Privacy Policy

OneSitting is a study app that helps students in Nigeria prepare for JAMB UTME. It is run by Simpa Labs Ltd, a company registered in Nigeria. In this policy, “we”, “us” and “our” mean Simpa Labs Ltd.

We are the data controller for the personal data we collect through the OneSitting app, the website and the OneSitting admin tools. This means we decide why and how your data is used, and we are responsible for keeping it safe under the Nigeria Data Protection Act 2023 (NDPA) and the rules of the Nigeria Data Protection Commission (NDPC).

Data you give us

• Account details: your name, email address, password (stored only as a secure hash) and profile photo.
• If you sign in with Google, the name, email address and photo that Google shares with us.
• Study details: your target course, school, exam year and the subjects you pick.
• What you create: notes, study packs, questions you ask, community posts, comments and messages to support.

Data we collect as you study

• Practice activity: questions you answer, your answers, scores, time spent, streaks, points and badges.
• Groups and squads you join, and challenges you play with other students.
• Device details: device type, operating system, app version, language and a push notification token.
• Technical logs: IP address, request times and error reports. We use these to keep the service safe and working.

Payment data

When you buy OneSitting Plus or credits, you pay through Google Play. Google collects your card, bank or airtime details directly. We never see or store your card number, PIN or bank login. We only receive the order number, product, status, renewal date and country of the purchase.

The NDPA says we must have a lawful reason for each use of your data. Here is what we do and the reason for it.

• Run your account and the app. Sign you in, save your progress and show your scores. Reason: to provide the service you signed up for (contract).
• Personalise your practice. Pick questions, topics and explanations that match your level and goals. Reason: contract.
• Study help. When you ask for an explanation or a summary, we send your question and the related study content to our study help provider to create the answer. Reason: contract.
• Payments. Confirm payments, unlock what you paid for and keep records. Reason: contract and legal duty.
• Community features. Show your name, photo and posts to other students in groups, squads and leaderboards. Reason: contract.
• Reminders. Send study reminders and streak alerts. Reason: consent. You can turn these off in your phone settings or in the app.
• Safety and security. Stop abuse, spam, cheating and fraud, and fix errors. Reason: our legitimate interest in a safe service.
• Improve OneSitting. Study how features are used, using totals and trends where we can. Reason: legitimate interest.
• Legal duties. Keep records and respond to lawful requests from Nigerian authorities. Reason: legal obligation.

We do not sell your personal data. We do not use it to show you third-party ads.

We only share data with companies that help us run OneSitting. Each one may use your data only to provide its service to us.

• Vercel hosts our servers and website.
• Prisma and our database host store your account and study data.
• Google provides Google sign-in and our study help features.
• InstantDB powers live features such as group chats and live challenges.
• Google Play processes payments and subscriptions.
• Apple and Google deliver push notifications to your phone.

We may also share data if the law requires it, to protect the safety of a student or the public, or as part of a merger or sale of our business. If that happens, we will tell you and your data will stay protected by this policy.

Some of the companies above store data on servers outside Nigeria, for example in the European Union or the United States. When we send data outside Nigeria, we follow sections 41 to 43 of the NDPA. We only use providers that offer a proper level of protection, and we rely on written contracts that require them to keep your data safe.

• We keep your account and study data while your account is open.
• When you delete your account, we delete your account and the data linked to it from our database right away. Backup copies are removed as our backups cycle out.
• Google keeps its own records of your Google Play payments under the Google Privacy Policy.
• Technical logs are kept for up to 90 days, unless we need them longer to look into a security problem.

Under the NDPA, you have the right to:

• Know what personal data we hold about you and get a copy of it.
• Ask us to correct data that is wrong or out of date.
• Ask us to delete your data.
• Ask us to limit how we use your data, or object to a use based on our legitimate interest.
• Get your data in a common format so you can move it to another service.
• Withdraw consent at any time, for example by turning off reminders. This does not affect what we did before.
• Not be subject to decisions made only by automated means that have legal or similarly serious effects on you.

You can edit most of your details in the app. You can delete your account in the app under Settings. For any other request, email support@simpalabs.com. We may ask you to confirm who you are. We reply within 30 days.

If you are not happy with how we handled your data, you can complain to the Nigeria Data Protection Commission at ndpc.gov.ng.

Many students preparing for JAMB are under 18. Under section 31 of the NDPA, a parent or legal guardian must agree before a student under 18 uses OneSitting. By creating an account, a student under 18 confirms that their parent or guardian has agreed.

A parent or guardian can ask to see, correct or delete their child’s data at any time by emailing support@simpalabs.com. If we learn that a student under 18 is using OneSitting without this consent, we will close the account and delete the data.

OneSitting is not meant for children under 13.

We encrypt data as it travels between your phone and our servers. Passwords are stored as secure hashes, never as plain text. Only staff who need access for their work can reach personal data, and payment keys stay on our servers.

If a data breach is likely to put your rights at risk, we will report it to the NDPC within 72 hours of finding it, as the NDPA requires. If the risk to you is high, we will also tell you directly and explain what you can do.

We may update this policy when our service or the law changes. The date at the top shows the latest version. If we make a big change, we will tell you in the app or by email before it takes effect.

For any privacy question or request, email our data protection team at support@simpalabs.com. Write “Privacy” in the subject line so it reaches the right person quickly.