EduSeat← Back to Login

Privacy Policy

Last updated: October 2026 (Version 1.2)

1. Who We Are

EduSeat is a digital attendance platform for Nigerian universities and polytechnics, built and operated by Alphastrive Company Limited ("Alphastrive", "EduSeat", "we", "us", or "our"). This Privacy Policy explains what personal data we collect from students, lecturers, and university administrators who use the EduSeat platform (web and mobile), and how we use, share, and protect that data.

2. Data We Collect

Depending on your role, we may collect:

  • Identity data — full name, matric/staff number, institutional or personal email address, date of birth when the university provides it, and a guardian name for a student under 18.
  • Attendance data — session check-ins, timestamps, and course enrollment records. A check-in is accepted with the session code. EduSeat does not store GPS coordinates with that record.
  • Mailbox content — messages delivered to a student's EduSeat address, including the sender, subject, and body.
  • Passport photograph — an optional profile photo a student chooses to upload. It is not used to verify attendance.
  • Device and usage information — device type, operating system, app version, and IP address, collected automatically for security and diagnostics.

3. Legal Basis for Processing

Under the Nigeria Data Protection Act 2023, we rely on the following legal bases for each category of data we process:

  • Attendance records — Contract (providing the attendance service your university has contracted).
  • Date of birth and guardian name — Legitimate interest (age checks before a student account is created). A guardian name typed by university staff is a contact record. It is not, by itself, proof of parental consent.
  • Email address — Contract (enabling account access and communications).
  • Passport photograph — Consent (collected only when a student chooses to upload one).
  • Device information — Legitimate interest (security and fraud prevention).

4. How We Use Your Data

  • To record and verify attendance at lectures and academic sessions.
  • To generate attendance reports and barring lists for lecturers and university administrators.
  • To send account messages: password setup, password reset, and an in-inbox attendance warning.
  • To detect and prevent fraud, proxy attendance, and other misuse of the platform.
  • To maintain the security and stability of our systems.

5. Data Sharing

We do not sell your personal data to third parties. We share data only as follows:

  • Your university — administrators and lecturers at your institution can access attendance and profile data relevant to their courses and roster.
  • Supabase — our database and authentication provider, which stores your account and attendance records.
  • Resend — our email delivery provider, used to send transactional emails such as password resets and invites.
  • Sentry — our error-monitoring provider, used to diagnose technical issues. Sentry runs server-side only and does not receive your passport photo or location data.
  • Cloudflare — used for DNS and email routing infrastructure.
  • Vercel Inc. — web application hosting (United States with global edge network).

6. International Data Transfers

Your data is stored on Supabase infrastructure located in the European Union (EU West region). By using EduSeat you consent to this transfer. Supabase complies with international data protection standards.

7. Data Retention

  • Attendance records are deleted 2 years after the account is closed. EduSeat does not store a graduation date.
  • System and security logs, and webhook delivery logs, are retained for 90 days.
  • Student mailbox messages are deleted 365 days after they are received, including while the student is still enrolled.
  • Password reset codes are deleted within 24 hours of creation.
  • Study schedule entries are deleted when the account is closed.
  • Session codes are removed when the session is no longer active.

8. Security

We apply industry-standard safeguards to protect your data, including:

  • TLS encryption for all data in transit.
  • Row Level Security (RLS) policies that restrict database access strictly by role and university.
  • Secure, encrypted storage of authentication tokens.

In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify you directly within 72 hours of becoming aware of the breach, in addition to notifying your university and the Nigeria Data Protection Commission (NDPC).

9. Location Data

The mobile app may read the phone's location while you are using it, as a local hint on the device. EduSeat's servers do not store GPS coordinates with a check-in. Presence is recorded when the session code is accepted. We do not run a server-side geofence.

10. Children's Data

EduSeat rejects a new student record when the date of birth shows the student is under 13. A student aged 13 to 17 can be registered only when the university also supplies a guardian name. That name is stored as a contact. It does not by itself prove that a parent or guardian consented. Universities remain responsible for obtaining whatever consent their own rules and the law require before they register a student under 18. A university may also attest that a student is 18 or older without sending a date of birth. Existing student accounts that have no date of birth are not locked out of sign-in.

11. Your Rights

You have the right to:

  • Access the personal data we hold about you — students can download a full export of their data from the EduSeat mobile app's profile section at any time.
  • Correct inaccurate or incomplete data.
  • Request deletion of your data, subject to your university's academic record-keeping obligations — students can request account deletion from the mobile app's profile section; attendance and enrollment records are retained under your institution's academic-integrity obligations even after deletion, per the Data Retention section above.
  • Data portability — you may request your data in a machine-readable format using the Export My Data feature in your account.
  • Object to processing based on legitimate interests.
  • Lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

To exercise any of these rights, contact us at the email below or your university administrator.

12. NDPR Compliance

EduSeat processes personal data in accordance with the Nigeria Data Protection Regulation (NDPR) and the Nigeria Data Protection Act 2023. We act as a data processor on behalf of your university, which acts as the data controller for your academic records.

Consent is obtained at two points, matching that controller relationship: a university, as data controller, registers on behalf of its institution and consents on its behalf, agreeing to our Terms of Service and this Privacy Policy for the processing of its students' and staff's data. A student separately consents for themselves when first activating their individual EduSeat account (setting their password), at which point they must explicitly agree to this Privacy Policy and our Terms of Service before their account can be used — that consent is recorded against the account as an activation timestamp at the moment it is given.

13. Contact Us

If you have questions about this Privacy Policy or how your data is handled, contact us at contact@eduseat.ng. For technical support with your account, contact support@eduseat.ng.

Data Protection enquiries: should be directed to contact@eduseat.ng. Alphastrive Company Limited is assessing its obligations under the Nigeria Data Protection Act 2023 regarding Data Protection Officer appointment.