Privacy Notice for Account Holders

This notice explains what Alethris does with your personal data. It is written for anyone who holds an Alethris account — to learn, to teach, or to run an academy — and wants to know what the platform holds about them, who can see it, and how long it is kept. If you apply to an academy without an account, clause 17 is written for you. An academy reading about the data it is responsible for should read the Privacy Notice for Academies instead.

1. Who we are

Alethris is operated by iSoterik Limited (iSoterik, we, us), a company registered in Nigeria with number RC 9910229, whose registered office is at No 22 Benin Street, Malali, Kaduna.

This notice is given under the Nigeria Data Protection Act 2023 (the Act). You can write to us about anything in it at privacy@alethris.com.

2. Who is responsible for your data

Alethris holds two kinds of personal data about you, and responsibility for them differs.

Your account — we are responsible. Your Alethris account exists independently of any academy, and we decide how it works and how long we keep it. This covers your name and email address, your password, your sign-in sessions and the devices they record, your notifications, your Skills Passport and the choices you make about it, your progress through the Alethris Guides, copies of your data you ask for, any support case you raise with us, and the questions you ask Alethris Help. For this data we are the data controller.

What an academy asks and records about you — the academy is responsible. When you apply to or join an academy, that academy decides what to ask you, what to assess and what to record. This covers your application answers, your offer, enrolment and fee, the lessons you open and complete, the work you submit, the assessments and feedback you receive, your attendance, your competency evidence, the credentials the academy issues you, any risk flags or notes its staff record about you, and the questions you ask the academy's own assistant. For this data the academy is the data controller, and we process it on its behalf, on its instructions and for no other purpose.

If you want a record in that second group corrected or erased, the academy decides. Ask the academy first; if you cannot reach it, write to us and we will pass your request on and act on its instruction.

Where the two meet. A credential is issued by an academy, but we keep it as a platform record so that it can still be verified after you leave the academy, after you close your account and after the academy closes; for that purpose we decide, and we are responsible. The record of a payment is kept for the academy that was paid and also by us, because we take a fee from it and must keep our own financial records.

3. What we collect, and where it comes from

From you: your full name, email address and password when you create an account; the answers you give on an academy's application form; the preferred name and short biography you give an academy for its staff to see; the work you hand in; what you put on your Skills Passport (its handle, headline, short biography and links); the messages you write in a support case; and the questions you ask an assistant.

If you applied to an academy without an account and it accepted you, we may have made your account from the name and email address you applied with, so that the academy could offer you a place on it. Nobody can sign in to it until you set it up from the email we send you.

We do not ask you for a phone number, a date of birth or an identity document. An academy's application form may ask questions like these; if it does, the academy is asking, and clause 2 applies.

From an academy, about you: your membership and roles; offers, enrolment and the price you were charged, including any discount, and the sponsor paying for your place, if there is one; assessment decisions and feedback, with the name of the person who made them and how they judged the work; attendance marks, corrections and notes; competency evidence; credentials, with your name as the academy confirmed it when it issued them; and risk flags and notes.

Generated as you use Alethris:

• Sign-in sessions. Each session records the address you connected from, the browser you used, where you signed in and when it was last used. A new record is made each time a session is renewed, which happens at least every fifteen minutes while you are active.
• Progress. When you first opened each lesson, when you last visited it and when you completed it. When you play a video an academy uploaded, we record that you played it and in which lesson.
• Audit records of significant actions, such as who issued a credential or changed a role. They record who did what, not where they were.
• Notifications we send you, a record of their delivery, and which academies' announcement emails you have stopped.
• Security counters. To stop anyone guessing passwords or flooding the service, we count requests against the address they come from, against your account and, on sign-in and password pages, against a hash of your email address. Each count expires within twenty-four hours.
• Operational logs and traces. To keep the service running and to investigate faults, our systems record which account and academy a request was made for, the page requested and your browser. They do not record the address you connected from, or the codes and search terms a web address can carry, such as the code in a link we send you.
• Error reports. When a page fails, in your browser or on our servers, a report says what went wrong and where in our code, the page's address without anything after a question mark, the pages and buttons that led to it, and your browser's name, version, language and time zone. It carries no name, account, email address, cookie or anything you typed.
• Usage figures. Records of events such as an enrolment, a lesson completed or a payment, keyed by the record's own identifier rather than by your name or email. They feed academies' reports and our own view of how Alethris is used.
• Credential lookups. How many times a day each credential's public record is looked up, and when it was last looked up. We do not record who looked.

