Privacy Policy

• We collect your account details, what you do on the platform, and your payment records.
• We use them to run your account, teach you, take payment, and keep the platform safe.
• We share them only with the services that make the platform work — our database host, payment processor, email provider and file storage — plus your lecturers, who see who is enrolled in their own courses.
• Your private notes stay private. Reviews you post are public, under your name.
• You can ask to see, correct, export or delete your data at any time.

AceMaxHub is the data controller for the personal data described here — meaning we decide what is collected and why. We process it in line with the Nigeria Data Protection Act 2023 (NDPA).

Our contact point for anything in this policy is privacy@acemaxhub.com.

Account and profile. Your name, email address, password (stored only as a cryptographic hash, never in readable form), profile photo if you have one, and your role on the platform. During onboarding we also ask for your institution and academic level, so courses can be pitched at the right stage.

Sign-in and session data. When you sign in we create a session and record the IP address and browser user-agent it was created from, so you and we can spot access you do not recognise. If you sign in with Google, we receive your name, email address and profile picture from Google along with the tokens needed to keep that connection working. We never receive your Google password.

Learning activity. The courses you enrol in, the lessons you complete and how far through you are, your quiz attempts and the answers you chose, your daily study activity (which is what the study streak counts), bookmarks, private notes, certificates issued to you, and any reviews or ratings you leave.

Payments. When you pay for a month of a course or bundle, we record the amount, the currency, the status, the payment channel used, and the reference Paystack gives the transaction, along with what you bought. We never see or store your card number, CVV or PIN — those go directly to Paystack.

Files and course material. If you are a lecturer, the teaching material you upload, along with its file name, type, size and a reference to where it is stored. If you are a student, anything you attach to a support request.

Analytics, only if you allow it. If you accept analytics on our cookie banner, Google Analytics and Vercel Analytics record the pages you view, how you arrived at them, your type of device and browser, your approximate location, and how quickly pages load. Google Analytics also stores a random identifier in a cookie so it can recognise a returning browser. If you reject analytics or never answer, none of this is collected. See section 5.

Support. The tickets you open, the messages in them, and our replies.

Technical data. Standard information your browser sends, plus aggregate performance and page-view measurements described in section 5.

Under the NDPA we must have a lawful basis for each use. Ours are:

• To provide the platform — creating your account, showing your courses, tracking progress, issuing certificates, taking payment. Basis: performance of our contract with you.
• To communicate with you — verification and password-reset emails, replies to your support tickets, and notices about changes that affect you. Basis: contract, and our legitimate interest in running the service.
• To keep the platform safe and working — detecting fraud and abuse, investigating breaches of our terms, and diagnosing faults. Basis: our legitimate interest in a secure, reliable platform.
• To understand how the site is used — counting page views, understanding how visitors find and move through the site, and measuring how quickly pages load, through Google Analytics, Vercel Analytics and Speed Insights. Basis: your consent, which you give or refuse on our cookie banner and can withdraw at any time (see section 5).
• To meet our legal duties — keeping financial records, and responding to lawful requests. Basis: legal obligation.

We do not use your learning activity to profile you for advertising, and we do not make automated decisions that have a legal or similarly significant effect on you.

We keep this deliberately small. Some of it is strictly necessary and always on; the analytics only run if you agree to them.

• A session cookie that keeps you signed in. Without it you would have to sign in on every page, so it is strictly necessary.
• A preference cookie (sidebar_state) that remembers whether you left your dashboard sidebar open or collapsed. It is only set when you open or collapse the sidebar yourself.
• A consent cookie (cookie_consent) that records whether you accepted or rejected analytics, so we do not ask on every visit. It expires after six months, after which we ask again. It is strictly necessary to respect your choice.
• Google Analytics (_ga, and a second cookie beginning _ga_), which stores a random identifier so it can recognise a returning browser and count visits. It only runs if you select Accept on our cookie banner. Google asks for these cookies to last two years; some browsers, including Chrome, limit that to 400 days. Google’s advertising features — Google Signals and Google Ads linking — are turned off, so this data is not linked to your Google account or used to personalise ads.
• Vercel Analytics and Speed Insights, which measure page views and loading performance in aggregate. Like Google Analytics, they only run if you accept. They are privacy-focused: they do not use advertising cookies and do not build a profile of you across other websites.

