Privacy Policy

How Stuex collects, uses, and protects your information · Effective Date: 16 May 2026

Stuex ("Stuex," "we," "us," or "our") operates the platform available at stuex.ng and any associated mobile or web applications (collectively, the "Platform"). We respect your privacy and are committed to protecting your personal data in compliance with the Nigeria Data Protection Act 2023 ("NDPA"), the Nigeria Data Protection Regulation 2019 ("NDPR"), and other applicable laws.

This Privacy Policy explains what information we collect, why we collect it, how we use and share it, and the rights you have over your data. By using the Platform, you confirm that you have read and understood this Policy.

1. Who We Are

Stuex is a hyper-local platform built for students of Nigerian tertiary institutions. We provide a verified, campus-fenced ecosystem for peer-to-peer commerce, academic learning, and student community engagement. For the purposes of the NDPA, Stuex is the data controller of the personal data processed through the Platform.

If you have questions about this Policy or wish to exercise any of your rights, contact us at support@stuex.ng.

2. Information We Collect

2.1 Information You Provide Directly

• Account Information: Full name, email address, phone number, password, and your institution of study.
• Verification Information: Student identification card, matriculation number, and/or institutional email address. This information is used solely to confirm your status as a student and is deleted from our systems immediately after successful verification.
• Profile Information: Profile photograph, year of study, course of study, and optional bio.
• Marketplace Listings: Photographs, descriptions, prices, and condition details for items you list for sale.
• Transactional Information: Records of items bought or sold, escrow status, delivery confirmations, and dispute filings.
• Communications: Messages exchanged with other users on the Platform, support tickets, and content you post in social or event feeds.
• Learning Activity: Past questions you upload or attempt, written or audio answers submitted for grading, and your performance history within the Stuex Intelligent Learning Engine ("SILE").

2.2 Information Collected Automatically

• Device and Technical Data: Device type, operating system, browser type, IP address, unique device identifiers, and crash reports.
• Usage Data: Pages visited, features used, search queries, time spent on the Platform, and click-through behaviour.
• Location Data: Approximate location derived from IP address or, where you grant permission, GPS data used to enable campus-fenced features.
• Cookies and Similar Technologies: See our Cookie Policy for details.

2.3 Information from Third Parties

• Payment processors (such as Paystack) may share transaction confirmations, payout details, and fraud signals.
• Institutional verification partners may confirm whether the credentials you submit match official student records.
• If you choose to sign in using a third-party authentication provider, we receive basic profile information from that provider.

3. Lawful Bases for Processing

Under the NDPA, we process your personal data only where we have a lawful basis to do so. The bases we rely on include:

• Contract: Processing necessary to provide the services you sign up for, including marketplace transactions, escrow, and learning tools.
• Consent: Where you have given explicit consent, such as for marketing communications or optional location features. You may withdraw consent at any time.
• Legal Obligation: Where we must process data to comply with applicable Nigerian law.
• Legitimate Interests: Where processing is necessary for our legitimate interests, such as preventing fraud, securing the Platform, and improving our services, provided those interests are not overridden by your rights.

4. How We Use Your Information

We use your personal data to:

• Create and manage your account, including the one-time verification of your student status.
• Operate the marketplace, including holding buyer funds in escrow and releasing them to sellers upon confirmation.
• Power the SILE learning engine, including grading written and audio answers, generating explanations, and recommending study material.
• Facilitate communications between buyers and sellers, and between members of campus communities.
• Moderate content posted on the Platform using a combination of automated systems and human review.
• Detect, investigate, and prevent fraud, scams, academic malpractice, and violations of our Terms and Conditions.
• Send service-related communications, including transaction receipts, dispute updates, and security alerts.
• Send marketing communications, where you have opted in, about new features, campus events, and promotions.
• Comply with legal obligations and respond to lawful requests from government authorities.

5. Data Minimisation and Verification Data

We follow the principle of data minimisation. In particular:

• Identification documents submitted for student verification (such as student ID cards) are processed only for verification and are permanently deleted from our active systems as soon as verification succeeds or fails.
• We do not retain long-term copies of your student ID, matriculation card, or other identity documents.
• We retain only the outcome of the verification process (verified or not verified) and the date of verification.

