Privacy Notice

CopaServe is operated by Business Intelligence Technologies Limited (BIT Ltd), Lagos, Nigeria. We are the data controller for the personal data described here, and we process it under the Nigeria Data Protection Act 2023 (NDPA).

For anything in this notice, including a request about your data, write to privacy@copaserve.com.ng.

Account details. Your email address, and the name you give us. Optionally a display name, photograph, short biography, profession, organisation, country, phone number and an emergency contact — all of which you choose to provide and can remove.

What you do on the platform. Which courses you enrol in, which lessons you complete, quiz attempts and scores, assignment submissions, live-class attendance, and derived figures such as your streak, learning minutes and points.

Certificates. Your name, the course, the issuing institution, the instructor, and the dates — recorded so a certificate can be verified.

Payments. A reference, amount, currency and status. Card and bank details are handled entirely by our payment providers and never reach CopaServe.

A wallet address, only if you choose to link one. This is optional and no learning or certification feature requires it.

Consent records. What you agreed to, when, and from what IP address and browser — kept so we can show what you were told, not to profile you.

What you type to Cruise, the assistant in the corner of the page: your question, and your first name so it can address you. It can look up your own enrolments, payments and certificates in order to answer, and can re-check a payment or issue a certificate you have already earned. It cannot see anyone else’s account. Conversations are not stored — closing the tab ends them — though anything it changes is recorded in our audit log like any other action.

Bank details, if you teach: your bank, account number and the name on the account, used only to pay you your share of sales. Each payout keeps a copy of the details it was sent to, so the record of where money went stays accurate if you change them later.

Enquiries, if you write to us about training for an organisation: your name, email, and optionally a phone number, organisation and team size, along with what you asked. You do not need an account to send one.

If you send an enquiry, we use what you wrote to reply to it and for nothing else. It does not add you to a mailing list, and we will not email you about anything other than the thing you asked about.

To run your account and deliver the courses you enrol in; to mark your work and issue certificates; to let employers and regulators verify those certificates; to take payment; to send you service messages about your account; and to meet our own legal and audit obligations.

Marketing email is separate and only ever with your consent, which you can withdraw at any time without affecting your account.

This deserves stating plainly. A certificate carries a credential ID, and anyone holding that ID can look it up at our verification page without signing in. The result shows the holder’s name, the course, the issuing institution, the instructor, the dates, and whether it is still valid.

That is the entire point of a verifiable credential, and it is why an employer can trust one. But it does mean your name and course become visible to anyone you give the ID to, or anyone they pass it on to. No other part of your account, and nothing about your progress, scores or payments, is exposed this way.

We use a small number of providers, each for one job: Supabase (database, authentication and file storage), Vercel (hosting), Sendlib (email), Termii (SMS), Kora (payments), and Anthropic (the Cruise assistant). They process data on our instructions and for no purpose of their own.

Cruise is built on Anthropic’s Claude. When you send it a message, that message, your first name, and whatever it looks up in your account to answer are sent to Anthropic in the United States. Under Anthropic’s commercial terms it is not used to train their models. If you would rather nothing of yours went there, do not use Cruise — nothing else on the platform depends on it, and every answer it gives is available from the pages themselves.

Paystack processed payments taken before September 2026 and still handles refunds and queries on those. New payments go through Kora.

We do not sell personal data, and we do not share it with advertisers.

Our database, file storage and application servers are in London, United Kingdom. Your data therefore leaves Nigeria.

Some processing happens elsewhere: messages you send to Cruise go to Anthropic in the United States, payment details go directly to Kora, and email we send you passes through Sendlib. Each of those providers holds only the part it needs to do its job.

We chose that location because it is the closest region with the reliability this service needs, and because keeping the database and the application in the same place is what makes the platform fast enough to use from Nigeria. Transfers are made under the NDPA’s provisions for cross-border transfer, and our providers are bound by contract to protect the data to the same standard.

Your account data is kept while your account is open. If you ask us to erase it, we redact your record rather than dropping the row, because certificates already issued must remain verifiable and administrative actions must remain auditable — both are obligations we cannot meet by deleting the evidence.

Consent and audit records are append-only by design: they exist to show what happened, which is not something that can be edited afterwards.

Under the NDPA you may:

• ask what we hold about you, and get a copy;
• have inaccurate details corrected;
• ask us to erase your data, subject to the retention obligations above;
• withdraw consent to marketing at any time;
• object to processing, or ask us to restrict it;
• complain to the Nigeria Data Protection Commission.

If you have an account, access and export are self-service in your privacy centre. Correction and erasure go to a person for review, because both have to be weighed against the retention obligations above — you will get an answer either way.

We set cookies to keep you signed in. They are necessary for the platform to work and are not used for advertising or cross-site tracking. Our hosting provider keeps ordinary server logs for security and reliability.

Access to your data is enforced in the database itself, not only in the application, so one mistake in a page cannot expose another person’s records. Passwords are never stored by us. Two-factor authentication is available on every account. Administrative actions are written to an audit log.

If we change how we handle personal data we will update this notice and, where the change matters to you, tell you directly rather than relying on you to re-read this page.