Privacy Policy

Joche Academy runs this platform and decides how your data is used. For anything in this policy, including a request to see or delete your data, write to support@jocheacademy.com. That address reaches the person responsible for data protection here.

If you are not satisfied with how we answer, you can complain to the Nigeria Data Protection Commission. You do not need our permission to do that.

• Account and profile: your name, email address, and anything you choose to add such as a photo or a short bio.
• Learning activity: the courses you enrol in, which lessons you have finished, how far through a video you were, quiz attempts and scores, assignment submissions including any files you upload, and certificates issued to you.
• Payment records: the amount, currency, reference and status of each purchase. Card details are entered on Paystack and never reach our servers.
• Community activity: posts, comments, reactions, forum topics and replies, group membership, who you follow, and direct messages you send to other members.
• Instructor applications: if you apply to teach, we collect your contact details, phone number, the documents you attach (a CV or certificates, which usually contain your employment history), and, so we can pay you, your bank name, account name and account number.
• Support and concierge conversations: what you type into the chat widget or a support ticket. The chat is available without signing in, and see section 5 for where those messages go.
• Email and notification preferences, and a record of the emails we have sent you so we do not send the same one twice.

Most of it you gave us. Some of it we imported. Joche Academy previously ran on a WordPress site at jocheacademy.com, and when we moved to this platform an administrator copied across existing accounts and the courses those people had already bought. If that includes you, we hold your name, email address, profile photo and bio, the role you held on the old site, and your enrolment history, without you having signed up here.

Passwords were not copied: they were stored in a format this platform cannot read. That is why an imported account has to set a new password with "Forgot password" the first time it signs in.

• To give you what you paid for: enrolment, course access, progress, marking and certificates. We need this to perform our contract with you.
• To take payment and keep financial records, which is both contractual and a legal obligation.
• To run the community: posts, messages, follows, and the leaderboard that ranks members by activity. Our legitimate interest in a working community, and you can take part as little as you like.
• To answer support questions, including through the AI concierge.
• To send marketing email, only if you opted in. You can turn it off at any time in your settings without losing course emails.

These companies process data on our behalf so the platform can work:

• Supabase, our database, sign-in and file storage.
• Paystack, payments. They handle your card details under their own privacy policy.
• Brevo, the service that delivers our email.
• Our AI provider, which generates the concierge's replies. What you type into that chat is sent to them, along with a one-way-hashed value derived from your IP address that we use to stop one visitor flooding the service. This applies even if you are not signed in.
• Video hosts: lessons are served from YouTube, Vimeo or Bunny.net depending on the lesson. Playing one contacts that provider directly.
• Our hosting provider, which serves the site and its images.

We do not sell your data, and we do not share it for anyone else's advertising. We may disclose data where the law genuinely requires it, such as a court order, and we will tell you when we are allowed to.

Several of the services above store or process data outside Nigeria. In plain terms: your account, your coursework and your messages sit in our database provider's infrastructure, our email provider is based abroad, and concierge conversations are sent to an AI provider that is also abroad.

We rely on each provider's own contractual data-protection terms for those transfers. If you want to know exactly where a particular provider holds data, ask us and we will tell you what we know.

• Your display name and photo are visible to other signed-in members wherever you take part: posts, comments, the members list and the community leaderboard, which ranks members by how active they have been.
• Direct messages are visible to you and the person you sent them to. We do not read them routinely, and we would only look at one in response to a report or a legal requirement.
• Certificates are publicly verifiable. Anyone holding a certificate number can check it on our verification page without signing in, and doing so shows the holder's name, the course, and the date it was issued. That is the point of a verifiable credential, and it is worth understanding before you earn one.
• Your email address is never shown to other members.

An instructor is public in a way a learner is not, and it is worth being clear about which parts.

• Your name, photo, headline, biography and the courses you teach are shown on your public instructor page and on the pages of every course you teach. That is the point of it: a student is deciding whether to learn from you.
• Anything you upload as course material is hosted by us and shown to the students enrolled in it, under the licence in the terms.
• We look at how your courses perform, including enrolments, completions and reviews, to run the academy and to tell you how you are doing.
• Your earnings and payout details are not public. Your revenue share, your balance, your bank details and your identity documents are visible to you and to the admins who process payouts, and to nobody else.

• Payment and order records: seven years, because tax law requires it.
• Account, profile and learning records: while your account is open, then as below.
• Community posts, forum content and direct messages: kept so that conversations other people took part in stay readable.
• Instructor application documents, including CVs and bank details: kept while the application is open and while you teach here. If you would like them removed after an unsuccessful application, ask and we will delete them.

We would rather be exact than reassuring. Deleting your account takes effect immediately and does the following:

• Your posts, comments and reactions are deleted.
• Your profile is anonymised: the name becomes "Deleted account" and the photo, bio and names are cleared.
• Your sign-in is removed, so the account can no longer be used.

These are kept, and this is why:

• Payment and order records, for the seven-year period above.
• Certificates already issued, so that a certificate someone verified yesterday does not stop existing today.
• Direct messages and forum posts, which would otherwise tear holes in conversations other people are part of. They show as coming from a deleted account.
• Assignment submissions, which form part of a course's marking record.

If you want something in that second list removed as well, email us and say so. We will do what we can and tell you plainly if something has to stay.

You can ask to see the data we hold about you, correct it, delete it, object to a particular use, or ask us to pause a use while a dispute is sorted out. You can also ask for a copy of what you gave us. We do not yet have a one-click export, so a person will put it together for you.

Email support@jocheacademy.com and we will reply within 30 days. Exercising any of these costs nothing.

Every request for your data is checked against who you are signed in as before anything is returned, and the database enforces row-level rules of its own underneath that. Private files such as assignment submissions and application documents are stored in buckets that are not publicly readable, and are served only through short-lived links issued after we have checked who is asking, five minutes for application documents and an hour for coursework.

If there is a breach that puts you at risk, we will tell you and the Nigeria Data Protection Commission as quickly as we can, and we will say what happened rather than what sounds best.

Joche Academy is for people aged 16 and over. We do not verify age at signup, so if you believe a child has an account here, tell us and we will remove it.

Courses, articles and community posts link out to other websites and tools, and instructors set the joining links for their own live classes. Once you follow one of those you are on somebody else's site, under their privacy policy, not ours. We have no control over what they collect and cannot answer for it, so it is worth a glance at theirs before you hand anything over.

If we change how we handle your data in a way that matters, we will update this page and tell you by email or in the app before it takes effect. The date at the top always shows the last change.