Campuso Privacy Policy

Last updated: [date]

Campuso ("we", "us") is operated by [legal company name], [registered address], Nigeria. This policy explains what we collect when you use the Campuso app and website (app.campuso.ng), why, and your rights under the Nigeria Data Protection Act 2023 (NDPA).

Contact for anything in this policy: [privacy@campuso.ng].

1. What we collect

Account and profile

• Your university email address. We use it to confirm you belong to your school.
• Your username, full name, bio and profile photo.
• Your faculty, department, level, admission year and expected graduation year.
• Whether you are a student or staff.

What you post

• Posts, photos, comments and likes.
• Messages you send in chats and groups.
• Confessions and whistleblow reports, which are handled specially (see section 3).

Wallet and payments

• Your wallet balance and transaction history: top-ups, boosts, badges, gifts and transfers.
• Card payments are processed by Paystack. We never see or store your full card details. We receive a payment reference and the amount.

Technical

• Sign-in records kept by Firebase Authentication.
• Basic device and app information needed to run the service and send notifications.

Biometric unlock

• If you turn it on, your fingerprint or face check happens entirely on your phone. We never receive biometric data, only a setting that says the lock is on.

2. Why we use it

• To run the app: show your school's feed, deliver messages, process wallet transactions and send notifications. *Legal basis: contract.*
• To keep Campuso to verified members of each university, and to stop abuse, fraud, harassment and illegal content. *Legal basis: legitimate interests and legal obligation.*
• To keep financial records as required by law. *Legal basis: legal obligation.*

We do not sell your personal data, and we do not use it for third-party advertising.

3. Confessions and whistleblowing

Confessions

• Confessions appear to other students as "Campuso Anonymous", with no name or username.
• We do privately record which account posted each confession. Only Campuso administrators can see that link. We use it only to deal with illegal content, harassment or threats, or when the law requires us to.
• Confessions are reviewed by an administrator before they appear.

Whistleblow reports

• A report is visible only to you and to Campuso administrators.
• The admin screens do not show who submitted it. Your account ID is stored with the report so that only you can check its status with your ticket ID.
• We disclose a reporter's identity only if a court or law-enforcement order requires it.

4. Who can see your information

• Students and staff at your university: your profile, posts, comments, likes and approved confessions (without your name). Other universities cannot see them.
• People you message: your messages, in that chat or group only.
• Campuso administrators: for moderation, support and safety.
• Service providers who process data for us:
  • Google Firebase: database and sign-in, stored in the EU (europe-west2, London).
  • Cloudflare: photo storage and server functions.
  • Paystack: payments.
  • Daily.co: voice and video calls.
  These providers may process data outside Nigeria under safeguards permitted by the NDPA.
• Authorities: when the law requires it.

5. How long we keep it

• Profile and content: while your account is active. Deleted content is removed from the app straight away and from backups within [30] days.
• Wallet and payment records: [6] years, as financial records.
• Moderation records (reports, bans, confession authorship): up to [2] years after the case closes.

6. Your rights

Under the NDPA you can:

• ask for a copy of your data;
• correct it, or ask us to delete it;
• object to or restrict some uses;
• withdraw consent where we rely on it.

Email [privacy@campuso.ng]. We will reply within 30 days. You can also complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

Deleting your account: request it at https://app.campuso.ng/delete-account, in the app under ☰ → Settings → Delete my account, or by emailing [privacy@campuso.ng] from your university address. Within [30] days we delete:

• your profile and photo;
• your posts, comments, likes and messages;
• your confession and whistleblow authorship links.

We keep wallet and payment records for the period the law requires, then delete them.

7. Age

Campuso is for university students and staff. You must be at least [16] years old to use it.

8. Security

We use access rules that limit each account to its own school's data, encrypted connections, and server-side handling of all money movements. No system is perfectly secure. Tell us at [security@campuso.ng] if you find a problem.

9. Changes

If we change this policy in a way that matters, we will tell you in the app before the change takes effect.