Legal
Privacy Policy
Last updated: October 27, 2026
Who we are and what this policy covers
SabiMastery is operated by Macy and Udy Ltd (RC8116436), a company registered in Nigeria with its registered office at 19 Stream Road, Ikot Effanga Mkpa, Calabar, Cross River State, Nigeria. In this policy, “SabiMastery”, “we”, “us” and “our” mean Macy and Udy Ltd. We are the data controller of the personal data described in this policy: we decide why and how it is used. Where a school or employer enrols learners under a licence and asks us to administer their seats, we process that enrolment data on their instructions as well as to run the learner’s own account.
This policy applies to our website, our Android app, and every SabiMastery service (lessons, practice, mock exams, the AI tutor, 1-on-1 and cohort tutoring, certificates, and school and employer licences). It does not apply to third-party websites or services we link to, which have their own privacy policies.
We handle personal data in line with the Nigeria Data Protection Act, 2023 (NDPA) — Nigeria’s primary data protection law, which succeeded the Nigeria Data Protection Regulation, 2019 (NDPR) — and, where they apply to you, the EU General Data Protection Regulation (GDPR) and the UK GDPR. That means we follow the principles in section 24 of the NDPA and Article 5 of the GDPR: we use personal data lawfully, fairly and transparently; only for specified purposes; only as much as we need; we keep it accurate and no longer than necessary; and we protect it with appropriate security.
Your controls, at a glance: update your details in Account settings, manage or cancel billing in Billing, delete your account at Delete account, and contact our data protection team at privacy@sabimastery.com. Your full rights are explained under “Your rights” below.
Personal data we collect
We collect the categories below. We collect most of it directly from you; some comes from your device automatically, and some from third parties such as Google (sign-in), Flutterwave and Google Play (payment confirmations), or the school, employer or tutor connected to your account.
| Category | Examples | Where it comes from |
|---|---|---|
| Account & contact data | Name, email address, optional phone number, password (stored only as a one-way bcrypt hash), account role (learner, tutor, affiliate, school/employer admin), billing country and preferred currency. For accounts created after our age check was introduced, we also collect date of birth and keep an age-eligibility status; we do not ask existing accounts for it retrospectively. | You, or Google when you sign in with Google (Google shares your name and email address and confirms the address is verified — we never receive your Google password). |
| Parent/guardian data (under-18 accounts) | The parent or legal guardian's name, email address and relationship to the learner, the approval/decline decision and its time, and a hashed, time-limited approval token — used only to obtain and evidence guardian approval. | The learner provides their guardian's contact details; the guardian confirms the details when approving. |
| Learning & assessment data | Exams and subjects you study, lessons opened, quiz, checkpoint and mock-exam answers and scores, weak-area diagnostics, study plans, streaks and usage credits, notes, bookmarks, flashcards and certificates earned. | Your use of the service. |
| AI feature data | Questions and messages you send to the AI tutor (doubt chat), written answers submitted for AI marking or feedback, and text you ask us to explain, translate or rewrite. If you use optional spoken-answer feedback, your voice recording is processed in memory to generate pronunciation feedback and is not stored afterwards. | You, when you use those features. |
| Tutor, affiliate & payout data | Tutor profile and bio, subjects claimed, qualifying-test results and teaching demo, identity or credential documents/references submitted for the background check and our decision, availability and timezone, bank name, account name and account number for payouts, earnings, reviews and ratings. | Tutors and affiliates who apply; learners who review them. |
| Payments & billing data | What you bought, amount, currency, VAT, order and payment references, subscription status and the recurring-deduction authorisation you gave (amount, plan, billing cycle, date). Card payments are processed by Flutterwave; we store only a payment token and the card's last 4 digits, brand and expiry month/year so we can show and charge your saved card — never the full card number or CVV. | You; Flutterwave; Google Play for in-app purchases. |
| Communications & content | Messages between learners and tutors, booking and session records, support emails and in-app notifications, reviews, reports of problems, and dispute and refund requests. Live tutoring sessions are streamed; we do not record them. | You and the other party to the communication. |
| Device, log & cookie data | IP address, browser and device type, approximate location derived from IP address, pages visited and actions taken, your cookie choices (categories, policy version and when you chose them), cookie and similar-technology identifiers, and—only for categories you allow—advertising identifiers and event data described under “Cookies and similar technologies”. | Your device and browser automatically; our analytics and advertising partners. |
If you choose not to provide data we need to create or secure your account, or to process a payment, we may not be able to provide that part of the service. Optional items are marked as such (for example, a phone number is never required).
