Privacy Policy for Ace Acad

Effective Date: August 17, 2026

Last Updated: October 1, 2026

Version: 1.1.0

1. Introduction

Ace Acad (“Ace Acad”, “we”, “us”, or “our”) is an educational technology mobile platform developed and operated by WSTAR TECHNOLOGIES LTD (“WSTAR”, World of Science, Technology, Advancement & Research), a company registered in Nigeria, located at Ahmadu Bello University, Zaria, Kaduna State, Nigeria.

Ace Acad is designed to help university undergraduates manage coursework, access curated study paths, review course materials offline, and test their academic knowledge through structured session quizzes.

We are firmly committed to respecting and protecting the privacy and personal data of our users. This Privacy Policy explains what personal information we collect, why we collect it, how it is processed and stored, who it may be shared with, and the statutory rights available to you under the Nigeria Data Protection Act 2023 (NDPA) and applicable data protection regulations.

2. Scope & Applicability

This Policy applies to:

• Registered student users of the Ace Acad mobile application;
• Prospective students and visitors accessing Ace Acad services or web portals;
• Individuals communicating with Ace Acad or WSTAR support channels.

This Policy does not apply to:

• Third-party websites, services, or platforms linked from our application;
• Institutional university portals (such as official university admission or registration portals) that operate independently of Ace Acad.

3. Data Controller & Contact Information

Data Controller: WSTAR TECHNOLOGIES LTD (World of Science, Technology, Advancement & Research)
Address: Ahmadu Bello University, Zaria, Kaduna State, Nigeria
Contact Email: support@wstartech.ng / wstar5552@gmail.com
Data Protection Support: privacy@wstartech.ng

4. Personal Data We Collect

We adhere strictly to the principle of data minimization under Section 24 of the NDPA 2023. We collect only the personal information necessary to deliver and improve the Ace Acad service.

4.1 Information You Provide Directly

When creating an account, completing your student profile, or interacting with our app, we collect:

• Full Name: To personalize your student dashboard, greetings, and study records.
• Email Address: Used as your unique account identifier, for authentication, password recovery, and essential service notices.
• Password: Stored in cryptographically salted and hashed form via Google Firebase Authentication. We never have access to your plain-text password.
• Academic Profile Information:
  • Faculty (e.g., Faculty of Engineering, Faculty of Science);
  • Department (e.g., Department of Mechatronics Engineering, Department of Computer Science);
  • Year of Admission (e.g., 2025, 2026);
  • Set (class), current level and entry mode (e.g., U21, 500L, Direct Entry).
  Purpose: To deliver academic course materials, curriculum modules, and study paths tailored to your specific department and study level, and to show you your class's tests, assignments, timetable and announcements.
• Registration Number (optional): To show you your project/lab group and to name your CBT results and assignment submissions for your lecturer. One account may claim a registration number.
• Assignment Work: Text you type and files you attach (e.g. PDFs, photos of handwritten work) when you hand in an assignment, kept for your lecturer with their grade and feedback.
• Photos and Files You Choose to Send for Reading: Photos or PDFs of a timetable (students) or a test paper (lecturers/Ace-Reps), and photos of your working in a mock exam, are sent to our server and AI providers to be read. Pages are captured with the on-phone document scanner (Google ML Kit). Photos are not kept afterwards; a PDF a lecturer uploads for this is kept in their private upload folder. Scanned files Ace-Reps share with a class are read by AI first to check they hold no students' personal data.
• Mock Exam Answers and Simulated Results: Your mock answers (typed, photographed or drawn) are sent to our AI providers to be marked against the marking guide. Your marks, typed answers and the AI's comments are kept in your account for review; the photos stay on your phone. For the simulated result we keep the CA you expect, your course units and, if you give it, your CGPA so far.
• Questions to the AI Tutor: The questions you type, sent with extracts of your course's study guide to our AI provider to write an answer. The conversation is stored only on your phone; we keep a daily count of questions per account to enforce fair-use limits.
• Content Reports: What you report about a material, question, topic or flashcard, and why.
• Feedback & Inquiries: Feedback and complaints sent in the app are also emailed (via Gmail) to the Ace-Acad team at wstar5552@gmail.com with your name, email, class, app version and any screenshot you add, so we can reply. When you submit bug reports, feature requests, or support messages via our in-app "Send Feedback" feature or email, we collect your message content, feedback category, and associated user ID.

