Privacy Policy — ScholarXcel

1. Who Is Responsible for Your Data

CISD Nigeria, the company behind ScholarXcel, is the data controller for personal data collected through this platform. If you have any questions about how we handle your data, contact us at support@scholarxcel.ng.

2. What Data We Collect

We collect only what is necessary to provide the ScholarXcel service. Here is a breakdown:

Category	Data collected	Why we collect it
Account	First name, last name, email address, password (hashed)	Create and secure your account
Academic profile	Institution, programme, current level, enrollment year, matriculation number, grading scale, active semester	Calculate your CGPA and build your academic plan
Course & grade data	Course codes, titles, credit units, scores, letter grades, grade points, semesters	Track progress and generate CGPA projections
Uploaded documents	Result sheets and transcripts you upload (PDF or image)	AI-assisted grade extraction only; documents are not retained after processing
Contact info	Phone number, WhatsApp number (optional)	Important platform updates
Goals & strategy	Target CGPA, classification goal, course targets	Power the backward-planning engine
Usage data	Pages visited, timestamps, session data	Improve the platform; analytics
Referral data	Referral codes used, who you referred	Award ScholarPoints for referrals

3. How We Use Your Data

Provide the service — calculate CGPA, generate academic strategies, match you with opportunities.
AI features — result sheets you upload are sent to Anthropic's Claude API solely for text extraction. Anthropic processes the data on our behalf and does not use it to train their models. Extracted data is returned to ScholarXcel and stored in your account; the raw document is not retained.
Communications — transactional emails (account verification, password reset) sent via Mailjet. We will only send marketing emails with your explicit consent.
Security — detect and prevent fraud, abuse, and unauthorised access.
Analytics — understand how students use the platform so we can improve it.
Rewards — track ScholarPoints earned through referrals and engagement.

4. Third-Party Services We Use

We work with the following trusted third parties who may process your data on our behalf:

Anthropic (Claude API) — processes uploaded documents for AI grade extraction. Anthropic Privacy Policy ↗
Mailjet — sends transactional emails. Mailjet Privacy Policy ↗
Amazon Web Services (S3) — stores verification documents you upload for trust-level upgrades. Data is stored in encrypted buckets. AWS Privacy Policy ↗
Render — our cloud hosting provider. Your data is stored on Render's PostgreSQL database. Render Privacy Policy ↗
Sentry — error tracking. Error reports may include anonymised request data. Sentry Privacy Policy ↗

We do not sell, rent, or trade your personal data with any third party for marketing purposes.

5. Data Storage & Security

Your data is stored on servers located within cloud infrastructure (Render, AWS). We protect it with:

Encrypted connections (HTTPS/TLS) for all data in transit.
Hashed passwords — we never store your password in plain text.
Encrypted storage for sensitive verification documents (AWS S3).
Access controls limiting which team members can access production data.

No system is perfectly secure. If we ever discover a breach that affects your data, we will notify you promptly in accordance with applicable Nigerian law.

6. How Long We Keep Your Data

Account data — kept for as long as your account is active.
Uploaded documents — raw files are not retained after AI extraction is complete.
Usage logs — retained for up to 12 months for security and analytics purposes.
After account deletion, we may retain anonymised, aggregated data (e.g., platform-level statistics) that cannot identify you.

7. Your Rights

You have the following rights regarding your personal data:

Access — request a copy of the personal data we hold about you.
Correction — ask us to correct inaccurate data. Most data can be updated directly in your profile.
Deletion — request deletion of your account and associated personal data.
Portability — request your data in a structured, machine-readable format.
Objection — object to us processing your data for analytics or marketing purposes.

To exercise any of these rights, email us at support@scholarxcel.ng. We will respond within 14 business days.

8. Cookies & Local Storage

ScholarXcel uses:

Session cookies — to keep you logged in during a browser session.
CSRF cookies — to protect forms from cross-site request forgery attacks.
localStorage — to remember UI preferences (e.g., whether you have dismissed a prompt or completed the onboarding tour). No personal data is stored in localStorage.

We do not use advertising or tracking cookies from third parties.

9. Children's Privacy

ScholarXcel is not intended for children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a minor has registered, please contact us and we will delete the account promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email or an in-app notice and update the "Last updated" date at the top. Continued use of ScholarXcel after the changes take effect constitutes your acceptance of the revised policy.

11. Contact Us

For any privacy-related questions or to exercise your data rights, contact:

Email: support@scholarxcel.ng
Organisation: CISD Nigeria