Why we use it and our lawful bases
We only use personal data where the NDPA (section 25) and, where it applies, the GDPR (Article 6) give us a lawful basis. The main ones are set out below. Where we rely on consent, you may withdraw it at any time — withdrawing consent does not affect processing that already happened. Where we rely on legitimate interests, we balance our interests against your rights and you may object (see “Your rights”).
| Purpose | What this covers | Lawful basis |
|---|---|---|
| Provide your account and the learning service | Signing you in; confirming a new account's age eligibility and, for 13–17 learners, obtaining parent/guardian approval; delivering lessons, quizzes, checkpoints, mock exams and study plans; saving progress, credits, notes and certificates; booking and running tutor sessions. | Performance of our contract with you (the Terms of Use). |
| AI features you ask for | Answering AI tutor questions, generating adaptive practice, marking written and spoken practice answers, and explaining, translating or rewriting lesson content at your request. | Performance of our contract with you. |
| Payments, subscriptions and payouts | Taking payment, renewing subscriptions you authorised, refunds, tutor and affiliate payouts, invoices, VAT and accounting records. | Performance of our contract with you; legal obligations (tax, accounting and consumer-protection law). |
| Personalisation and improvement | Weak-area diagnostics, recommended next steps and score forecasts; understanding how features are used so we can fix and improve them. | Performance of our contract with you; our legitimate interests in improving the service. |
| Safety, trust and compliance | Age eligibility and safeguarding; tutor identity/credential verification and the background check; detecting and preventing fraud, abuse, cheating and security incidents; rate limiting and bot protection; handling complaints, disputes and legal claims. | Our legitimate interests in keeping learners, tutors and the platform safe; legal obligations where they apply. |
| Service messages and support | Receipts, billing and renewal notices, session reminders, security alerts and replies to your enquiries. | Performance of our contract with you; our legitimate interests in supporting our users. |
| Study reminders and marketing | Occasional study reminders and news about SabiMastery features, offers and exams, by email or in-app notice. | Your consent where the law requires it; otherwise our legitimate interests in keeping existing users engaged. You can opt out at any time (see “Marketing and service messages”). |
| Analytics and advertising measurement | Measuring visits, sign-ups and purchases and improving ad targeting using cookies, Meta Pixel/Conversions API and Google Ads/GA4 (described in our Cookie Policy). | Your consent to the relevant analytics or marketing category for non-essential cookies, pixels and server-side events. We do not run those events for an account still completing its age check or for a known under-18 account. |
We will only use your personal data for a new purpose that is compatible with the purposes above, or where the law otherwise allows it. If we ever need your consent for a new use, we will ask first.
Sensitive data
We do not ask for sensitive (special-category) personal data — such as data about health, genetic or biometric identification, racial or ethnic origin, religious or political beliefs, trade-union membership or sexual life — to open or use a learner account, and voice recordings for pronunciation feedback are never used to identify you biometrically. Please do not include sensitive data in messages, notes or AI tutor chats. The only routine exception is tutor verification: a tutor applicant may submit identity or credential documents for the background check, which we process with the applicant's consent, to protect learners and meet our safeguarding responsibilities; access is restricted to the small team that reviews applications, and the documents are handled as described under “How long we keep it”. If sensitive data is ever provided to us unsolicited, we process it only to the limited extent necessary (for example, to answer your message) and delete it when it is no longer needed.
AI features, profiling and automated decisions
SabiMastery uses automated processing, including profiling of your learning activity, to find weak areas, recommend what to study next, estimate practice scores and mark practice answers. These are practice tools only: they do not produce official examination results and do not, by themselves, make decisions that produce legal or similarly significant effects on you within the meaning of section 37 of the NDPA or Article 22 of the GDPR. Tutor subject qualification combines an automatically scored test with a human-reviewed teaching demo and background check before any tutor is verified.
If you believe an automated score, diagnostic or recommendation about you is wrong, or you want a person to review it, contact us at privacy@sabimastery.com or via Contact us and we will arrange human review. When you use AI features, the content you submit is sent to our AI providers (see below) solely to generate your response under contract; avoid including personal data about yourself or anyone else in AI chats beyond what your question needs.
