# Privacy Policy — Academium [View the HTML page](https://academium.com.ng/privacy/) > Exactly what Academium SMS, Academium Surepass and this website collect, why, where it is kept, who else handles it and when it is deleted. Your information ## Privacy Policy Exactly what Academium SMS, Academium Surepass and this website collect, why, where it is kept, who else handles it and when it is deleted. Last updated 6 November 2026 We collect what the product needs to work and nothing for advertising. Our desktop apps contain no advertising, no third-party analytics and no AI services. We do not sell personal information, and we do not use it to build advertising profiles. ## Who we are Academium is a subsidiary of Codeindigitech Limited (RC 8591629), a company registered in Nigeria. Our registered office is at 4 Mudashiru Soetan Street, Olambe, Ogun State, Nigeria. This policy covers this website, the Academium Surepass and Academium SMS apps, the Academium portal they connect to, and our support. When a school uses our software, the school decides what student, parent and staff records to keep and why. For those records the school is the controller and we process them on its behalf. For accounts people open with us directly, such as a Surepass Individual account or a parent account, we are the controller. Send privacy questions and requests to info@academium.com.ng. The appointment of our Data Protection Officer is in progress, and this page will name them once it is complete. ## What Surepass collects ### Your account Name, email address or username, password (stored only as a one-way hash), account type, and the school, class or parent the account is linked to. Students also give a date of birth, which we use to work out whether they are under 18. ### Under-18 accounts The parent’s email address, the parent’s full name and a record of their consent: when they gave it, whether by code or link, the IP address and browser used, and the policy version they saw. ### Learning activity Practice sets, test and exam answers, scores, typing lessons and speeds, goals, XP and rank points, titles earned, and the friends a student adds in Circles. ### Activity Monitor How long a student spends on each page of the app, split into active and idle time. It is on by default so parents can see screen time. A parent can turn it off in settings; for school students the school decides. ### Sign-in and devices A device identifier generated by the app, the computer’s name, model and operating system, its local network address, the app version, and the IP address and browser of each portal sign-in. Web sign-up also records a browser fingerprint, used only to limit each computer to one free trial. ### Crash reports When the app fails, it sends us the error and where it happened. Values such as names, answers and passwords are blanked out before the report leaves the computer. ## What SMS collects Academium SMS is used by school staff. Students and parents do not sign in to it. The school decides what goes in, and what SMS holds depends on the modules the school switches on. ### Students and families Student and guardian details, admissions, classes, attendance, assessments and results, hostel and transport, and documents and photos the school uploads. ### Fees and wallets Invoices, fee payments, discounts, scholarships and write-offs, family wallet balances and top-ups, and the payment references of online payments. ### Staff and payroll Staff records, salary grades, payslips, salary advances, pension and tax details such as a staff member’s TIN, and the bank details used to pay them. ### The school’s books Bank accounts, vouchers, journals, reconciliations, inventory and sales. ### Audit trail Who made each financial change and what changed, from what to what, so a school can account for its money. ### Staff sign-in and devices Each staff member’s sign-ins, the computers they use, the computer’s hardware identity, and the security questions and PIN they set (stored only as one-way hashes). ## What this website collects This website stores your light or dark theme choice in your browser. Traffic analytics (Sabilytics) and the support chat load only if you allow them in the cookie banner, and you can withdraw that at any time from the footer. If you contact us or use the “Try Surepass” demo, we keep what you send us and the demo answers you give. - [Cookie Policy](https://academium.com.ng/cookie-policy) ## Why we use it - To run the product: sign you in, save your work, mark tests, show progress, and sync between your computer, your school server and our portal. (Contract.) - To keep accounts safe: confirm sign-ins by email code, stop the wrong device from opening an exam, and detect misuse. (Legitimate interest.) - To protect children: check age, ask a parent to confirm an under-18 account, and keep friends, leaderboards and public challenges locked until they do. (Legal obligation under NDPA section 31, and the parent’s consent.) - To take payments and issue refunds and credit notes. (Contract and legal obligation.) - To fix faults and answer support requests. (Legitimate interest.) - We do not use personal information for advertising, and we do not sell it. ## Where it is kept ### On your computer Surepass Individual and SMS Individual keep a working copy on the computer so they run offline. ### On your school’s server The school-server editions keep the school’s records on the school’s own hardware. The school controls that machine and its backups. ### On our portal Accounts, subscriptions, and the learning activity that syncs between devices are held on the Academium portal. Our portal runs on our own servers in Nigeria. ### In backups Backups are encrypted copies. School-server backups go to the drives the school chooses. ## Who else handles it We use a small number of service providers. Each receives only what its job needs. - Bachs (checkout.bachs.io) processes plan payments. We never see or store your card details. - Paystack, Flutterwave or Monnify process school-fee payments in SMS, if the school sets one up with its own account. - OneSignal sends SMS push notifications, if the school turns them on. - Cloudflare carries traffic to this website and the portal. - Our own mail server sends sign-in codes, parent requests and receipts. - Sabilytics measures website traffic, only with your permission. - Our support chat runs on our own server, only with your permission. - We disclose information to a public authority only when the law requires it. ## How long we keep it - Account and learning records: while the account exists. A school’s records: as long as the school instructs. - Sign-in history: kept as a security record, but the IP address and browser details are erased after 90 days. - Device network addresses: erased once a device has not been seen for 90 days. - “Try Surepass” demo runs, sign-up attempt records, lab device check-ins and installer diagnostics: deleted after 90 days. - Crash reports: deleted after 30 days. - Your “My data” file: deleted 7 days after it is ready. - Parent consent records: kept while the child’s account exists, as evidence of the consent. - The device identifier of a computer banned for breaking our Terms: kept for as long as the ban lasts, which can be permanent, so the ban can be enforced. - Payment records: kept as long as tax and accounting law requires. - When a plan ends, nothing is deleted. You keep reading, exporting, printing and deleting your records. ## Children Many Surepass users are children. The Nigeria Data Protection Act treats anyone under 18 as a child, so every student gives a date of birth when signing up, and we ask a parent to confirm each under-18 account. Students under 18 sign up with a username, not an email address, and can name a parent. Until a parent confirms, friends (Circles), ranks and leaderboards, global challenges and XP bounties stay locked, even on a paid plan. Sign-in codes and password resets for a linked child go to the parent. There is no chat or private messaging between students in any of our products. - [Children’s Safety](https://academium.com.ng/children) ## Your rights You can ask to see, correct, delete or move your information, object to how we use it, or withdraw consent. Every Academium account holder can download a copy of their data at any time from My data on their account page, without asking us. In SMS only school staff have accounts; students and parents do not sign in to it, so for the records a school keeps about them in SMS, ask the school. For school records, ask the school first; we will help it answer. We reply to every request within 30 days. If you are not satisfied, you can complain to the Nigeria Data Protection Commission. - [How to make a request](https://academium.com.ng/data-protection) - [Email info@academium.com.ng](mailto:info@academium.com.ng?subject=Privacy%20request) ## Keeping it safe Passwords and PINs are stored as one-way hashes. Signing in to a desktop app with an email and password needs a code sent to that email. Release builds are signed and refuse to run if their files are altered. Payment and XP records cannot be edited after they are written. If a breach puts your information at risk, we will tell the Nigeria Data Protection Commission within 72 hours and tell you without undue delay. - [Security](https://academium.com.ng/security) ## Changes to this policy The date at the top shows the current version. If a change affects how we use information you have already given us, we will tell account holders by email before it takes effect. Questions: info@academium.com.ng.