Privacy Policy

General

At Sierra Africa Limited, we are committed to safeguarding your privacy and protecting your personal data. This Privacy Policy explains how Sierra Africa Limited ("Sierra Africa," "we," "us," or "our"), a company registered in Nigeria with its office at 8 Levante Estate, Adesham Street, Bogije, Lagos State, Nigeria, collects, uses, processes, and shares your personal data when you use our websites, mobile applications, and related services (collectively, the "Service").

We process personal data in accordance with the Nigeria Data Protection Act 2023 (the "NDPA") and the subsidiary Nigeria Data Protection Regulation 2019 ("NDPR"), under the supervision of the Nigeria Data Protection Commission ("NDPC"). Where you are in the European Economic Area or the United Kingdom, we also process your data in accordance with the EU General Data Protection Regulation and the UK GDPR; see the section If You Are in the EEA or the UK below.

Schools and Institutional Tenants

Whollify can be used in two ways, and which one applies to you changes who is responsible for your personal data.

• Your school runs its own Whollify tenant. If you were given a Whollify account by a university, polytechnic, secondary school, bootcamp or other institution, that institution is the data controller for your academic data and Sierra Africa acts as its data processor. The school decides what is collected, which staff hold which roles, how long records are kept, and what becomes part of your official record. We process that data on the school's documented instructions in order to provide the Service, and not for our own purposes.
• You joined Whollify School directly. Whollify School is the school Sierra Africa runs on its own platform. Where you signed up yourself rather than through an institution, Sierra Africa is the data controller and this Policy governs directly.

Where a school is the controller, some requests have to go through it rather than through us. If you ask us to correct or delete an academic record held in your school's tenant, we will refer you to the school, because a school is required to keep records we are not entitled to alter on our own initiative. Requests about your account itself (your login, your contact details, your device sessions) you can always make to us directly. Where we receive a request that belongs to a school, we will tell you so within 1 business day and pass it on, rather than leaving it unanswered.

Each school's tenant is logically separated from every other school's. Staff at one institution cannot see students, records or messages belonging to another. We do not combine data across tenants to build profiles, and we do not use one school's data to provide the Service to another.

Institutions are responsible for establishing a lawful basis for the data they enter or import, for informing their students and staff about how the institution uses the platform, and, where their students include children, for obtaining any consent the law requires before those students are enrolled. See Children and Young People below.

Institutions considering Whollify should raise data protection terms, retention periods and export formats with us before signing, at hello@whollify.com. Those are agreed per institution and are not set by this Policy. A data processing agreement is available on request.

Information We Collect

We collect several types of information for various purposes to provide and improve our Service to you. The types of data we collect include:

Personal Data

While using our Service, we may ask you to provide us with certain personally identifiable information that can be used to contact or identify you ("Personal Data"). This may include, but is not limited to:

• Email address
• First name and last name
• Phone number
• Address, State, Province, ZIP/Postal code, City
• Cookies and Usage Data
• Profile information (e.g., display name, profile picture)

Academic and Platform Data

Whollify is one platform made up of apps: Messages, Courses, Assignments, Evaluations, Reputation, AI, Forum, Calendar, Classes, Records, Directory and Research. Depending on which of them are available to you, and what role you hold, we process:

• Coursework submissions: documents, files, links, images, recordings, datasets and code repositories you submit
• Assessment records for activities that are assessed, which may include instructor marks, peer evaluation records (who evaluated whom, when, against which rubric, the scores given and received, evaluator comments, and the rating you give your evaluator in return) and automated grading results
• Automated grading inputs and outputs, including where an automated assessment diverged from a peer score and was referred to a person
• Course structure, section completion, deadlines and submission history
• Participation records, which are derived from the work itself rather than a separately kept register
• Messages, channels, threads, reactions, mentions, attachments and read state within your school
• Forum posts and the reputation ledger that determines earned permissions
• Calendar entries, scheduled sessions, evaluator availability and to-dos
• Enrolment and application data, where an institution admitted or enrolled you through Whollify
• Academic records: academic periods, results and transcripts, together with the audit trail behind each entry
• Directory records, which may include people who do not hold Whollify logins (guardians, employers, external evaluators, alumni and applicants), where a school has entered them

Usage Data

We may also collect information on how the Service is accessed and used ("Usage Data"). This Usage Data may include information such as your computer's Internet Protocol address (e.g., IP address), browser type, browser version, the pages of our Service that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers, and other diagnostic data.

