Privacy Policy

LOLOIT is an independent campus automation platform for students, course representatives, and faculty. LOLOIT is not affiliated with, endorsed by, or operated on behalf of any university, polytechnic, college, or other educational institution ("Institutions"). Institutions do not operate this service, and LOLOIT does not act as an agent of any Institution.

This Privacy Policy explains how we collect, use, disclose, retain, and protect your personal data, and your rights in respect of it. It is written to comply with the Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Act (NDPA) 2023, and reflects internationally recognised principles including the EU GDPR. By using LOLOIT, you consent to the practices described here.

This Policy applies to all users — students, course representatives, faculty, administrators, canteen operators, and visitors who contact us — and to all personal data processed through our applications, websites, and APIs.

"Personal Data" means any information relating to an identified or identifiable natural person. "Processing" means any operation performed on Personal Data. "Controller" determines the purposes and means of processing; "Processor" processes data on our behalf.

We collect only what is necessary:

Account & Profile Data: email, hashed password, display name, Institution, faculty, department, role, avatar, matriculation/registration number, verification status, and notification/push-token preferences.

Content You Submit: housing/roommate listings, job and hustle posts, lost-and-found items, tutorials/comments, study groups, events, announcements, signed documents, canteen orders, and SOS alerts.

Institution- and Representative-Sourced Data: timetables, course outlines/materials, class streams, carry-over lists, past questions, and broadcasts — supplied and maintained by course representatives and Institution staff; LOLOIT is the Controller of such data as hosted on its systems.

Communications & Support: chat messages, and the name, email, and message content you send via support channels (used solely to respond to you).

Device, Technical & Usage Data: device type, OS, app version, IP address, and technical logs (rate-limiting, security audit).

Financial & Transaction Data: billing/transaction records for paid features (e.g., Campus Prep, premium), processed through our payment partner.

Safety Data: SOS alert content and SOS configuration.

Authentication & Security Data: verification, password-reset, and invite tokens, and login session information.

We do not intentionally collect special categories of data (health, religion, biometric, political) except where you voluntarily include such information in submitted content, in which case you consent to its processing for that feature.

(a) Directly from you when you register, configure your profile, or submit content; (b) from course representatives and Institution staff who populate campus data; (c) automatically through your use of the application and its infrastructure.

To create/authenticate accounts; operate and deliver requested features (messaging, listings, timetables, documents, SOS, payments); facilitate campus coordination; send transactional communications (verification, password reset, support replies); maintain security, integrity, and performance; and comply with legal obligations.

Performance of a contract; legitimate interests (security, fraud prevention, product improvement); consent (push notifications, optional features, voluntary special-category content); and legal obligation.

We do not sell Personal Data. We share only with vetted subprocessors under contract:

Supabase — database, authentication, storage hosting;

Resend — transactional email delivery;

Vercel — application hosting/delivery;

Google — authentication (where you sign in with Google);

Our payment partner — premium/paid transaction processing.

We may also disclose data where required by law, court order, or to protect the rights, safety, or property of LOLOIT, its users, or the public.

Some subprocessors may process data outside Nigeria. Where such transfers occur, we rely on contractual and technical safeguards consistent with the NDPR/NDPA to ensure adequate protection.

Appropriate technical and organisational measures: encryption in transit (TLS), hashed passwords, per-Institution data isolation via database Row-Level Security, role-based access controls, and audit logging. No method of transmission or storage is completely secure; we continually strengthen our controls.

We retain Personal Data only while your account is active and as necessary to provide the service, comply with legal obligations, and resolve disputes. Support submissions are transmitted to our support inbox and are not separately retained in our application database. On account deletion we delete or anonymise Personal Data per our retention schedule, subject to legal-hold requirements.

Subject to applicable law: be informed; access; rectification; erasure; restriction/object to processing; data portability; and withdraw consent at any time. Exercise via support@loloit.com.ng. You may also lodge a complaint with the Nigeria Data Protection Commission (NDPC) / NITDA.

LOLOIT is intended for users enrolled in tertiary institutions. We do not knowingly target or collect Personal Data from persons below the applicable age of consent without appropriate authorisation.

The platform may link to or integrate third-party services; this Policy does not apply to them.

We may update this Policy to reflect legal, technical, or operational changes. Material changes are communicated via the application or email. The "Effective date" reflects the latest revision.

For privacy requests or questions, contact the Data Controller at support@loloit.com.ng.