the Child Rights Act 2003, all persons under 18 are classified as children. Since our Platform serves secondary school students, the following additional protections apply:
- Parental consent is mandatory: A parent or legal guardian must provide consent for all data processing related to their child. This consent is obtained during the enrolment process.
- Sensitive data classification: Children's data is classified as sensitive personal data under the NDPA, requiring explicit consent and enhanced safeguards.
- Best interests of the child: All processing of children's data is carried out in the child's best interest, primarily for educational purposes.
- Data minimisation: We collect only the data necessary to provide our educational services.
10. Your Rights
Under the NDPA 2023 (Sections 34–38), you (and parents/guardians on behalf of their children) have the following rights:
- Right of Access: Request a copy of the personal data we hold about you or your child.
- Right to Rectification: Request correction of inaccurate or incomplete data.
- Right to Erasure: Request deletion of your data when it is no longer necessary for the purpose it was collected, or when you withdraw consent.
- Right to Restrict Processing: Request that we limit how we use your data in certain circumstances.
- Right to Data Portability: Receive your personal data in a structured, commonly used, machine-readable format.
- Right to Object: Object to processing based on legitimate interests or for direct marketing purposes.
- Right Regarding Automated Decision-Making: Not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects.
- Right to Withdraw Consent: Withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
To exercise any of these rights, contact us at compliance@gradeboostapp.com. We will respond within 30 days.
11. Data Security
We implement appropriate technical and organisational measures to protect your personal data, including:
- Encryption of data in transit (TLS/SSL) and at rest
- Secure password hashing (bcrypt)
- Role-based access controls
- Regular security reviews
- Secure API communication with all third-party providers
12. Data Breach Notification
In accordance with NDPA Section 39, in the event of a personal data breach, we will:
- Notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of the breach
- Notify affected data subjects without undue delay if the breach is likely to result in a high risk to their rights and freedoms
- Document all breaches, including the facts, effects, and remedial actions taken
13. Cookies
Our Platform uses cookies and similar technologies for session management, security, and analytics. By using our Platform, you consent to our use of cookies. You may configure your browser to reject cookies, but this may affect the functionality of the Platform.
14. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email to registered users at least 14 days before they take effect. Continued use of the Platform after the effective date constitutes acceptance of the updated policy.
15. Complaints
If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with:
- GradeBoost AI: compliance@gradeboostapp.com
- Nigeria Data Protection Commission (NDPC): https://ndpc.gov.ng