Coursework Submissions

Whollify is subject-agnostic, and what counts as a submission depends on the activity. You may hand in a written document, a file, an external link, an image, an audio or video recording, a dataset, or a code repository. We store what you submit, together with when you submitted it and any revisions, so that it can be assessed and so that it forms part of your record.

Your submission is private to you, to anyone you explicitly share it with, to the staff of your institution in accordance with its policies, and, where the activity is assessed that way, to the person evaluating it or to our automated grading systems. It is not public and it is not shared with other learners unless you share it.

Where a submission is a code repository, it may be hosted on Whollify's own infrastructure or on a third-party service such as GitHub. You do not share external Git hosting credentials with us. Where a third-party provider hosts it, that provider's own privacy policy additionally governs the data on their infrastructure, and deleting your Whollify account does not delete a repository held there.

Automated Grading

Some activities are graded automatically. Whether yours is depends on what the activity uses: a course creator, an institution, or you decide whether work is assessed by an instructor, by peers, automatically, or not at all. Where automated grading applies, the pipeline may involve one or both of the following:

• Runners. For work with executable components, we run it in an isolated execution environment. The outputs, test results and runtime behaviour are collected and passed to the grading service for scoring.
• Model-based assessment. We pass your submission, or the results of executing it, to a language model that reads it against the rubric the activity was set with. The result is a score with a confidence level and written notes.

The combination applied to any given activity is set by whoever owns that activity and may change over time. In all cases, grading inputs and outputs (your submission, execution results, scores, confidence levels and analysis notes) are stored against your submission record. Where an activity is graded both automatically and by a peer, a disagreement between the two is flagged for a person to look at.

Grading results form part of your record on the platform and may inform platform-wide quality benchmarks. Aggregated and anonymised grading data may be used to improve grading accuracy and fairness. We do not use individual grading data to train publicly available AI models.

Automated Decisions and Human Review

Some decisions on Whollify are made by software without a person reviewing them first. The clearest example is automated grading: a model scores your submission and that score is recorded against your work. Any threshold that automatically gates progression, and any automated scoring an institution runs as part of its own enrolment, works the same way. We consider these to be decisions with a significant effect on you, and we treat them accordingly.

You have the right to ask that a human being review any automated decision that affects you. In practice that means:

• You can contest the outcome. Raise a dispute within 7 days of the grade appearing in your account, using the process in the Terms of Service under "Grading Disputes." A member of staff, not a model, reviews it.
• You can ask how the decision was reached. We will tell you what inputs the assessment ran against (which repository, which commit, which rubric), what the model returned, and what confidence it reported.
• You can ask for it to be re-run. Where a technical fault is the cause (the wrong commit, a failed runner, a truncated submission), we re-grade rather than ask you to appeal a result we already know is wrong.

Where your school is the controller, your school decides what an automated score means for your official record, and a human review by us goes to the school's staff rather than overriding their academic judgement. We do not use automated decision-making to profile you for advertising, and we do not make solely automated decisions about you on the basis of special categories of personal data.

Peer Evaluation Sessions

Peer evaluation is one assessment mode among several, and it is optional. An institution switches it on or off like any other app, and an individual is never required to use it. This section applies only where an activity you take part in is assessed this way. If it is not, nothing here describes data we hold about you.

Where it is used, a peer evaluation is a live session in which another Whollify user opens your submission, examines your work, asks you questions, and scores it against the rubric the activity was set with. Sessions take place in video rooms Whollify operates. You may evaluate work of a kind you have passed yourself.

What is retained from a session is:

• The rubric scoring and the evaluator's written comments.
• The participation record: who evaluated whom, when the session started and ended, and whether both parties attended.
• The rating you give your evaluator in return, which feeds evaluator quality checks.

We do not currently record the audio or video of evaluation sessions. The live stream is not captured, stored or reviewed by us. If we introduce recording, we will update this Policy and notify affected users before the feature is switched on, and sessions will carry an in-session notice while recording is active.

We may review the retained records above (scores, comments, timing and attendance) to resolve a grading dispute, investigate suspected misconduct, or check that evaluators are applying rubrics consistently. Your evaluator's display name is visible to you during the session; their email and legal name are not disclosed to you.

