Privacy Policy

Aorthar Academy operates at aorthar.com and provides product development education services. For the purposes of applicable data protection law, Aorthar Academy is the data controller responsible for your personal information.

Contact: hello@aorthar.com

We collect the following categories of personal information:

• Account & Profile Data: Your name, email address, department, year level, profile photo (if uploaded), and any profile details you choose to provide.
• Learning Data: Course progress, lesson completion status, quiz attempts and scores, exam results, GPA, and capstone project submissions. This data is core to operating the University Platform.
• Application Data: Information you submit when applying for our internship programme — including your background, career track preference, motivation statement, and employment status.
• Payment Data: Transaction records, payment method type (card or bank), and billing amounts. Full card details are processed directly by Paystack and are never stored on Aorthar's servers.
• Communications: Messages you send us via email or support channels, including partnership enquiries and feedback.
• Technical Data: Your IP address, browser type, device information, and usage activity on the platform (pages visited, time spent, click behaviour). Collected via server logs and analytics tools.

We use your personal data to:

• Create and manage your account and provide access to our services
• Deliver course content, track your progress, calculate your GPA, and process quiz and exam results
• Review internship and programme applications, select cohort participants, and communicate application decisions
• Process payments and manage your subscription
• Send transactional emails (account verification, receipts, password resets)
• Send programme updates, new course announcements, and learning resources — you can unsubscribe at any time
• Facilitate career placement by sharing your profile (with your consent) with Motivv and partner hiring companies
• Improve our platform, content, and user experience through anonymised analytics
• Comply with legal obligations

Where GDPR applies, we process your data on the following legal bases:

• Performance of a Contract: Processing necessary to provide you with the services you signed up for (account access, course delivery, application processing, payment).
• Legitimate Interests: Platform analytics, security monitoring, and product improvement — provided these interests are not overridden by your rights.
• Consent: Marketing communications and career placement data sharing — you can withdraw consent at any time.
• Legal Obligation: Where we are required by law to process or retain data.

We do not sell your personal data. We share your data only in the following limited circumstances:

• Supabase: Our cloud database and authentication provider, used to store account, profile, and learning data securely.
• Paystack: Our payment processor for handling course purchases and subscription billing. Paystack is PCI-DSS compliant.
• Motivv: Our talent placement partner. Your profile data is only shared with Motivv if you explicitly opt in to the career placement programme.
• Legal Authorities: We may disclose data where required by applicable law, court order, or regulatory authority.

We retain your account and learning data for as long as your account is active and for up to 2 years after account deletion, to allow for reactivation requests, dispute resolution, and legal compliance.

Internship application data is retained for 12 months after the cohort closes. Payment records are kept for 7 years as required by Nigerian tax and financial regulations.

You can request deletion of your account and associated data at any time — see Section 7.

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data ("right to be forgotten"), subject to legal retention requirements.
• Portability: Request your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests, including direct marketing.
• Restriction: Request that we limit how we use your data in certain circumstances.

To exercise any of these rights, email us at hello@aorthar.com. We will respond within 30 days. We may ask you to verify your identity before processing your request.

We use cookies and similar technologies to maintain your session, remember preferences, and understand platform usage. For full details on the cookies we use, please see our Cookie Policy.

We implement appropriate technical and organisational measures to protect your personal data from unauthorised access, loss, or misuse. These include encrypted data transmission (HTTPS), access controls, and secure cloud infrastructure provided by Supabase.

No method of transmission over the internet is 100% secure. If you believe your account has been compromised, contact us immediately at hello@aorthar.com.

Our services are intended for individuals aged 13 and above. Users under 18 require parental or guardian consent. We do not knowingly collect personal data from children under 13. If you believe we have inadvertently done so, contact us immediately and we will delete the data.

Aorthar is based in Nigeria. Our infrastructure (Supabase, Paystack) may process data in jurisdictions outside Nigeria, including the United States and EU. Where transfers occur, we ensure appropriate safeguards are in place in accordance with applicable data protection law.

We may update this Privacy Policy periodically. When we make significant changes, we will notify you via email or a platform notification. The "last updated" date at the top of this page reflects the most recent revision.

For privacy-related questions or to exercise your data rights, contact us at: hello@aorthar.com

If you are in the EU/UK and are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.