Privacy Policy — Kaykav Academy
In force. Approved by counsel 2026-08-11; published and effective 2026-08-12.
Effective: 2026-08-12 Last updated: 2026-08-12
1. Who We Are
Kaykav Academy ("we", "us", "our") operates the online learning platform at learn.kaykav.academy.
Data Controller: KayKav Creative Studio LTD, a private company limited by
shares, incorporated in Nigeria on 24 February 2024
RC number: 7366203
Registered address: CBN Quarters, Congo Street, Barnawa, Kaduna State,
Nigeria, 800005
Contact: support@kaykav.academy
2. What We Collect
You give us directly
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Name | Account identity, certificates | Contract |
| Email address | Login, checkout, receipts, course access, notifications | Contract |
| Password (hashed) | Authentication | Contract |
| Phone number | Bank-transfer orders only — so we can reach you if we cannot match your transfer | Contract |
| Profile picture (optional) | Account personalisation — only if your sign-in provider supplies one | Consent |
You may make a card payment without creating an account first. In that case, we collect your email address at checkout so we can process the payment, send your receipt and claim link, and hold the paid course access for the correct person.
From social login
If you sign in with Google, we receive your name, email address, and profile picture from Google. We do not receive your password, contacts, or any other account content, and we do not post anything to your account.
Facebook login is not currently offered. The integration exists in our codebase but is switched off; no data has been or is being received from Facebook. If we enable it, this policy will be updated first.
Automatically
| Data | Why | Legal basis |
|---|---|---|
| Approximate country (from your IP, via our hosting provider) | Showing the right currency and payment method | Legitimate interest |
| Timezone | Displaying dates correctly | Legitimate interest |
| Video playback position | Resume-where-you-left-off | Contract |
| Seconds of video watched, per lesson | Progress tracking and the 90% completion rule | Contract |
| Lesson completion records | Progress, certificates | Contract |
| Quiz attempts, answers, and scores | Grading, quiz completion, certificates | Contract |
| Device/browser type, error and access logs | Compatibility, debugging, security | Legitimate interest |
On IP addresses: our hosting provider (Vercel) processes your IP address to serve the site and passes us only a two-letter country code. We store that country code on your account as a hint for pricing. We do not store your IP address in our own database, though it may appear transiently in server logs held by our hosting provider.
We do NOT collect
Special category data (health, biometrics, religion, political views, sexual orientation). Please do not send it to us.
3. Payment Data
We never see or store your full card number, expiry date, or security code. How your payment data is handled depends on how you pay.
If you pay by bank transfer
You transfer money to our bank account yourself, from your own bank. We receive no card or account credentials from you at all. What we hold is the order you created — your name, email, phone number, the course, and the exact amount we asked you to send — plus our own bank statement showing the transfer arrived, which we check by hand to confirm your payment.
If you pay by card
You may pay by card without an account. We collect the email address you enter at checkout and send it to Paystack with the amount, currency, payment reference, and course identifier needed to process and reconcile the payment. Card payments are processed by Paystack Payments Limited (paystack.com/privacy). Your card details are entered on Paystack's own checkout page, not on ours. They never pass through our systems.
For the payment and its confirmation we store:
- the payment reference
- the payment email and course
- the amount and currency
- the payment status
- the last four digits of the card and the card brand (e.g. "4081", "visa")
The last four digits and brand are supplied to us by Paystack so we can identify a payment in support and dispute handling. They cannot be used to make a payment.
If you paid without an account, we keep the course access pending and bound to the email address Paystack confirms for the successful payment. That payment email can be claimed only by an account whose sign-in provider has verified the same address. For a password account, that means completing our emailed verification step first. An unverified account, or an account with a different email address, cannot claim the purchase.
4. How We Use Your Data
- Provide the courses you purchased
- Match a guest card purchase to a provider-verified account with the same email address
- Verify bank transfers and match payments to orders
- Authenticate you and secure your account
- Track progress, grade quizzes, and issue certificates
- Send transactional email — receipts, course access and invite emails, certificate emails, access-on-hold notices, and password resets
- Prevent fraud and abuse
- Comply with tax and legal obligations
We do not currently send marketing email. If we start, we will ask for your consent first and you will be able to opt out at any time.
We do not sell your personal data. We do not use it for advertising. We do not train AI models on it.
