Privacy Policy

Inspaya, Inc. ("Inspaya," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our platform at inspaya.net and related services (the "Service"). This policy is designed to comply with the Nigeria Data Protection Regulation (NDPR), the EU General Data Protection Regulation (GDPR), and other applicable data protection laws.

By using our Service, you consent to the data practices described in this Privacy Policy. If you do not agree with our practices, please do not use the Service.

1. Information We Collect

1.1 Information You Provide

• Account Information: Name, email address, password (hashed), and profile photo when you register directly or via Google OAuth.
• Profile Data: Bio, skills, portfolio items, work experience, certifications earned, and other information you add to your talent or learner profile.
• Payment Information: Billing address, payment method details (processed securely by Paystack and Stripe — we do not store full card numbers).
• Communications: Messages, feedback, support requests, and any other content you send to us or other users through the Platform.
• Assessment Data: Your responses to quizzes, tests, and assessments taken as part of courses on the Platform.

1.2 Information Collected Automatically

• Device & Browser Data: IP address, browser type and version, operating system, device identifiers, and screen resolution.
• Usage Data: Pages visited, courses viewed, time spent on pages, click patterns, search queries, and navigation paths.
• Learning Progress: Course completion rates, video watch time, assessment scores, and certification achievements.
• Cookies & Similar Technologies: We use cookies, web beacons, and similar tracking technologies as described in our Cookie Policy.

1.3 Information from Third Parties

• Google OAuth: When you sign in with Google, we receive your name, email address, and profile picture from Google.
• Payment Providers: Transaction confirmations and limited account information from Paystack and Stripe.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Service Delivery: To create and manage your account, generate personalized learning curricula, process payments, issue certifications, and operate the Talent Marketplace.
• Personalization: To tailor your learning experience, recommend courses, and match you with relevant opportunities in the marketplace.
• Communication: To send you service-related notifications, updates, promotional materials (with your consent), and respond to your inquiries.
• Analytics & Improvement: To analyze usage patterns, improve our AI algorithms, enhance platform features, and optimize user experience.
• Security: To detect, prevent, and address fraud, abuse, security incidents, and technical issues.
• Legal Compliance: To comply with applicable laws, regulations, legal processes, and government requests.
• Certification Verification: To allow third parties (such as employers) to verify the authenticity of certificates you share with them.

Legal Basis for Processing (GDPR/NDPR): We process your personal data based on (a) your consent, (b) the necessity to perform our contract with you, (c) our legitimate business interests, or (d) compliance with legal obligations.

3. Information Sharing

We do not sell your personal information. We may share your data in the following circumstances:

• Talent Marketplace: If you create a public talent profile, your name, skills, certifications, and portfolio are visible to potential employers and other users.
• Service Providers: We share data with trusted third-party providers who assist us in operating the Platform (e.g., cloud hosting, payment processing, email delivery, analytics).
• Payment Processors: Transaction data is shared with Paystack and Stripe to process your payments securely.
• Legal Requirements: We may disclose your information if required by law, court order, or governmental regulation, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business Transfers: In the event of a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of that transaction.
• With Your Consent: We may share your information with third parties when you have given us explicit consent to do so.

4. Data Security

We implement industry-standard security measures to protect your personal information, including:

• Encryption of data in transit (TLS/SSL) and at rest.
• Secure password hashing using modern algorithms.
• Regular security assessments and vulnerability testing.
• Access controls limiting employee access to personal data on a need-to-know basis.
• Secure payment processing through PCI-DSS compliant providers (Paystack and Stripe).

While we strive to protect your personal information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security but will notify you and relevant authorities of any data breach as required by applicable law.

5. Cookies and Tracking

We use cookies and similar tracking technologies to enhance your experience, analyze usage, and deliver personalized content. For detailed information about the cookies we use and how to manage your preferences, please refer to our Cookie Policy.

6. Third-Party Services

Our Platform integrates with the following third-party services:

7. Your Rights

Under the NDPR, GDPR, and other applicable data protection laws, you have the following rights regarding your personal data:

• Right of Access: You may request a copy of the personal data we hold about you.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data.
• Right to Erasure: You may request deletion of your personal data, subject to legal retention requirements.
• Right to Restrict Processing: You may request that we limit the processing of your personal data in certain circumstances.
• Right to Data Portability: You may request a machine-readable copy of your personal data to transfer to another service.
• Right to Object: You may object to the processing of your personal data for direct marketing or on grounds relating to your particular situation.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of prior processing.
• Right to Lodge a Complaint: You may file a complaint with the Nigeria Data Protection Commission (NDPC) or a relevant supervisory authority in your jurisdiction.

To exercise any of these rights, please contact us at support@inspaya.net. We will respond to your request within 30 days.

8. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. Specifically:

• Account Data: Retained for the duration of your active account plus 2 years after account deletion.
• Transaction Records: Retained for 7 years in accordance with Nigerian financial record-keeping requirements.
• Certification Records: Retained indefinitely to support ongoing certificate verification.
• Usage & Analytics Data: Retained in anonymized or aggregated form for up to 3 years.
• Communication Records: Retained for 2 years after your last interaction with us.

9. Children's Privacy

The Service is not directed to children under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have inadvertently collected personal data from a child under 16, we will take steps to delete such information promptly. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@inspaya.net.

10. International Data Transfers

Inspaya is based in Nigeria, but our Service is accessible globally. Your personal data may be transferred to and processed in countries other than your country of residence, including countries that may not provide the same level of data protection as your home country.

When we transfer personal data internationally, we implement appropriate safeguards, including:

• Standard Contractual Clauses approved by relevant data protection authorities.
• Ensuring third-party recipients maintain adequate data protection standards.
• Obtaining your explicit consent where required by applicable law.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last updated" date at the top of this policy.
• Notify you via email or an in-app notification for significant changes.
• Obtain your consent where required by applicable law.

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after any changes constitutes your acceptance of the updated policy.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

For complaints regarding data protection, you may also contact the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.