AAICBI Ecosystem — Privacy Policy
Last updated: [date] — Version 1.1 (draft)
1. Who We Are
This policy covers the AAICBI Ecosystem (the "Platform"), operated by Africa's AI Capacity Building Initiative ("AAICBI", "we", "us") as part of Futybills Tech Community, based in Uyo, Akwa Ibom State, Nigeria. This policy is specific to the Platform — it covers data collected through course registration, enrollment, assessments, and progress tracking, and works alongside (not instead of) any wider AAICBI/Futybills organisational privacy policy.
2. What We Collect
- Account information: your name, email address, and (optionally) phone number, when you register as a trainee.
- Course activity: which courses, modules, and lessons you access; assessment attempts, scores, and pass/fail results; certificates issued to you.
- Technical information: your IP address, captured briefly to enforce login rate limits that protect your account from unauthorised access attempts.
- Consent record: the date and time you agreed to this policy, kept as evidence that consent was actually given, not just requested.
- Notification records: when we send you an account or course email (see Section 9), we keep a record that it was sent (or that sending failed) — not the email content itself, and not tied to a copy of your email address beyond what's already in your account information above.
We do not collect more than this. If a future version of the Platform needs to collect something new, this policy will be updated first.
3. Why We Collect It (Lawful Basis)
We process your data on two grounds recognised under the Nigeria Data Protection Act 2023: your consent (given at registration, and withdrawable at any time — see Section 7), and contractual necessity — we can't actually deliver a course, grade an assessment, or issue a certificate without knowing who you are and tracking your progress through it.
4. How We Use It
- To create and maintain your trainee account.
- To let you enroll in and progress through courses.
- To administer and grade timed assessments securely.
- To issue and verify certificates of completion.
- To protect your account (rate limiting failed login attempts).
- To send you account and course emails — a verification email when you register, a password reset email if you request one, a notification when you unlock the next module in a course, and your assessment results after you submit an attempt (see Section 9). Verification and password-reset emails are essential to using the Platform. Module-unlock and assessment-result notifications are optional — contact us if you'd like them turned off for your account (a self-service toggle for this is planned but not built yet).
We do not sell your data. We do not use it for advertising. We do not share it with third parties except where Section 6 applies.
5. How Long We Keep It
We keep your account and course records for as long as your account is active, and for a reasonable period afterward to support certificate verification (see the Platform roadmap's M15 milestone) — currently planned as 3 years after your last activity, subject to review. You can request earlier deletion under Section 7.
6. Who We Share It With
We use third-party infrastructure to run the Platform — a hosting provider, a database provider, and (for the account and course emails described in Section 9) an email delivery provider — all acting only as data processors under our instructions, not as independent users of your data. If any of this infrastructure is hosted outside Nigeria, we take reasonable steps to ensure it offers a comparable level of protection, consistent with the Nigeria Data Protection Act's cross-border transfer requirements. We do not share your data with any other third party without telling you first, except where required by law.
7. Your Rights
Under the Nigeria Data Protection Act 2023, you have the right to:
- Ask what personal data we hold about you.
- Ask us to correct inaccurate data.
- Ask us to delete your data, subject to Section 5's certificate-verification exception.
- Withdraw your consent at any time (this may limit your access to the Platform).
To exercise any of these rights, contact us at the address in Section 10. We aim to respond within a reasonable time.
8. How We Protect It
Passwords are never stored in plain text. Assessment answers are never sent to your browser before you submit. Access to trainee and course data is restricted by role — only staff who created a course can edit it. Login attempts are rate-limited against brute-force guessing.
9. Notifications
The Platform sends email notifications for: account verification and password resets (essential — needed to use the Platform), and unlocking the next module in a course or receiving an assessment result (optional — see Section 4 for how to turn these off). If your assessment result is configured to be released later rather than shown immediately, no result email is sent until you can see that result yourself in the Platform — the two are never out of sync.
WhatsApp notifications are not active yet — this section will be updated when that changes. See Section 6 for who processes notification content on our behalf.
10. Contact
For any question about this policy or your data, contact AAICBI at [insert contact email] or in writing at [insert AAICBI address, Uyo, Akwa Ibom State, Nigeria].
11. Changes to This Policy
If this policy changes in a way that affects how your existing data is used, we will take reasonable steps to let registered trainees know before the change takes effect.
12. Cookies & Anonymous Analytics
When you visit the Platform's public pages, a banner asks whether we can use a cookie to understand how visitors use the site — this is entirely opt-in: nothing is tracked unless you actively click "Accept", and declining (or simply not answering) means nothing is set and nothing is recorded.
If you accept, we set two first-party cookies:
- aaicbi_cookie_consent — remembers your choice, so you're not asked again.
- aaicbi_visitor_id — a random, anonymous identifier with no name, email, or other identifying information attached to it, used only to recognise repeat visits from the same browser.
With that cookie, we record which pages and courses you view, what you search for in the course catalogue, a coarse category of what device you're on (mobile, desktop, or tablet — never the exact device or browser), and a coarse category of how you arrived (search, social, a direct visit, or a link from somewhere else) — never the exact page you came from. This data is anonymous and is not linked to anything that identifies you.
If you go on to register for an account on the same browser that already accepted this cookie, we connect your prior anonymous browsing to your new account — for example, a course you looked at before signing up can inform what we show you as relevant once you're a trainee. From that point on, your account activity is covered by Section 2 above, not this section.
We keep this anonymous data for up to 180 days. You can withdraw at any time — clearing your browser's cookies has the same effect, or use the control below to reset your choice on this device right now.