ContextEd Privacy Policy
*Effective date: 21st of July, 2026
Quick summary
(This section exists so a reader gets the key facts in under a minute — full detail follows below.)
- We collect the account information you sign up with, the study materials you upload, how you use the product, and payment confirmation from our payment providers (we never see your card details directly).
- Your study materials and chat conversations with Jules are processed by our AI providers (Anthropic, Voyage AI) to power tutoring, planning, and search — they don't use your content to train their own models under our agreements with them.
- We don't sell your personal data.
- If you're in Nigeria, the Nigeria Data Protection Act 2023 governs how we handle your data. If you're elsewhere, GDPR-equivalent principles apply regardless of where you're located.
- You can ask us what we hold on you, correct it, or ask us to delete it, at any time — see Section 10.
1. Who we are
ContextEd ("ContextEd," "we," "us," "our") is the data controller for personal data processed through the ContextEd platform, available globally via Paddle (USD) and in Nigeria via Paystack (NGN).
Data controller: Seriki Favour Fisayo, sole proprietor Contact for privacy matters: privacy@context-ed.app Jurisdiction: Federal Republic of Nigeria
2. What personal data we collect
2.1 Account and authentication data
Name, email address, and profile information from Google OAuth sign-in, or email and a hashed password if you sign up directly. We never store your Google password, and we never see your card details for payments (Section 2.4).
2.2 Study content you provide
Uploaded course materials (PDF, image, or text), web links and YouTube videos you add as material, the goals and deadlines you declare in a Learning Contract, your conversations with Jules (our AI tutor), and your quiz/flashcard answers and mastery progress.
2.3 Usage and product data
How you use the product — pages visited, features used, session activity, and product analytics — collected via PostHog. This may include session replay (a recording of on-screen interactions, not audio or webcam) for debugging and product-improvement purposes.
2.4 Payment data
When you subscribe or make a purchase, our payment providers — Paddle (global, USD) or Paystack (Nigeria, NGN) — collect your card or payment details directly. We receive confirmation that a payment succeeded, the amount, and the plan purchased — we do not receive or store your full card number at any point. Paddle acts as the Merchant of Record for global transactions, meaning Paddle is legally the seller and handles your payment, tax, and refund inquiries directly.
2.5 Communications
Emails we send you (delivered via Resend) and in-app or browser push notifications (delivered via Novu) — for example, accountability nudges, renewal receipts, or renegotiation prompts — along with delivery and open/click data from those channels.
2.6 Device and technical data
IP address, browser and device type, and error/crash reports, collected via Sentry for reliability and debugging purposes. Infrastructure-level logs and traces are also collected via Grafana Cloud (Mimir/Tempo/Loki) for system health monitoring; these are oriented around system behavior, not individual user identity, though they may incidentally contain user or account identifiers during troubleshooting.
3. How we use your data, and our legal basis for using it
| Purpose | What data | Legal basis |
|---|---|---|
| Provide the core service (Contracts, tutoring, mastery tracking) | Account data, study content | Performance of a contract with you |
| Process payments and manage your subscription/entitlement | Payment confirmation data | Performance of a contract with you |
| Send accountability nudges and service communications | Contact info, notification preferences | Performance of a contract with you |
| Improve the product, fix bugs, understand usage patterns | Usage data, session replay, error reports | Legitimate interest |
| Comply with tax, fraud, and financial recordkeeping obligations | Payment records | Legal obligation |
| Marketing communications (if you opt in) | Contact info | Consent — withdrawable at any time |
We do not use your study content or conversations with Jules to train our own models, and our agreements with our AI providers (Section 4) prohibit them from using your content to train their general-purpose models.