International transfers
SabiMastery is based in Nigeria, and several of our providers process data in other countries, including the United States. That means your personal data may be transferred outside Nigeria, and — if you are in the European Economic Area (EEA) or the UK — outside the EEA/UK. Whenever we transfer personal data internationally, we do so under sections 41–43 of the NDPA and, where applicable, Chapter V of the GDPR: to a country recognised as providing adequate protection where possible, and otherwise under appropriate safeguards such as approved contractual clauses and binding contracts with the recipient, supplemented by technical measures such as encryption in transit. Limited exceptions (for example, where a transfer is necessary to perform our contract with you, or with your explicit consent) are used only where the law permits. You may request information about the safeguards for a particular transfer using the contact details below.
How long we keep it
We keep personal data only for as long as we need it for the purposes described in this policy, and then delete or anonymise it. In practice:
| Data | How long we keep it |
|---|---|
| Account, learning and AI-interaction data | While your account is active. When you delete your account (or we delete it at your request), this data is deleted with the account, except the limited records below. |
| Age, guardian and cookie-consent records | Date of birth, age-eligibility status, guardian contact/approval records and account cookie choices are kept while the account is active so eligibility and consent can be evidenced, then deleted with the account. A guardian link expires after 7 days; the browser cookie that remembers cookie choices lasts 6 months unless you change or clear it sooner. |
| Payments, invoices, refunds and payouts | While your account is active and, after account deletion, as an anonymised payment record (amount, currency, reference and date — without your name or email address, which is retained only as a one-way hash for reconciliation) for as long as Nigerian tax and accounting law requires us to keep transaction records. |
| Tutor verification documents and decisions | While the application is considered and, for verified tutors, while the tutor account is active, so the verification can be evidenced; deleted with the account, subject to the payment-record exception above and any legal hold. |
| Support, dispute and complaint records | Until the matter is resolved and for so long afterwards as needed for accounting, chargeback, fraud-prevention and legal-claim purposes, alongside the related payment record. |
| Security and system logs | For the period needed to secure the service, investigate incidents and prevent abuse, then deleted or anonymised. |
| Marketing suppression data | If you opt out of marketing, we keep the minimum identifier needed (for example, your email address on a suppression list) for as long as necessary to honour your opt-out. |
You can delete your account yourself at any time at Delete account. Some accounts cannot be self-deleted while money or other people are affected (for example, a tutor with active students or an unpaid payout, or an account with a refund in progress); in those cases the page explains why and our support team will complete the deletion with you. Deleted data is removed from our live systems promptly and from backups in the ordinary backup cycle.
Your rights
Under Part VI of the NDPA (and Chapter III of the GDPR, where it applies), you have the following rights over your personal data. Some rights are subject to conditions or exemptions in the law (for example, we must keep certain payment records for tax purposes even after an erasure request); where we cannot fully comply, we will explain why.
- Right to be informed — to clear information about how your data is used, which is what this policy provides.
- Right of access — to ask whether we process your personal data and to receive a copy of it, together with information about the purposes, recipients and retention periods.
- Right to rectification — to have inaccurate data corrected and incomplete data completed. You can correct most profile details yourself in Account settings.
- Right to erasure — to ask us to delete your personal data, for example where it is no longer needed or you withdraw consent. Self-service account deletion is available at Delete account.
- Right to restrict processing — to ask us to pause using your data in certain circumstances, for example while its accuracy is being checked.
- Right to data portability — to receive personal data you provided to us in a structured, commonly used, machine-readable format and to have it transmitted to another controller where technically feasible, where processing is based on consent or contract and carried out by automated means.
- Right to object — to object to processing based on legitimate interests, and to object at any time to direct marketing (including related profiling), in which case we will stop.
- Right to withdraw consent — where we rely on your consent, to withdraw it at any time, as easily as you gave it.
- Rights around automated decision-making — not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, and to request human review as described under “AI features, profiling and automated decisions”.
- Right to complain and to a remedy — to complain to the Nigeria Data Protection Commission (or your local supervisory authority) and to seek a judicial remedy, as described in the next section.
How to exercise your rights and complain
To exercise any right above, email privacy@sabimastery.com (ideally from the email address on your account so we can find it), write to us at 19 Stream Road, Ikot Effanga Mkpa, Calabar, Cross River State, Nigeria, or use the self-service controls in Account settings, Billing and Delete account. A parent or guardian may exercise these rights for a child (see “Children and younger learners”), and you may authorise someone else to act for you with proof of their authority.