Changing your mind. We ask on our homepage the first time you visit. To change your choice later, clear the cookie_consent cookie for this site in your browser settings, and we will ask again the next time you open the homepage. If you had accepted, also clear the cookies beginning _ga, which Google Analytics leaves in your browser until they expire. Withdrawing consent stops the analytics from loading from then on; it does not affect analytics data already collected, which is kept as described in section 9.

We do not use advertising or social media tracking pixels. You can clear or block cookies in your browser, but clearing or blocking the session cookie will sign you out and stop you signing in.

• You — your profile, progress, notes, certificates and payment history, from your dashboard.
• Your lecturers — the lecturer who owns a course can see which students are enrolled in it and how those students are progressing through their course. They cannot see your private notes, your payment details, or your activity in other lecturers’ courses.
• Other users — only what you choose to make public: your name and any review or rating you post on a course.
• Our administrators — staff who run the platform can see account details, enrolments and payment records where needed to provide support, moderate content, or investigate abuse. For troubleshooting, an administrator may also access an account directly; when that happens it is recorded against the session.
• Authorities — where we are legally required to disclose data, or need to in order to establish or defend a legal claim.

We do not sell personal data, and we do not share it with advertisers.

These providers process data on our behalf, under contract, and only for the purposes we set:

• Supabase — hosts our Postgres database, where nearly everything described in section 3 is stored.
• Vercel — hosts and serves the application, and — only if you accept them — provides the analytics and performance measurement in section 5.
• Paystack — processes payments and handles your card details directly.
• Google — provides optional sign-in, stores lecturers’ uploaded teaching files, and — only if you accept analytics — provides Google Analytics. Uploaded files are served back through AceMaxHub’s own access checks rather than public links.
• Resend — delivers our transactional email, and therefore handles your email address and the contents of those messages.

The providers above operate infrastructure outside Nigeria, so your personal data is transferred to and stored in other countries. Where the NDPA requires it, we rely on the safeguards in our contracts with those providers to keep your data protected to the standard Nigerian law expects.

• Account and learning data: for as long as your account is open.
• After your account is closed: we delete or anonymise your data within 90 days, except where we must keep it longer.
• Payment records: kept for as long as financial and tax law requires, even after an account closes.
• Support tickets: kept for up to two years, so we have context if you write to us again.
• Session records, including IP address and user agent: kept for a short period for security purposes, then removed as sessions expire.
• Google Analytics data, if you accepted analytics: event-level data is kept for 2 months and then deleted by Google. Google Analytics’ aggregated reports, which do not identify individuals, are not subject to that limit.

Certificates and course reviews may remain visible after account closure in an anonymised form, so that course ratings stay meaningful.

• Passwords are stored only as salted cryptographic hashes — we cannot read them, and neither can anyone who obtained the database.
• Email addresses must be verified before an account can be used.
• Every page and every action re-checks who you are on the server before returning data, rather than trusting the browser.
• Uploaded course files are served through our own access checks, not public links.
• Traffic is encrypted in transit, and standard security headers are applied to every response.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the Nigeria Data Protection Commission as the NDPA requires.

Under the NDPA you have the right to:

• Access the personal data we hold about you, and get a copy of it.
• Correct it where it is wrong — you can edit most of your profile yourself from your dashboard.
• Delete your account and the data attached to it, subject to the records we must keep by law.
• Restrict or object to certain processing, including anything we do on the basis of legitimate interest.
• Receive your data in a portable, machine-readable format.
• Withdraw consent where our use rests on consent — for analytics, by changing your cookie choice as described in section 5 — without affecting what we did before you withdrew it.
• Complain to the Nigeria Data Protection Commission.

To exercise any of these, email privacy@acemaxhub.com from the address on your account. We respond within 30 days. We will not charge you or treat you differently for asking.

AceMaxHub is built for students in tertiary medical education and is not directed at children. You must be at least 16 to hold an account. If we learn that we hold data about a child below that age, we will delete it. If you believe that has happened, write to us.

We will update this policy as the platform changes. The date at the top always reflects the current version, and for significant changes we will notify you by email or in your dashboard before they take effect.

For anything about this policy or your data, email privacy@acemaxhub.com. For help with your account, email support@acemaxhub.com or open a support ticket from your dashboard.

If you are not satisfied with how we have handled your data, you can complain to the Nigeria Data Protection Commission.