Privacy Policy
This explains what Novel AI Services collects about you, why, who else sees it, and what you can make us do about it. The controller is NOVEL DESIGNERS (BN 6882663) of 2 Oshodi Tapa Close, Opposite Health Centre, Ajah, Lagos, Nigeria. Data-protection questions go to privacy@novelaiservices.com.
We are subject to the Nigeria Data Protection Act 2023, and to the UK and EU GDPR where we handle data about people there.
1. What we collect
When you go through a quiz
- Your answers, and a first name if you give one.
- Your email address, once you enter it.
- Where you came from — UTM parameters and ad click identifiers (
gclid,fbclid,ttclid), the referring page, your browser’s user agent and the country your IP resolves to. We do not store the IP address itself. - Which screens you reached, so we can see where people give up.
When you buy something
- Your email, the plan, the amount, the currency and how you paid.
- Payment details go straight to Paystack. We never receive or store your card number.
- If you are a creator taking payouts: your bank code, bank name and the account name the bank returns. We deliberately do not keep a copy of your account number — Paystack holds it, because Paystack is the only party that needs it.
When you learn
- Which lessons you finished, your quiz answers and scores.
- Sign-in sessions. Emailed links are stored only as a SHA-256 hash, never as the link itself.
- If you turn on notifications: your browser’s push endpoint and its keys.
When you use the creator studio
- Files you upload and the text extracted from them.
- The courses generated from that material.
When something breaks
We record the error message, the page path and your browser version. We strip the query string first, so ad identifiers do not end up in error logs.
2. Why we are allowed to
| What | Lawful basis |
|---|---|
| Running your account, delivering courses, taking payment | Performance of a contract with you |
| Keeping financial and tax records | Legal obligation |
| Security, fraud prevention, fixing faults, basic analytics | Our legitimate interests in running a working service |
| Marketing email, advertising cookies, push notifications | Your consent — asked for separately, never pre-ticked |
Where we rely on consent you can withdraw it at any time and it costs you nothing else: unsubscribe from any email, turn notifications off in your browser, or email us.
3. Who else sees it
We do not sell your personal data. We share it with the providers that make the service work, each bound to use it only on our instructions.
| Provider | What for | What they get | Where |
|---|---|---|---|
| Vercel | Hosting and content delivery | IP address, request logs | United States, EU |
| Supabase | Database and file storage | Everything stored: account, learning and payment records | Configured region |
| Paystack | Payment processing | Email, payment details, transaction records | Nigeria |
| Resend | Transactional email | Email address, message content | United States |
| Anthropic | Course generation from your uploads | Text you upload to the studio | United States |
| Voyage AI | Search indexing of your uploads | Text you upload to the studio | United States |
| Unstructured | Reading PDF, DOCX and PPTX uploads | Files you upload to the studio | United States |
| Google Cloud (Vertex AI) | Lesson image generation | Image prompts derived from your course | United States |
| ElevenLabs | Narration, when you use it | Lesson text, and a voice sample if you clone your voice | United States |
| PostHog | Product analytics | Pseudonymous usage events | United States |
| Meta, TikTok, Google | Advertising measurement | Hashed email, event data — only where you consented | United States |
| Push services (Google, Mozilla, Apple) | Delivering notifications you asked for | Device push endpoint, notification content | Varies by browser |
Several are outside Nigeria and outside the EEA. Those transfers rely on the providers’ standard contractual clauses and equivalent safeguards under NDPA s.41 and GDPR Chapter V.
On the AI providers: material you upload to the studio is sent to them to generate your course. We use their business APIs, under terms that do not permit training models on your content.
4. Cookies
We use three, all first-party, all set to be unreadable by JavaScript. None of them is an advertising cookie.
| Cookie | What it does | Lasts |
|---|---|---|
cm.student | Keeps you signed in | 30 days |
cm.creator | Identifies an anonymous creator workspace | 1 year |
cm.bucket | A number from 0–999 that keeps you on one version of a page we are testing. It says nothing about you. | 90 days |
Your quiz answers are kept in your own browser’s local storage so you can come back to where you were. Advertising and analytics scripts load only where you have consented to them.
5. How long we keep it
- Quiz sessions that never became an account — 12 months.
- Account and learning records — while your account is open, then 12 months.
- Payment records — 6 years, because tax law requires it.
- Sign-in links — 20 minutes, single use.
- Error reports — 90 days.
- Push subscriptions — until you turn them off or the browser drops them.
6. Your rights
Under the NDPA and the GDPR you can ask us to:
- Give you a copy of what we hold about you.
- Correct anything wrong.
- Delete it, where we are not legally required to keep it.
- Stop or limit a particular use, including any use based on our legitimate interests.
- Send it to another provider in a machine-readable form.
Email privacy@novelaiservices.com. We reply within 30 days and it is free. If you are not satisfied you can complain to the Nigeria Data Protection Commission, or to your own supervisory authority in the UK or EU.
7. Security
Everything travels over HTTPS. There are no passwords to leak, because we do not use them. Sign-in tokens are stored hashed. Sessions are rows we can revoke rather than signed cookies that outlive us. Access to production data is limited to people who need it.
No system is perfectly secure. If a breach affects you we will tell you, and notify the NDPC within 72 hours as the Act requires.
8. Children
This service is for adults. We do not knowingly collect data about anyone under 18. If you believe we have, email us and we will delete it.
9. Changes
If we change this materially we will email account holders before it takes effect. The date at the bottom of this page always tells you which version you are reading.
The Terms of Service and Subscription Terms complete the picture.