Privacy policy

Nasuru.com Limited is the data controller. We process personal data under the Nigeria Data Protection Act 2023 and the NDPR.

Registered in Nigeria, company registration number 9759223, at 19 Obashoro Street, Oke Odo, Alimosho, Lagos State.

Data protection requests go to support@nasuru.com, marked for the attention of our Data Protection Officer.

When you create an account and use the platform, we hold:

• Account details — your name, email address, phone number, and the date you accepted these terms.
• Student profile — date of birth, nationality, country and state of residence, and a WhatsApp number if you give us one.
• Application answers — everything you enter into our intake and school forms, kept against the version of the form you answered.
• Documents you upload — passports, transcripts, certificates and any other file a school on your list requires.
• Payment records — the amount, reference, status and gateway response for each payment. We never see or store your card or bank details; those go directly to Paystack or Flutterwave.
• Technical records — the IP address of your last sign-in, and an audit log of actions taken on your account by our staff.

• To provide the service you paid for — building your checklist, reviewing your documents and tracking your applications. Basis: performance of our contract with you.
• To send you updates about your application — when a document is verified or rejected, and when something is waiting on you. Basis: performance of our contract.
• To take payment and prevent fraud — including checking that referral rewards are earned on genuine, confirmed payments. Basis: our legitimate interest in running the service and not being defrauded.
• Marketing — only if you opted in. You can withdraw at any time and it will not affect the service you receive.

Access inside the company is granted by role, not by seniority. Every staff account carries an explicit set of permissions — reviewing documents, managing students, viewing payments, exporting data and so on — and each is granted separately.

In practice: a document reviewer can open your uploads but cannot reach payment gateway credentials; a finance user can see that you paid but has no reason to open your passport and is not given the permission to do so.

Staff actions on your record are written to an audit log that records who did what and when. Passwords, tokens and gateway secrets are stripped from that log before it is written.

Uploaded documents are held in private object storage at Cloudflare R2. They are never publicly addressable: each time a document is opened, the platform issues a signed link that stops working after fifteen minutes. Files are encrypted at rest with AES-256, and are not stored on the application server's own disk.

Payment gateway credentials are encrypted in the database with a key held outside it, so a database copy alone does not expose them.

These companies handle data on our behalf. They may only use it to provide the service to us, never for their own purposes.

Needs sign-off before launch: Rows marked PENDING are deployment choices that have not been made. Naming the wrong processor in a published policy is worse than an incomplete list, so they stay marked until hosting, object storage and the email/SMS provider are chosen. Note that the default storage region in the backend config is eu-west-1 (Ireland) — any region outside Nigeria is an international transfer the NDPR requires you to disclose here and to have a lawful basis for.

Under the NDPR you can ask us to:

• Give you a copy of everything we hold about you.
• Correct anything that is wrong.
• Delete your account and the documents attached to it.
• Send your data to you in a portable format.
• Stop sending you marketing, at any time.

To make any of these requests, email support@nasuru.com or use the contact page. We will respond within 30 days.

These requests are handled by a person reading that inbox, not yet by a self-service button — so the 30-day commitment above depends on somebody owning it. Self-service export and deletion are planned.

• Documents you upload — 24 months after the application they belong to is closed or withdrawn. Long enough to reapply or appeal without uploading everything again.
• Payment records — 7 years. Required for Nigerian tax and audit purposes.
• Your account — Deleted after 24 months with no sign-in. We email you twice before anything is deleted.
• Staff audit logs — 7 years. So we can always answer who accessed your file, and when.

You do not have to wait for these periods to expire. You can ask us to delete your account and documents at any time, and we will.

We record the version of this policy you accepted and the date you accepted it. If we change it in a way that affects your rights, we will tell you and ask you to accept the new version.