Privacy Policy

1. Who we are

Akadaa is a school management service for Nigerian schools, colleges and universities. We are based in Kano, Nigeria. Akadaa is run by INTELLIYA CONSULT LTD, trading as Akadaa, RC 7827471. In this policy, "Akadaa", "we" and "us" mean that company and the Akadaa service. You can reach us at support@akadaa.com.

This policy follows the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Commission's General Application and Implementation Directive (GAID) 2025. Because some of our providers are in the European Union and elsewhere, we also aim to meet the standards of the EU General Data Protection Regulation where it applies.

2. Who is in charge of your information

The law separates the organisation that decides how information is used (the controller) from the one that handles it for them (the processor).

• Your school is the controller of the records it keeps about its students, parents and guardians, staff and applicants. The school decides what to record and why. If your school belongs to a group, the group (the organisation on Akadaa) may share this role.
• Akadaa is the processor for those records. We store and handle them only to run Akadaa for the school, under our Data Processing Agreement.
• Akadaa is the controller only for its own information: the accounts of school owners and administrators who sign up, billing and subscription records, support emails, the security records that keep the service safe, and the information of our sales agents and the people who apply to be one (section 13).

So if you are a student, parent or member of staff, your school is the first place to go with questions about your records.

3. What information is handled

School records (handled for the school)

• Students: names, admission numbers, dates of birth, gender, photos, classes or programmes, attendance, scores and results, fees and payments, documents the school uploads (for example birth certificates or previous results), and other records the school chooses to keep, such as hostel, health or clinical placement records.
• Parents and guardians: names, phone numbers, email addresses, home addresses, occupation and relationship to the student, and their replies to the school's requests and consent forms.
• Staff: names, contact details, roles, classes and subjects taught, and other staff records the school keeps.
• Applicants: what an applicant enters on a school's admission form, their guardian's details, previous school, uploaded documents and any payment proof.

Some records can be sensitive, such as health information. Schools should only record what they need for a clear school purpose.

Account and security information

• Your name, email address or phone number, role and school.
• Your password, which we store only as a scrambled (hashed) value, and your two-factor sign-in settings.
• Sign-in and activity records: the time, your IP address and your browser or device type.

Information we handle for ourselves

• Organisation details given at sign-up: school name, email address, phone number and type of school.
• Subscription and billing records, including payment receipts you upload.
• Emails you send to support@akadaa.com and messages you type into the in-app help assistant.
• A record of when your organisation accepted our terms and which version it accepted.

4. Children's information

Most students on Akadaa are under 18. We take extra care with their information.

• The school is responsible for having a lawful basis to record each child, and for getting a parent's or guardian's consent where the law requires it. Akadaa gives schools tools to send consent requests to parents and keep a record of each answer.
• We use children's information only to run Akadaa for their school. We never use it for advertising or sell it.
• When the applicant on an admission form is under 18, a parent or guardian should fill in the form or approve it.
• Students can use the AI Tutor. What they type is sent to an AI provider (see section 10). Their name is not sent with it, but students should not type personal details into it. A school can turn the AI Tutor off for all its students.

5. Why we use information, and our lawful basis

For school records, we act on the school's instructions, and the school relies on its own lawful basis (for example, a contract with parents, a legal duty, its legitimate interests, or consent). For the information we control:

• To provide Akadaa to your organisation: accounts, sign-in, sending service emails, billing and support. Basis: our contract with your organisation.
• To keep Akadaa secure: rate limits, sign-in protection, audit logs and fixing faults. Basis: our legitimate interest in a safe, working service.
• To meet legal duties, such as keeping financial records or answering lawful requests from authorities. Basis: legal obligation.
• To improve Akadaa, using support questions and how features are used. Basis: legitimate interest. We do not use analytics or tracking tools to do this.

We do not send marketing emails today. If we start, we will only do so in a way the law allows and you will be able to opt out easily.

6. Who we share information with

• Your school. School staff see records according to the role the school gives them. Parents see their own children's records once the school links them.
• Our providers (sub-processors), who help us run Akadaa. They are listed below and in our Data Processing Agreement.
• Sales agents. If a school signs up with a sales agent's link or code, that agent sees the school's name and whether it pays Akadaa for a paid plan, and nothing else about the school or its records (see section 13).
• Akadaa support staff, who may sign in as a user to fix a problem. Each time this happens it is recorded in an audit log.
• Authorities, when the law requires it. We will tell the school first unless the law stops us.
• A new owner, if Akadaa is ever sold or merged. They would have to protect information in the same way.

We do not sell personal information, and we do not share it with advertisers.