- We respond without undue delay and within one month of receiving your request. Where a request is complex or one of many, we may extend this by up to two further months where the law allows; we will tell you within the first month if so, and why.
- To protect your account, we may ask for proportionate proof of identity before acting. We will never ask for your password.
- Requests are free of charge. Where a request is manifestly unfounded or excessive, we may charge a reasonable, cost-based fee or refuse it, as the NDPA/GDPR permit — and we will explain our reasons and your right to complain.
- If you ask us to delete your account while a subscription is active, unused credits and remaining plan time are lost and are not refunded by deletion alone — if you believe you are owed a refund, request it first under our Refund Policy.
We hope to resolve any concern directly, but you do not have to come to us first. In Nigeria you may complain to the Nigeria Data Protection Commission (NDPC) via ndpc.gov.ng or info@ndpc.gov.ng. If you are in the EEA, you may complain to your local data protection supervisory authority; in the UK, to the Information Commissioner’s Office (ICO) at ico.org.uk.
Marketing and service messages
We send service messages you need (receipts, billing and renewal notices, session and security alerts) as part of our contract with you; these are not marketing and cannot be opted out of while you hold an account. Study reminders and marketing messages are different: every such email includes a one-click unsubscribe link, and opting out stops those messages without affecting your account or service messages. We never sell your contact details to third parties for their marketing, and we honour objections to direct marketing immediately, keeping only the suppression record described under “How long we keep it”.
Children and younger learners
You must be at least 13 years old to create a SabiMastery account. Every new account completes an age check before onboarding or using the learning service: the account holder gives their date of birth (used only for eligibility and safeguarding); an 18+ account is unlocked immediately; a 13–17 account remains locked until a parent or legal guardian approves it from their own email inbox under the Terms of Use and this policy; and an under-13 result deletes the just-created account and related personal data. This is our age and guardian-consent verification mechanism for NDPA section 31 purposes and for GDPR digital-consent rules (13–16, depending on country). We do not ask children for government ID for this step. Analytics and advertising tracking are off for known under-18 accounts. Where a school enrols learners under a school licence, the school remains responsible for having any additional authority and consents its enrolment requires; school membership does not bypass our account age check. Parents and guardians may withdraw approval and exercise a child's rights (access, correction, deletion) using the contact details below. If we learn that an account was opened under 13 or without required guardian approval, we will delete it and the related personal data.
Security and data breaches
We apply technical and organisational measures appropriate to the risk, as required by the NDPA and Article 32 of the GDPR, including:
- Encryption of data in transit (HTTPS/TLS) between your device and our servers, and with our providers.
- Passwords stored only as one-way bcrypt hashes; sign-in sessions can be revoked across devices; password-reset links expire after 30 minutes.
- Cards are tokenised by Flutterwave — full card numbers and CVVs never reach or are stored on our servers.
- Access controls so staff and processors can reach only the data their role needs, with monitoring, logging and rate limiting on sensitive endpoints, and bot protection on account forms.
- Contracts with processors requiring confidentiality and security, and periodic review of our safeguards.
No system is completely secure. If a personal data breach occurs that is likely to risk your rights and freedoms, we will notify the Nigeria Data Protection Commission (and, where the GDPR applies, the relevant supervisory authority) within 72 hours of becoming aware of it, as section 40 of the NDPA and Article 33 of the GDPR require, and we will inform affected users without undue delay where the breach is likely to result in a high risk to them, with guidance on steps they can take. If you believe your account has been compromised, contact privacy@sabimastery.com immediately.
Changes to this policy
We may update this policy from time to time to reflect changes in the service or the law. When we do, we will post the new version here and update the “Last updated” date. If a change materially affects how we use your personal data, we will notify you in advance by email or in-app notice and, where the law requires your consent for the new use, we will not proceed without it. Earlier versions are available on request from the contact details below.
Contact us
UK representative: Uduak Effanga, privacy@sabimastery.com, 48 Fiske Court, lansdowne Road, London N17 0NA, United Kingdom, +44 7803 460219.
Data protection questions, rights requests and privacy complaints: privacy@sabimastery.com. General support: support@sabimastery.com or +234 703 699 7573. By post: Data Protection Enquiries, Macy and Udy Ltd (RC8116436), 19 Stream Road, Ikot Effanga Mkpa, Calabar, Cross River State, Nigeria. You can also reach us through our Contact us page. This Privacy Policy should be read with our Terms of Use, Cookie Policy, Refund Policy and Security Policy.