From payment providers: Paystack tells us that a payment succeeded or failed, its amount, its fee, the method used and its reference. We never receive or store your full card number or your card's security code. You enter card details on Paystack's own page. Paystack's notifications to us can include your card type, its last four digits and the issuing bank; we keep those notifications encrypted and delete them thirty days after we receive them, or ninety days after for one we could not process. Where you pay by bank transfer, the temporary account number issued for that payment is encrypted while the instruction is live and cleared once it is paid or expires.

From your device: see clause 10.

We do not buy personal data, we do not enrich your profile from other sources, and we do not use your data for advertising.

4. Why we use it, and on what basis

For the data we are responsible for, we rely on the following lawful bases under the Act.

For the data an academy is responsible for, the academy decides why it is collected and must have a lawful basis for it. We process it only to provide the academy's programmes to you: to deliver lessons, store your work, record assessment and attendance, issue credentials, take payment, notify you and answer your questions.

We rely on your consent for one thing only: support sessions, described in section 6, including any change you allow one to make. You give it in your account, and you can withdraw it at any time — by switching it off, declining a request, withdrawing a permission you gave or ending a session — which ends any session in progress that relied on it at once. Withdrawing it does not affect a session that has already ended, or a change already made. For everything else, your choices are made through the settings this notice describes.

We do not sell your personal data, we do not use it for advertising, we send no marketing email, and we do not use your work or your conversations with an assistant to train AI models.

5. Who can see what

Staff are seated on a cohort, or on a self-paced programme's staff list, to teach or assess it. While nobody is seated on a self-paced programme, all of the academy's teaching staff can see its learners' work.

If you teach at an academy, the public page of each cohort you are assigned to names you as one of its instructors or mentors.

If you assess learners' work, the verification page of every credential that rests on your assessment shows your name as your account gives it, how you judged the work and when, and whether you taught the learner's cohort. If you confirm the evidence behind a credential as a second assessor, it shows your name and the date. Anyone holding the credential's code can read these, for as long as the credential exists, because they are part of what makes it worth checking.

Four entries are worth stating plainly, because they are deliberate.

Risk flags are kept from you. If an academy's rules flag that you may be falling behind, you will not see the flag, its evidence or the notes staff write about it. A learner watching a risk label move would change how they behave, and staff would stop recording honest concerns. You may ask the academy what it holds about you.

Support cases you raise with us are not visible to your academy. Not to its owner, its administrators or its finance staff. If a case cannot be resolved without involving the academy, we will ask you before we contact it.

Your conversations with an assistant are yours. Nobody at your academy can read them, and no tool our staff use shows them — not even a support session.

Support sees what you see only when you allow it. In a support session you allow, a support operator sees your account as you do, for as long as the session lasts. Section 6 says what such a session can and cannot reach.

6. What our own staff can reach

iSoterik's staff work through named roles — support, security, finance, trust and safety, content, AI, analytics and access administration — and none of those roles can see everything. Our staff cannot sign in as you or learn your password, and they cannot change an admission, enrolment, assessment, completion or credential decision.

• Support and security operators can look up an account — its name, email address, status and the academies it belongs to — only after stating a reason and re-entering their own password. Looking at a summary of your records at an academy, such as the state of an enrolment or a certificate, also needs an open support case. Both kinds of lookup are written to registers that cannot be edited or deleted. These operators can also read support cases, including yours.
• Support sessions. To sort out a problem, a support operator may ask to see Alethris as you see it. They can do so only from an open support case that names you, and only once you allow it: by switching on "Let Support look without asking", which covers only cases you raise, or by allowing the request in your account, which needs your password. Inside an academy, its Owners must allow it too, and an academy that has not is not shown at all. A session can only view, unless you allow changes: when the fix is in the setup of an academy you help run — its settings, courses, cohorts or templates — the operator may ask to make that change as you, for at most 24 hours. That needs your password and an academy Owner's approval each time, and "Let Support look without asking" never covers it. Whatever you allow, a session cannot send, pay, publish, decide or accept anything in your name, change a price or a refund policy, or change who belongs to an academy. It never shows your password, your sign-in sessions and devices, your conversations with an assistant or a copy of your data. It lasts at most an hour. You are told by email and in your account when we ask and when a session starts, and you can end a session, or withdraw a permission you gave, at any time from your account. Your account lists every session — when, how long, the case it served, the parts of Alethris it opened and how many changes it made — and each change is in the academy's audit log as made by Alethris Support as you. The operator is not named to you, as with replies to a case, and every session is kept in a register that cannot be edited or deleted.
• Trust and safety operators can view any Skills Passport in order to moderate it.
• Finance operators see what they need to review refunds, payment disputes and academies' settlement accounts.