4.2 Information Collected Automatically Through App Use

When you use the Ace Acad mobile app, our system records:

• Course Enrollments & Study Progress: The courses you add to your dashboard, topics marked complete, modules completed, and your last active study timestamp.
• Daily Study Activity: Date-level indicators recording whether a study session occurred on a given day (to power your 7-day study rhythm view).
• Quiz Performance Data: Quiz scores, topic completion records, and question response accuracy.
• Diagnostic & Telemetry Data (Firebase Analytics): Screen view events, session start/end timestamps, app login/signup method (email vs. Google), and anonymous device metadata (operating system version, device model).
• Account Timestamps: Account creation timestamp (createdAt) and last active timestamp (lastSeen).
• CBT Tests: Your answers, start/submit times, the number of times you left the app during a test, and a random identifier for your app installation (so a test continues only on the phone it started on). Results are marked on our server and shown to your lecturer.
• Location Checks (location-locked tests only): When a lecturer requires you to be at the test venue, the app reads your location once when you start the test and compares it with the venue on your phone. Your location is not stored or sent to us. No location is read at any other time.
• Games: Your score per game; your first name and best score appear on that course's weekly leaderboard, visible to other students.
• Timetable & Reminders: Your class timetable and classes you add; reminders are scheduled on your phone.

4.3 What We DO NOT Collect

To prevent ambiguity and adhere strictly to verified system behavior:

• ❌ We do not track your location. Location is read only at the start of a location-locked CBT test, checked on your phone, and never stored or sent to us.
• ❌ We do not access your camera, photos or files except when you choose to take or attach one (assignments, reading a timetable or test paper). We never access your microphone, contacts or media library in the background.
• ❌ We do not collect payment card numbers, bank verification numbers (BVN), or financial data (Ace Acad MVP is 100% free).
• ❌ We do not collect sensitive personal data such as biometric records, genetic data, health data, political opinions, or religious affiliations.

5. Lawful Bases for Processing (NDPA Section 25)

Under Section 25 of the Nigeria Data Protection Act 2023, we process your personal data under the following lawful bases:

6. On-Device Storage & Local Caching

To support low-connectivity and offline study environments across Nigerian university campuses, Ace Acad stores select data locally on your device:

• Downloaded Course PDFs: When you tap "Download Course" or "Download Material", PDF files are downloaded from cloud storage and saved exclusively in the app's sandboxed, private documents directory (/data/data/com.example.aceAcadMobile/app_flutter/courses/).
• Local Database (Drift SQLite): The app maintains a local SQLite database (db.sqlite) tracking which course materials have been downloaded for offline access.
• Preferences (SharedPreferences): Your chosen theme mode (Light, Dark, System) and cached course catalog listings are stored locally for fast startup.
• Data Wipe: You can delete all local downloaded materials at any time via the in-app Download Manager or by clearing app storage in your Android system settings.

7. Artificial Intelligence & Pedagogical Content

• Generated Study Content: Study guides, flashcards and practice questions are written by AI from each course's lecture notes and past questions. Generation refuses pages it cannot read. Content built from an Ace-Rep's upload is checked by an Ace-Rep before students see it. AI-written practice is kept separate from real past questions, and students can report errors.
• AI Tutor: Answers are generated instantly by an AI model from your course's study guide and are not reviewed by a person; they may contain errors.
• No Real-Time Automated Profiling: The mobile application does not subject users to automated legal profiling or automated decisions that produce legal or significant adverse effects.
• Academic Disclaimer: AI-assisted study guides and quiz explanations are designed as supplementary educational aids. They do not replace official university lectures, textbooks, or institutional grading rubrics.

8. Data Sharing & Third-Party Processors

We do not sell, rent, lease, or monetize your personal data to third parties, advertisers, or data brokers.

We disclose personal data strictly to verified technical service providers (Data Processors) under binding contractual safeguards:

Within Ace Acad, lecturers and Ace-Reps see results of tests they set and submissions to assignments they set; Ace-Acad administrators can see account profile details (name, email, class, level, department, registration number) to run the service and support students. Other students see only your first name and score on game leaderboards.

All technical processors are bound by written Data Processing Addenda complying with NDPA requirements, obligating them to implement robust technical security measures and process data solely on our instructions.

Legal Disclosures

We may disclose personal data if required to do so by Nigerian law, a valid court order, a formal request from law enforcement under the Cybercrimes Act 2015 (as amended 2024), or to protect the vital interests and safety of students and the platform.

9. Cross-Border Data Transfers (NDPA Part VIII)

Ace Acad operates using Google Firebase and Google Cloud infrastructure, which stores and processes data on secure servers located outside Nigeria (principally in the United States and European Union regions).

In accordance with Sections 41, 42, and 43 of the Nigeria Data Protection Act 2023:

• Transfers are conducted pursuant to Google Cloud's Data Processing Addendum and Standard Contractual Clauses (SCCs), providing international-grade organizational and technical safeguards;
• Transfers are necessary for the performance of our service contract with you (NDPA Section 43(1)(b)) to synchronize your study progress and account across devices;
• By registering for Ace Acad, you acknowledge and consent to the secure cross-border transfer and storage of your account data on Google Cloud servers (NDPA Section 43(1)(a)).