Our providers

• Railway

  In use

  What for

  Hosting for the Akadaa app and its database.

  What it receives

  Everything stored in Akadaa, including uploaded documents and photos, which are kept in the database.

  Where

  Railway's EU region (Amsterdam, Netherlands), for both the app and its database

• Resend

  In use

  What for

  Sending Akadaa's emails, and receiving email sent to akadaa.com addresses such as support@akadaa.com.

  What it receives

  Recipients' names and email addresses and the content of each email (for example notices, password links and application confirmations). Emails sent to our support address.

  Where

  Resend's EU (Ireland) region; Resend is a US company

• Google (Gmail)

  In use

  What for

  The mailbox that receives messages sent to support@akadaa.com and sales@akadaa.com (Resend forwards them there).

  What it receives

  Emails people send to our support and sales addresses, with their names and email addresses.

  Where

  Google's servers outside Nigeria

• Upstash

  In use

  What for

  Rate limiting, to slow down password guessing and abuse of public forms.

  What it receives

  IP addresses, account IDs and some email addresses, used as short-lived counters.

  Where

  Upstash cloud servers outside Nigeria

• DeepSeek

  In use

  What for

  AI features: the help assistant, the student AI Tutor, smart spreadsheet import and dashboard insights.

  What it receives

  What a user types into the assistant or AI Tutor, earlier messages in that chat, the page they are on, their role and their school's name and type. Smart import from a spreadsheet sends column headings, the kind of data in each column and class names, never the names or contact details in the file; a pasted list, or the text read on the device from a photo of one, is sent as written, names and contact details included. Insights send school-wide totals only, with no names.

  Where

  China

  Note

  Schools can turn the AI Tutor off in Settings → Modules.

• OpenAI

  Switched off

  What for

  Back-up AI provider for the help assistant and AI Tutor.

  What it receives

  The same chat content as DeepSeek, only if DeepSeek is not set up.

  Where

  United States

  Note

  Not set up: Akadaa uses DeepSeek. We will update this list before it is switched on.

• Intelliyya CBT (hosted on Supabase)

  Only when used

  What for

  Computer-based tests and exam practice, for schools that connect it.

  What it receives

  Students' names, admission numbers, email addresses, class or programme and internal record IDs, sent when a student opens a test or the school shares its class list. Scores come back into Akadaa.

  Where

  Supabase cloud servers outside Nigeria

• Telegram

  Only when used

  What for

  The Akadaa Telegram bot, for people who choose to link their Telegram account.

  What it receives

  The phone number shared to link an account, and what the bot sends in that chat: children's names, fees, results, attendance, announcements and payment receipt photos.

  Where

  Telegram's servers outside Nigeria

• Paystack

  Only when used

  What for

  Online card and bank payments, only for a school that adds its own Paystack account.

  What it receives

  The payer's email address, the amount and the payment reference.

  Where

  Nigeria

• Termii

  Switched off

  What for

  Text messages (SMS).

  What it receives

  Phone numbers and message text.

  Where

  Nigeria

  Note

  Switched off. Akadaa sends email only. We will update this list before it is switched on.

• Meta (WhatsApp Business)

  Switched off

  What for

  WhatsApp messages.

  What it receives

  Phone numbers and message text.

  Where

  Outside Nigeria

  Note

  Switched off. Akadaa sends email only. We will update this list before it is switched on.

7. Information that leaves Nigeria

Several providers above store or handle information outside Nigeria, including in the European Union (Ireland), the United States and China. When information leaves Nigeria, we rely on the grounds the NDPA allows for these transfers, such as the protection offered by the provider's data protection terms, or the transfer being needed to provide the service your school has asked for. We choose providers that commit to keeping information secure, and we send them only what each feature needs.

8. How long information is kept

• School records are kept while the school's Akadaa subscription is active, so the school can use them.
• When a school asks, or after it closes its account, we delete its records or return them to the school, as the school chooses. We may keep some information for longer only where the law requires it, such as billing records.
• Our system clears some short-lived records automatically. For example, sent notification records are removed after 30 days, read in-app notifications after 90 days, all in-app notifications after a year, and expired sign-in sessions after 7 days.
• Audit logs are part of the school's records and are kept with them.

9. How we protect information

• All connections to Akadaa use HTTPS. Sign-in cookies are secure and cannot be read by page scripts.
• Passwords are stored only as hashed values (bcrypt). We cannot see your password.
• Two-factor sign-in with an authenticator app is available, with backup codes.
• Two-factor secrets and school bank account numbers are encrypted in the database (AES-256-GCM).
• Private request links and consent codes sent to parents are stored only in a scrambled form.
• Each person sees only what their role allows, within their own school or organisation. Sessions can be ended remotely, and people are signed out after a period of inactivity.
• Sign-in, password reset and public forms are rate limited to slow down attacks.
• Sensitive actions, including support staff signing in as a user, are recorded in an audit log.