This approach protects you from unnecessary exposure of sensitive personal information.

6. How We Share Your Information

We do not sell your personal data. We share personal data only in the limited circumstances described below.

6.1 With Other Users

• Your display name, profile photograph, institution, and year of study are visible to other verified users.
• Buyers and sellers see each other's display names and contact within the in-app messaging system when a transaction is initiated.
• Content you publish in event feeds or community posts is visible to other users in your campus-fenced community.

6.2 With Service Providers

• Payment processors (such as Paystack) for handling escrow funds, payouts, and refunds.
• Cloud hosting and infrastructure providers used to host the Platform and store data securely.
• OCR providers (such as AWS Textract) for digitising uploaded handwritten content for the SILE learning engine.
• AI processing providers (such as OpenAI) used to generate explanations and grade answers. We do not share your name or contact details with these providers, only the content needed for processing.
• Customer support, analytics, and communications providers.

All service providers are contractually required to process personal data only on our instructions and to apply appropriate security measures.

6.3 For Legal and Safety Reasons

• To comply with applicable law, court orders, or lawful requests from regulators or law enforcement.
• To enforce our Terms and Conditions, including investigating fraud, scams, or academic malpractice.
• To protect the rights, safety, or property of Stuex, our users, or the public.

6.4 Business Transfers

If Stuex is involved in a merger, acquisition, restructuring, or sale of assets, personal data may be transferred as part of that transaction. We will notify you and ensure that the receiving party honours commitments equivalent to this Policy.

7. International Data Transfers

Some of our service providers may store or process data outside Nigeria. Where we transfer personal data outside Nigeria, we do so in accordance with the NDPA, including by relying on adequacy decisions, standard contractual clauses, or your explicit consent where required.

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy or as required by law.

• Account Data: Retained for the lifetime of your account, plus a reasonable period after closure for legal, accounting, or fraud-prevention purposes.
• Verification Documents: Deleted immediately after verification.
• Transaction Records: Retained for a minimum of seven (7) years to comply with applicable tax and financial regulations.
• Learning Content: Past questions, answers, and grading history are retained while your account is active to support your study history. You may request deletion at any time.
• Communications: In-app messages and support communications are retained for up to twenty-four (24) months.

9. Your Rights

Under the NDPA, you have the following rights in respect of your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your data, subject to legal or contractual retention requirements.
• Right to Restrict Processing: Request that we limit how we use your data in certain circumstances.
• Right to Data Portability: Receive your data in a structured, commonly used format and transfer it to another service.
• Right to Object: Object to processing based on our legitimate interests or for direct marketing.
• Right to Withdraw Consent: Withdraw any consent you have previously given, without affecting prior processing.
• Right to Lodge a Complaint: File a complaint with the Nigeria Data Protection Commission (NDPC).

To exercise any of these rights, contact support@stuex.ng. We will respond within the timelines required by the NDPA.

10. Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption of data in transit using TLS.
• Hashing of passwords using industry-standard algorithms.
• Role-based access controls and least-privilege access for our personnel.
• Regular security reviews and monitoring for suspicious activity.
• Strict deletion routines for verification documents.

No system is perfectly secure. If we become aware of a personal data breach that is likely to result in risk to your rights, we will notify you and the NDPC in line with our legal obligations.

11. Children and Age Requirement

The Platform is intended exclusively for users who are at least eighteen (18) years of age. We do not knowingly collect personal data from individuals under 18. If we discover that we have inadvertently collected data from a person under 18, we will delete that data promptly. Parents or guardians who believe their child has provided us with personal data should contact us at the address below.

12. Automated Decision-Making

Some features of the Platform, including SILE answer grading and content moderation, involve automated processing. These systems support, but do not replace, human review for material decisions such as account suspensions or dispute outcomes. You may request human review of any automated decision that significantly affects you.

13. Changes to This Policy

We may update this Policy from time to time. Where changes are material, we will notify you through the Platform or by email at least seven (7) days before they take effect. The "Effective Date" at the top of this Policy indicates when it was last updated.

14. Contact Us

For privacy questions, complaints, or to exercise your rights, contact us at support@stuex.ng. We are committed to working with you to resolve any concerns.