4. Who we share your data with
We don't sell your personal data. We share it with the following categories of service providers, each acting under contract to process data only for the purposes we specify:
| Provider | Role | What they receive |
|---|---|---|
| Anthropic (Claude) | AI tutoring, planning, and agent orchestration | Your Contract goals, chat messages, and study content needed to generate a response |
| Voyage AI | Embeddings and search/retrieval over your materials | Text extracted from your uploaded materials |
| Neon | Database hosting (Postgres) | Your account and application data at rest |
| Upstash | Queue/cache infrastructure (Redis) | Job metadata for background processing (e.g., accountability scheduling) |
| UploadThing | File upload storage | Your uploaded course materials |
| Sign-in (OAuth) | Authentication only — see Section 11 | |
| Paddle | Payment processing and Merchant of Record (global) | Payment and billing data — see Section 2.4 |
| Paystack | Payment processing (Nigeria) | Payment and billing data — see Section 2.4 |
| Resend | Transactional email delivery | Email address, message content, delivery/open/click data |
| Novu | In-app and browser push notification delivery | Notification content and delivery status |
| PostHog | Product analytics, session replay, feature flags | Usage events, session interaction data |
| Sentry | Error and crash monitoring | Error reports, which may include IP address and account identifiers |
| Grafana Cloud | Infrastructure logging, metrics, and tracing | System-level logs and traces |
| Render, Vercel, Cloudflare | Application hosting and network security | Data in transit/at rest as part of normal operation |
We may also disclose data where required by law, to enforce our Terms of Service, or to protect the rights, safety, or property of ContextEd or our users.
5. International data transfers
Our service providers operate infrastructure in multiple countries, including the United States and the European Union. If you're in Nigeria or elsewhere outside where a given provider's servers are located, your data may be transferred internationally. Where required, we rely on recognized safeguards for these transfers — such as standard contractual clauses, or transfers to countries with a recognized adequate level of data protection.
6. How long we keep your data
- Account and Contract data: retained for as long as your account is active, plus a limited period after closure to allow reactivation and meet legal recordkeeping requirements.
- Payment records: retained per tax and financial recordkeeping obligations, independent of account status.
- Refunded or downgraded entitlements: your Contract and mastery data are not deleted on refund or downgrade — you simply lose paid-tier access.
- Session replay recordings: retained for 30 days, then automatically deleted.
- Analytics/event data: retained for 1 year.
- Deletion requests: honored per Section 10, subject to the legal retention exceptions above.
7. Security
We use industry-standard technical and organizational measures to protect your data, including encryption in transit, access controls on our infrastructure, and monitoring via Sentry and Grafana Cloud. No system is perfectly secure, and we can't guarantee absolute security, but we take reasonable steps to protect your data. In the event of a data breach likely to pose a risk to your rights, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, and notify affected users without undue delay where the breach poses a high risk to you.
8. Cookies and tracking technologies
We use cookies and similar technologies for:
- Essential functions (keeping you signed in, security) — these don't require consent.
- Analytics and session replay (via PostHog) — this requires your opt-in consent, which we ask for through a consent banner when you first visit. We don't collect analytics or session replay data until you accept.
You can change your preference at any time from your account settings.
9. Children's and minors' data
Some ContextEd users are under 18. If you're under 18, we require a parent or legal guardian's consent before your account can be used.
When you sign up and indicate you're under 18, we ask for a parent or legal guardian's email address. We send them a confirmation link, valid for 7 days. Your account remains inactive until they confirm — you won't be able to use the platform until then. If the link expires without confirmation, you'll be notified and can request a new one after 24 hours.
Once your guardian confirms, we keep a record of their email address and the date they confirmed, as evidence that consent was properly obtained.
10. Your rights
You have the right to:
- Access — request a copy of the personal data we hold about you.
- Rectification — ask us to correct inaccurate or incomplete data.
- Erasure — ask us to delete your personal data, subject to legal retention requirements (Section 6).
- Restriction — ask us to limit how we use your data in certain circumstances.
- Portability — request your data in a structured, commonly used, machine-readable format.
- Object — object to processing based on legitimate interest, including for marketing.
- Withdraw consent — where processing is based on consent, withdraw it at any time without affecting processing that already took place.
To exercise any of these rights, contact us at privacy@context-ed.app. We'll respond within 30 days, and may ask you to verify your identity first. If you're not satisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) or, if applicable, your local data protection authority.
11. Third-party sign-in and services
If you sign in with Google, ContextEd's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We only request the minimum sign-in information needed to create and secure your account.
Our platform also links to or integrates with third-party services described in Section 4. Their use of your data is governed by their own privacy policies, which we encourage you to review.
12. Changes to this policy
We may update this policy from time to time. If we make material changes, we'll notify you by email or an in-app notice before the changes take effect. The "Effective date" at the top of this document reflects the last update.
13. Governing law
This policy is governed by the laws of the Federal Republic of Nigeria, without prejudice to any statutory rights you have under the law of your own country of residence, including, where applicable, the GDPR/UK GDPR.
14. Contact us
Questions about this policy or how we handle your data: Email: privacy@context-ed.app