Outside a support session you allow, none of them can see your submitted work, the feedback on it, the notes staff write about you, or the content of your notifications. None of them can ever see your conversations with an assistant or card details.

A security operator can suspend an account, end its sessions or send it a password-reset link, but only under a security case, with a recorded reason and a re-entered password. We tell the person when we suspend or restore their account, unless the operator records a reason not to; ending their sessions is not announced. Suspension deletes nothing.

A small number of engineers who run the platform have technical access to its systems. They use it only to operate, repair and secure the service.

7. Providers who process data for us

Each provider acts under written terms that limit it to our instructions. When you watch a video, your browser fetches it directly from Mux or YouTube, which therefore see your connection address. Lessons show YouTube videos in YouTube's privacy-enhanced mode. An error report reaches Sentry through our own servers, so Sentry does not see your connection address.

When an assistant answers a question, the question and the material it needs to answer it are sent to OpenAI or Anthropic. We send no account identifiers with them, and we instruct OpenAI not to store what we send. Under both providers' terms for this kind of use, they do not train their models on it, although they may keep it for a limited period to detect misuse. The model that makes an academy's lessons searchable runs on our own servers, not at a third party.

8. Where your data is held, and transfers out of Nigeria

Alethris runs in the European Union: its servers and databases are in the Netherlands, and its files, email and backups are in Ireland. Some providers in clause 7 are in the United States. Your personal data is therefore transferred out of Nigeria as a matter of course, not as an exception.

We make these transfers on a basis the Act allows: under written terms with each provider that require it to protect your data to the standard the Act sets and, where those terms are not enough on their own, because the transfer is necessary to perform our contract with you — to deliver the programme you joined, to take your payment, or to answer the question you asked.

9. How long we keep things

Credentials are kept indefinitely on purpose. An employer who verified your credential in 2027 should still be able to check it in 2035, and a credential that vanished when an academy closed would be worth very little.

Backups are encrypted, kept apart from the service and used only to restore it. Something removed from Alethris stays in a backup until that backup expires, and the monthly copies are locked so that nobody can alter them in the meantime.

10. Cookies, and what is kept on your device

Cookies. We use only cookies that are strictly necessary, so there is no consent banner:

• two that keep you signed in — one lasting fifteen minutes and renewed while you are active, and one lasting seven days, or thirty if you choose to stay signed in on that device at Alethris Hub (seven days at an academy's own address);
• one that protects forms against cross-site request forgery, lasting as long as your session;
• one used for sixteen minutes while you are being signed in to an academy's own address;
• one that remembers the light or dark theme you chose, for a year;
• one set when you sign out on a device and kept until Alethris confirms the sign-out — at once with a connection, otherwise for up to thirty days — so that a sign-out made offline is finished when the connection returns;
• in the browser of a support operator in a session you allowed, and nowhere else: one for six minutes while the session opens, and one for as long as it lasts, which tells that browser to keep nothing of yours and whether the session can only view.

We use no advertising, analytics or cross-site tracking cookies, and no analytics scripts. The error reports in clause 3 keep nothing on your device.

Storage on your device. So that Alethris keeps working when your connection drops, your browser keeps some of what you use at Alethris Hub and at an academy: pages you have viewed, until that address goes seven days unused; work you have started but not yet handed in; lesson completions waiting to be sent; drafts staff are writing; and lessons you choose to save for reading offline. We ask before saving a lesson and tell you how much space it needs. Saved lessons are limited to 250 MB, and they stay until you remove them, sign out on that device, or lose access to the programme.

A support session keeps none of this in the operator's browser: no pages, no work and no saved lessons.