No system is perfectly secure. On a shared computer or phone, always sign out. See our Cookie Notice for what Akadaa keeps on your device.

10. AI features

Akadaa has four features that send information to an AI provider, DeepSeek, whose servers are in China:

• Help assistant (for signed-in users): your question, earlier messages in that chat, the page you are on, your role, and your school's name and type.
• AI Tutor (for students): the student's message and earlier messages in that chat. The student's name is not sent. The AI Tutor is on unless the school turns it off: a school administrator can turn it off for the whole school in Settings → Modules. While it is off, students cannot use it and nothing is sent from it.
• Smart import (for administrators and registrars importing a spreadsheet): the file's column headings (only common heading words; any other heading is hidden), what kind of data each column holds (for example “phone-like” or “2 words”), class labels from the file and the school's class names. Names, phone numbers, email addresses and other values in the file are not sent. The suggestions are shown for the administrator to check before anything is imported. When the administrator instead pastes a list (from WhatsApp or a document, say) or takes a photo of one, the text of that list is sent, including the names and any phone numbers or email addresses in it, so that it can be turned into rows. A photo is read on the administrator's own device; only the text, which they see and can correct first, is sent. The page says this before anything is sent.
• Dashboard insights (for administrators): school-wide totals only, such as the number of students and the fee collection rate. No names or individual records are sent.

These providers handle the text to produce a reply, under their own terms. AI answers are there to help, not to decide. They can be wrong. Akadaa does not use AI to make decisions about a student, parent or staff member, and important answers should be checked with the school.

11. Your rights

Under the NDPA you have the right to:

• ask for a copy of your information (access);
• have wrong information corrected (rectification);
• have your information deleted (erasure), where the law allows;
• ask for its use to be limited (restriction);
• receive your information in a common format, or have it sent to another provider (portability);
• object to its use, including for direct marketing;
• withdraw consent at any time, where consent is the basis (this does not affect what was done before);
• not be subject to decisions made only by automated means that significantly affect you; and
• complain to the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

How to use your rights

• Students, parents, guardians, staff and applicants: contact your school first, as it controls your records. We will help the school respond.
• School owners and administrators, or if your school cannot help: email support@akadaa.com with "Privacy request" in the subject. We may ask you to confirm who you are. We will reply as soon as we can, within the time the law allows.

12. If something goes wrong

If personal information is lost, stolen or exposed, we will tell the affected schools without undue delay, with what they need to meet their own duties. Where we are the controller, we will notify the NDPC within 72 hours of becoming aware of it where the law requires, and tell the people affected where there is a high risk to them.

13. Sales agents and people who apply to be one

Akadaa works with independent sales agents, and schools that refer other schools, under our Sales Agent Agreement, which agents read and sign on their agent page once approved. For them, and for anyone who applies at www.akadaa.com/become-an-agent, Akadaa is the controller.

• What we collect: your name, phone number, email address, state and town, whether you are a sales person or a school, your school's name, and what you tell us about how you will reach schools. Once you are an agent: your bank details for payouts, the commission and payouts on your account, and your acceptance of the agreement (the version, the name you typed, when, and the IP address and browser you used).
• Why, and our lawful basis: to consider your application (our legitimate interest in choosing agents carefully); to run the programme, credit schools to you and pay your commission (the agreement with you); and to keep payout and tax records (our legal obligations).
• Who sees it: Akadaa's platform administrators. Your bank details are visible only to them. As an agent, you see only the names of the schools credited to you and whether each one is paying, never a school's records about its students, parents, staff, results or fees.
• How long we keep it: a declined application is deleted within 12 months. An agent's details, commission and payout records are kept while you are an agent, and afterwards for as long as tax and accounting law requires.
• Your rights: you can ask to see, correct or delete your information, where the law allows, by emailing support@akadaa.com. Some payout records must be kept for tax reasons even if you ask us to delete them.

14. Cookies

Akadaa uses only the cookies it needs to sign you in and keep your account secure. It uses no analytics, advertising or tracking cookies. See our Cookie Notice.

15. Changes to this policy

When we change this policy, we update the date and version at the top of this page. If a change is important, we will tell organisation administrators by email or in Akadaa before it takes effect.

16. Contact

Akadaa, Kano, Nigeria. Email support@akadaa.com. For school records, please contact your school first.