5. Who We Share With
Only these processors, only for these purposes. This list reflects what is actually connected to the platform today.
| Processor | What they do for us | What they receive | Location |
|---|---|---|---|
| Supabase | Database and authentication | All account, progress, quiz, payment-record and certificate data | EU — Frankfurt |
| Vercel | Application hosting | Requests to the site, including your IP address; server logs | Global edge network |
| Cloudflare Stream | Video hosting and delivery | Video playback requests | Global edge network |
| Cloudflare R2 | Storage and delivery of course files and images | File download requests | Global |
| Paystack Payments Limited | Card payment processing | Your card details (entered on their page), name, checkout email, amount, currency, payment reference, and course identifier | Nigeria |
| Resend | Transactional email delivery | Your email address, name, and the contents of the email | US / EU |
| "Continue with Google" sign-in | Only what is needed to authenticate you, if you choose this method | Global |
Our bank necessarily sees bank transfers you send us, under its own terms.
We also disclose data where legally compelled, or to protect our rights or users' safety.
6. Where Your Data Lives
Primary storage is in the European Union (Frankfurt) — your account, progress, and payment records live there. Some processors operate globally, and video and files are delivered from edge locations worldwide so they load quickly wherever you are.
We are a Nigerian company storing EU-hosted data and serving learners internationally. Transfers of personal data outside the EEA rely on Standard Contractual Clauses or an adequacy decision. Nigerian users' data is processed in line with the NDPR.
7. How Long We Keep It
| Data | Retention |
|---|---|
| Account, progress, and quiz records | While your account is active |
| After a deletion request | Purged within 30 days |
| Payment records | 7 years (tax/accounting law — we cannot delete these on request) |
| Unclaimed paid course access | Until it is claimed or the entitlement ends; after claim, the associated payment and access record is kept for 7 years |
| Bank-transfer order records | 7 years, as part of the payment record |
| Server and error logs | Held by our hosting provider under its own retention schedule |
| Certificates issued | Retained for as long as the certificate is verifiable |
| Admin action records | Retained as an audit trail |
8. Your Rights
Under GDPR (EU/EEA), NDPR (Nigeria), and CCPA (California), you can:
- Access — get a copy of your data
- Rectify — correct anything wrong
- Erase — delete your account and data ("right to be forgotten")
- Restrict — limit how we process it
- Port — receive your data in a machine-readable format
- Object — to processing based on legitimate interest
- Withdraw consent — anytime, without affecting prior lawful processing
- Not be discriminated against (CCPA) for exercising these rights
How: email support@kaykav.academy. We respond within 30 days.
Complaints: EU users may complain to their national supervisory authority. Nigerian users may contact the Nigeria Data Protection Commission (NDPC).
9. Deleting Your Account
By email: support@kaykav.academy. We will confirm and action it.
What happens: your account, progress, and personal data are purged within 30 days. Purchase records are retained for 7 years as legally required, stripped of unnecessary personal detail. Deletion forfeits access to purchased courses — this is not reversible and is not a refund.
10. Certificates Are Publicly Verifiable
When you complete a course, your certificate is issued with a serial number.
Anyone who has that serial number can look it up at
learn.kaykav.academy/verify/<serial> and see your name, the course title,
the issue date, and whether the certificate is still valid.
This is deliberate — it is what lets an employer confirm a certificate is genuine. Note that:
- Only the name is shown. No email address, and no other personal data
- The lookup requires the serial number. There is no directory, no search, and no way to browse certificate holders
- These pages are marked so search engines do not index them, which keeps learners' names out of search results
11. Cookies
| Type | Purpose | Consent needed? |
|---|---|---|
| Essential | Login sessions and security | No — strictly necessary |
These are the only cookies we set. Your currency choice is carried in the page address, not stored on your device.
We do not use analytics cookies, advertising cookies, or cross-site tracking of any kind. No analytics service is connected to this platform.
12. Security
Encryption in transit (TLS) and at rest. Passwords are hashed by our authentication provider and are never stored or visible in plain text. Database-level access control (row-level security) governs who can read what. Course video and files are served through short-lived signed URLs rather than public links. Access to production data is restricted to authorised personnel.
No system is perfectly secure. In a breach affecting your rights, we notify affected users and the relevant authority within 72 hours as required.
13. Children
Kaykav Academy is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has given us data, contact support@kaykav.academy and we will delete it.
14. Changes
Material changes will be notified by email and posted here at least 14 days before taking effect.
15. Contact
support@kaykav.academy
KayKav Creative Studio LTD (RC 7366203)
CBN Quarters, Congo Street, Barnawa, Kaduna State, Nigeria, 800005