10. Data Retention & Deletion Schedule

We retain personal data only for as long as necessary to fulfill the educational purposes for which it was collected:

• Active User Profile Data: Retained for the lifetime of your active account.
• Study Progress & Quiz Records: Retained while your account is active to maintain your learning history.
• Feedback Submissions: Retained for up to twelve (12) months to resolve technical issues and improve features, after which they are anonymized.
• Account Inactivity: Accounts inactive for more than twenty-four (24) consecutive months may be queued for deletion following email notification.
• Account Deletion: When you request account deletion, all personal data in users/{uid}, enrollments, progress, and activity records are permanently purged from active Firestore databases, your Firebase Auth record is deleted, and local cached data is removed within fourteen (14) days. Deleting the account also removes, automatically, your CBT attempts and results, assignment submissions and their files, game leaderboard rows, content reports, AI-tutor usage counters and private uploads. Copies a lecturer has already exported (e.g. a results spreadsheet) are held by that lecturer.
• Test Results & Assignments: Retained while your account is active so you and your lecturer can see them for the session.

11. Data Security Measures

We implement robust technical and organizational measures to safeguard your personal data:

• Transport Layer Encryption: All data transmitted between the Ace Acad mobile app and backend servers is encrypted in transit using TLS 1.3 / HTTPS.
• Credential Protection: Passwords are never stored in plain text; authentication is managed securely through Firebase Auth using salted hashing.
• Application Sandbox: Local SQLite data and downloaded course files are stored in Android's private app sandbox, preventing access by unauthorized third-party applications.
• Cloud Storage Rules: Firebase Storage rules enforce authenticated-only access (request.auth != null) and disable client-side write access.
• Least-Privilege Access: Administrative access to backend database infrastructure is restricted to authorized WSTAR technical personnel using multi-factor authentication.

12. Your Statutory Data Subject Rights

Under the Nigeria Data Protection Act 2023 (Sections 34–40), you have the following rights regarding your personal data:

• Right of Access (Section 34(1)(b)): You have the right to request a copy of the personal data we hold about you.
• Right to Rectification (Section 34(1)(c)): You have the right to correct inaccurate or incomplete profile information.
• Right to Erasure / Right to be Forgotten (Section 34(1)(d)): You have the right to request the permanent deletion of your account and personal records.
• Right to Restriction of Processing (Section 34(1)(e)): You have the right to request that we temporarily restrict the processing of your data in specific circumstances.
• Right to Data Portability (Section 34(1)(f)): You have the right to receive your personal data and study history in a structured, commonly used, and machine-readable JSON format.
• Right to Object (Section 34(1)(g)): You have the right to object at any time to the processing of your personal data for direct marketing or based on legitimate interests.
• Right to Withdraw Consent (Section 35): Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of prior processing.

How to Exercise Your Rights

• In-App Self-Service: You can export your data or initiate account deletion directly from the app: More > Export My Data and More > Delete Account.
• Web Deletion Portal: You can submit an account deletion request online at wstartech.ng/products/ace-acad/account-deletion.
• Email Requests: You can contact our Data Protection team at privacy@wstartech.ng or support@wstartech.ng. We will verify your identity and respond to your request within thirty (30) days in accordance with statutory timelines.

13. Children & Minors' Privacy (NDPA Section 31)

Ace Acad is designed as a higher-education academic study tool for university undergraduate students.

Under the Child's Rights Act 2003 and Section 31 of the NDPA 2023, individuals under 18 years of age are classified as children/minors. In Nigeria, many 100-level university students are 16 or 17 years of age.

• If you are between 16 and 17 years old, you affirm during registration that you have obtained the permission of your parent or legal guardian to create an account, use the application, and agree to these terms.
• We do not knowingly collect personal data from children under the age of 13. If we discover that an individual under 13 has registered an account, we will immediately delete their account and associated data.

14. Regulatory Authority & Complaints

If you believe that your personal data has been processed in violation of the Nigeria Data Protection Act 2023, you have the right to lodge a complaint with the national supervisory authority:

Nigeria Data Protection Commission (NDPC)
Website: https://ndpc.gov.ng
Email: info@ndpc.gov.ng
Address: No. 5, Donau Crescent, Off Amazon Street, Maitama, Abuja, FCT, Nigeria

15. Changes to this Privacy Policy

We may update this Privacy Policy periodically to reflect enhancements to the Ace Acad application, changes in data practices, or updates to statutory requirements.

When material changes occur:

• We will update the "Last Updated" and "Version" indicators at the top of this document;
• We will provide prominent in-app notification upon your next login;
• Continued use of Ace Acad following notice of changes constitutes acknowledgement of the updated Privacy Policy.

16. Contact Us

If you have questions, feedback, or privacy-related inquiries, please reach out to us:

WSTAR TECHNOLOGIES LTD — Ace Acad Team
Ahmadu Bello University, Zaria, Kaduna State, Nigeria
General Inquiries: wstar5552@gmail.com
Customer & Account Support: support@wstartech.ng
Privacy & Data Rights: privacy@wstartech.ng
Website: wstartech.ng