This storage is labelled with your account and held separately for each address. Signing out on a device empties it for that address, and when someone else signs in at that address on the device, everything kept there for the last person is emptied first. A session that simply expires, or one you end from another device, does not empty it, though the offline page lists no saved lessons while nobody is signed in there. On a shared device, sign out when you have finished.

Sessions. You sign in at Alethris Hub, and an academy's own address signs you in by passing your session across from the Hub. Each address then holds its own session, and signing out of one does not sign you out of the others. You can see every session, and end any or all of them, from Account and security.

11. Your rights

Under the Act you may ask us for a copy of your data, to correct it, to erase it, to restrict how we use it, to object to our using it on the basis of legitimate interests, and to receive it in a portable form. You may also complain to the Nigeria Data Protection Commission; clause 18 says how.

Much of this you can do yourself, from Account and security in Alethris Hub.

Correct your name. It updates everywhere it is read from, except credentials already issued, which keep the name they were issued with. Your email address cannot be changed there; if it must change, write to Support.

Take a copy of your data, from Your data. We prepare it in the background and tell you when it is ready. It arrives as one archive of readable files covering every academy you belong to: your account and sign-ins, your memberships, what you applied for and the places you took up, the prices you were charged, the lessons you opened, your attendance, the work you handed in and the assessments of it, your credentials, your payments, your notifications and your conversations with assistants. It names what it leaves out on purpose, such as your password and the notes staff keep about you. It does not yet include your Skills Passport, your support cases, the decisions on your applications, the videos you played, or single requests you made to an assistant outside a conversation; write to privacy@alethris.com for those. The download stays available for seven days, and you can ask for a new copy up to three times a day. The owners and administrators of the academies you belong to are told that you took a copy; they are not shown it.

Close your account, from Closing this account. You are signed out everywhere at once. Nothing is removed for thirty days; to stop the closing, sign in within those days and choose Keep my account — signing in on its own does not stop it. After thirty days your name becomes "Deleted account", your email address is replaced with one that identifies nobody, your password is removed, and your memberships of academies end, with any place you had not finished and any application still waiting. Your Skills Passport is made private, what you wrote on it about yourself — its headline, short biography, links and the summaries you added to items — is cleared, and every link you shared from it stops working. The questions you asked assistants and their answers are cleared, as is the biography you gave any academy. Your notifications leave your inbox, and our records of the emails we sent you keep no email address. What you wrote to Support is cleared: the subject and description of each case you opened, and every reply you sent. That step cannot be reversed.

Some things survive a closure, deliberately:

• Credentials you earned stay valid and verifiable, and keep your name, because a credential that no longer names its holder cannot be verified.
• What an academy recorded about your learning — your applications and places, your work, the decisions on it, your completions and your competency evidence — stays with that academy, but carries the marker that replaced your name and email. It is the academy's record; ask the academy if you want it changed.
• Payment records keep the payer's name and email, because financial records must.
• Our side of a support case — the replies our staff sent and the notes they kept — stays with the case, so that what we did and why can still be accounted for. It is cleared three years after the case closes, as every support case is.

For anything else, write to privacy@alethris.com. We will reply within thirty days, and we may ask you to confirm who you are first. Some requests have limits:

• Assessment and credential records cannot simply be erased. Other people rely on them. If a credential should not stand, the academy revokes it, which records that it was withdrawn rather than pretending it never existed.
• Financial records cannot be erased while we are required to keep them.
• Where an academy is responsible for the data, we pass your request to the academy and act on its instruction rather than deciding for it.

If an academy you learn with closes, we tell you by email and in Alethris Hub before it happens, and again if the academy decides to stay open. Thirty days after it closes you can no longer open its lessons, and its files, videos, public pages and the risk records its staff kept about learners are removed; take a copy of your data before then if you want one. What you earned stays: your credentials remain valid and verifiable, and the record of what you studied, the work you handed in and the decisions you were given are kept with them. Alethris Hub goes on naming the academy on your records.

12. Automated decisions and AI

No decision that affects you is made by automated means alone.

Assistants can give an assessor a private checklist of what to look for in your work, drawn from the assignment's brief and rubric; summarise your risk record and propose a check-in; or draft wording for academy staff. The checklist never reads the work you handed in and never suggests a level, a score or a decision. Assistants do not grade, approve competencies or issue credentials. Every assessment carries the name of the person who made it, and nothing an assistant drafts takes effect until a person applies it.

