UTMEPrep
Menu

Privacy

Last updated November 2026 (version 2026-11)

This is a plain-language draft. It describes how the app works today and must be reviewed by a lawyer before launch, especially because many students are under 18.

In plain words

  • We keep what we need to help you practise: your name, email, subjects and goals, and your answers and scores.
  • Only you see your own practice. If you join a school or centre, your teachers see your class tests and assignments. Other learners only ever see your first name.
  • We never ask for your NIN, BVN, home address, location or ID documents, and there is no chat with strangers.
  • The AI tutor sends your questions to an AI company only to get the answer, and only after you agree.
  • We do not sell your data and we do not show adverts.
  • You can download your data, ask us to correct it, or delete your account, from Settings. We answer within 30 days.
  • If you are under 18, please read this with a parent or guardian. They can make requests about your data for you.

Who we are

UTMEPrep is run by UTMEPrep Hub, 10, Adewunmi Street, Meiran, Lagos, Nigeria. We decide how your personal data is used (we are the “data controller”), except for school and centre records, which we hold for your school or centre. Our data protection contact is [DPO contact]; you can also write to privacy@utmeprep.app.

What we collect, and why

  • Your account: name and email (or your Google name and email if you sign in with Google), so you can sign in and we can address you.
  • Your age group: under 16, 16 or 17, or 18 or older. We never ask your date of birth. It lets us explain things in the right way and apply the right protections.
  • A parent or guardian’s email (optional, under-18s only): only to send them this notice and to answer their requests about your data.
  • A leaderboard nickname (optional, learners on their own): what others see on the leaderboard instead of your name.
  • Your goals: course, UTME year, subjects, target university and score, and your state (never shown to other learners), so practice fits you.
  • Your learning: answers and scores in practice, mocks, tests, assignments, battles and cups, study days, XP, badges, saved questions and notes you have read, so we can show your progress and what to practise next.
  • School or centre: which one, and your class or cohort, if you join with a code.
  • Payments: payment references, amounts and Premium dates. Card details go to Paystack, never to us.
  • Messages you send us: support messages, screenshots you choose to attach, and reports about questions or players.
  • The AI tutor: your questions and any photo of a question go to an AI company to get the answer. We do not keep them; your past chats stay on your own phone. If you tell us whether an answer helped, we keep only that yes or no and the subject.
  • Technical: your sign-in sessions, notification choices and device address for push notices, and error reports (with your name, email, phone number and IP address removed).

Our reasons (lawful basis)

Draft, to be confirmed by our legal adviser:

  • To provide UTMEPrep to you (practice, progress, Premium): because you asked us to (contract).
  • For school and centre records: on behalf of your school or centre.
  • For security, preventing abuse and keeping logs: our legitimate interests in keeping UTMEPrep safe.
  • For the AI tutor, your public profile, email and push notices: your consent, which you can withdraw at any time in Settings or Notifications.
  • For payment records: our legal obligations.

Who can see your data

  • You see everything about you.
  • Your teachers see results of tests and assignments they set your class, and your study time. Not your personal practice.
  • On the leaderboard (learners on their own), others see only a nickname you choose, never your name. Without a nickname you are not on it.
  • Other learners see your first name only, and only within your own school or centre (or, for learners on their own, other learners on their own). No chat. If you switch on a public profile, anyone with the link sees your first name, level, streak and pinned badges.
  • UTMEPrep staff see only what their job needs (for example, support staff see support messages), and their actions are logged.
  • Service providers who run parts of UTMEPrep for us (below). We do not sell your data to anyone.

Service providers, and data outside Nigeria

These companies process data for us. Most are outside Nigeria, so your data is transferred abroad; we use providers with security commitments and data processing terms.

  • Supabase (database and sign-in): all stored data, kept in Paris, France (EU).
  • Vercel (runs the website): requests and logs, in Paris and worldwide edge servers.
  • Paystack (payments, Nigeria): payer email, amount and card details.
  • Resend (email, USA): your email address and the message.
  • Sentry (error reports): reports with personal details removed.
  • Cloudflare Turnstile (stops spam on forms): your browser and connection, for that check only.
  • AI providers (Anthropic, OpenAI, Google or IFM, mainly USA): your tutor questions and photos, only to answer them.
  • Your browser’s push service (Google, Apple, Mozilla or Microsoft): a device address and a short notice, never names or scores.

How long we keep it

Draft periods, to be confirmed:

  • Your account and learning records: while your account is open; deleted when you delete your account.
  • Notifications: 90 days. Handled support messages and screenshots: 12 months. Reminder records: 90 days.
  • Records of privacy requests: 2 years after they are answered. Help feedback: 2 years. Staff and school action logs: 3 years.
  • Payment records: as long as the law requires.
  • Backups: deleted data disappears from backups when they expire (within days).

Your rights

You can, at any time:

  • See and download your data: Settings → Privacy and your data → Download.
  • Correct it: most details on your Profile; anything else with a request in Settings.
  • Delete your account: Settings → Delete my data. We do it within 30 days.
  • Restrict or object to some uses, and withdraw consent (AI tutor, public profile, email and push notices) in Settings or Notifications.
  • Ask about anything else: privacy@utmeprep.app.

We answer within 30 days. We may need to check it is really you.

Children and parents

Many UTME candidates are under 18. We ask for an age group (never a date of birth or ID), explain things simply, and let under-18s add a parent or guardian’s email. A parent or guardian can make a request about their child’s data on our parents and guardians page. Centres are for adults (18 or older). How consent works for under-18s will be confirmed with our legal adviser before launch.

Keeping it safe

Everything is sent over secure connections and stored encrypted. Passwords are never stored in readable form. Each person and staff member can reach only what their role allows, and that is checked in the database itself. Staff must use a second sign-in step. If a breach ever risks your rights, we will tell the Nigeria Data Protection Commission (NDPC) within 72 hours and tell you as soon as we can.

Complaints

Please tell us first at privacy@utmeprep.app, and we will try to put it right. You can also complain to the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

Changes

When we change this policy in a way that matters, we show you the new version in the app before you continue.