An academy names its own assistant. Its answers are written by an AI model, not by a member of staff, and they can be wrong; check anything that matters with the academy.

Risk flags are raised by rules, not predictions. An academy's rules flag a learner who, for example, has had no counted activity for seven days, has missed two of their last three sessions, or has not handed in a required assignment two days after it was due. The academy can adjust or switch off each rule, and its staff can also raise a concern by hand. Each flag names the rule and the evidence behind it, and an automatic flag clears when its condition does. There is no predictive score. A flag never changes your enrolment, assessment, access, payment, completion or credential; it tells staff who may need their attention.

What counts as activity for these rules is narrow, and only what you do counts: opening a lesson for the first time or completing it, saving or handing in work on an assignment, and attending a session, which counts from the session's date rather than when the mark was entered. Nothing staff do counts, including a reviewer asking you to change a submission, and nor does viewing a page, downloading a file, playing a video or asking an assistant a question. The count pauses while the academy, or your access to it, is unavailable.

Raising these flags is an automated evaluation of how you are doing, which the Act may treat as profiling. It is done for the academy, under rules the academy controls, and it decides nothing about you.

13. How we protect your data

Passwords are stored only as scrypt hashes with a unique salt and a secret of ours, never in a form that can be turned back into the password. Links we email you are stored only as hashes. Support cases, conversations with assistants, bank account numbers and the email addresses we deliver to are encrypted in the database. Each academy's records are kept apart by the database itself, not only by our code. Everything travels over encrypted connections, and backups are encrypted before they leave our servers.

No system is perfectly secure, and clause 15 says what we do if something goes wrong.

14. Children

Alethris is for adult and vocational learning. You must be 18 or older to hold an account, and we do not knowingly hold an account for anyone younger. If we learn that we do, we will close it.

15. If something goes wrong

If a breach of security affects your personal data and is likely to put your rights at risk, we will tell the Nigeria Data Protection Commission within seventy-two hours of becoming aware of it. Where it is likely to put you at high risk, we will also tell you without undue delay, in plain words: what happened, what it means for you, what we are doing about it and what you can do.

Where the data belongs to an academy, we tell the academy straight away so that it can meet its own obligations to you.

16. Changes to this notice

We will publish any change here with a new version number and the date it takes effect. Where a change materially affects how we use your data, we will tell you before it takes effect.

17. If you apply without an account

Where an academy allows it, you can apply to it without an Alethris account. This clause says what happens to your details until you hold one; the rest of this notice applies once you do.

What you give. Your full name and an email address, and your answers on the academy's application form. To confirm the address, we email it a six-digit code, which we never store. Our record of the request, with your name and address, is deleted a day after the code runs out, and to stop the form being misused we count code requests against a hash of your address. While you fill the form in, your browser keeps your answers in that tab, so that a reload does not lose them, and clears them once you send it.

Who is responsible. Your application belongs to the academy, which decides about it and is its controller, as clause 2 describes; we hold it on the academy's behalf. We email you about it in the academy's name, since you have no inbox in Alethris.

If the academy accepts you. We find the account your email address already has or, if it has none, make one from the name and address you applied with. Then we email you a link to set it up, or the academy invites you to sign up, as it chooses. Nobody can sign in to an account made this way until you set it up. If the offer lapses before then and you hold no other offer or place, we erase the account as a closed account is erased.

How long we keep your application. If you never take up an account — because the academy does not accept you, you withdraw, or an offer lapses — your name, email address and answers are cleared from the application twelve months after it closed. The academy keeps a record that an application was made, and any note its staff wrote when deciding stays as they wrote it. The emails we sent you keep your address for the same twelve months.

Your rights. Until you hold an account there is no account to take a copy from or to close. Ask the academy, or write to privacy@alethris.com, and we will pass your request to the academy and act on its instruction.

18. Contact and complaints

iSoterik Limited, No 22 Benin Street, Malali, Kaduna.

• Privacy: privacy@alethris.com
• Support: support@alethris.com

If you are unhappy with how we have handled your data, please tell us first so that we can put it right. You may also complain to the Nigeria Data Protection Commission at any time, through ndpc.gov.ng.