Where your school is the controller, it may configure additional monitoring within its own tenant and is responsible for telling its students what it has enabled. If you have concerns about a specific session, contact support@whollify.com.

Research

Research is the feature of Whollify used to supervise and carry out research projects, and to write academic documents such as theses, dissertations, journal articles, research papers, and literature reviews. It runs on the same account as the rest of the platform, but it processes categories of data the rest of the platform does not. This section describes the additional data Research collects and how it is processed. Where this section and the general terms above differ, this section governs your use of Research.

Information Research Collects

• Project content: the title, document type, research question, and citation style of each project you create, and the text of the documents and drafts you write in the editor.
• Research sources: academic papers you add to a project, whether discovered through our integrated search, added by identifier (e.g. DOI), or uploaded by you as PDF or DOCX files, together with their metadata, extracted full text, and the search queries you run.
• Writing-style samples: if you choose to set up a writing-style profile, the writing samples you upload (as text, PDF, or DOCX). These are optional and are used only to help the assistant match your voice.
• Generated and derived content: AI-generated drafts and suggestions, document version history, citation relationships, extracted claims and concepts, and the vector embeddings we compute from your papers and writing to power semantic search and relevance.
• Usage data: AI calls, token consumption, papers processed, and active project counts, which we track to enforce plan limits and for billing.

How Your Content Is Processed

To provide the service, your project content and sources are processed by AI and document-processing providers. Uploaded PDFs may be sent to a document-parsing provider to extract their text; your text, papers, and writing samples are sent to language-model and embedding providers to generate drafts, suggestions, analysis, and embeddings; and, where you enable web or open-access search, your queries are sent to the relevant search providers. We send only the content necessary to perform the requested operation, and we do not use your documents, sources, or writing samples to train publicly available AI models. The specific providers are listed on our sub-processors page.

Storage and Access

Your projects, papers, drafts, and embeddings are associated with your account and are private to you and any collaborators you explicitly invite to a project. Retention, your data subject rights, security, and the international-transfer terms described elsewhere in this Privacy Policy apply equally to data you create in Research.

How We Use Your Information

We use the collected data for various purposes:

• To provide and maintain our Service
• To personalize your learning experience
• To notify you about changes to our Service
• To allow you to participate in interactive features of our Service when you choose to do so
• To provide customer support
• To gather analysis or valuable information so that we can improve our Service
• To monitor the usage of our Service
• To detect, prevent and address technical issues
• To process payments and prevent fraudulent transactions
• To send you transactional emails, such as deadline reminders, account confirmations, and evaluation notifications
• To send you marketing emails, such as product updates, feature announcements, and promotions. You may opt out of marketing emails at any time by clicking the unsubscribe link in any such email or by contacting us at support@whollify.com. Opting out of marketing emails does not affect transactional emails required to operate your account. We do not send marketing email to users we know to be under 18.

Our Legal Bases for Processing

Under the NDPA, and for users in the EEA and the UK under the GDPR and UK GDPR, we must have a lawful basis for each purpose we process your data for. Ours are:

• Performance of a contract. Running your account, delivering courses, accepting submissions, grading them, scheduling and hosting evaluations, keeping your records, and taking payment. Without this processing there is no Service to provide.
• Legitimate interests. Securing the platform, preventing fraud and abuse, investigating misconduct, understanding which features are used and where they fail, and improving grading accuracy. We balance these against your rights, and you may object. See Your Data Subject Rights.
• Consent. Optional analytics and marketing cookies on our public website, marketing email, and optional features such as the writing-style profile in Research. You may withdraw consent at any time, and withdrawing it is as easy as giving it.
• Legal obligation. Tax and accounting records, responding to lawful requests from authorities, and retaining what we are required to retain.
• Instructions of a controller. Where your school is the controller, we process your academic data on its documented instructions rather than on a basis of our own. The school is responsible for establishing that basis.

Cookies and Similar Technologies

We use cookies and similar technologies in two different places, and they behave differently. On the Whollify platform (where you sign in and do your coursework) the only cookies set are the session cookies required for authentication; without them you cannot log in. On our public website (whollify.com) we additionally load product analytics, but only if you accept analytics cookies in the banner.

Changing your mind. You can reopen the cookie banner and change or withdraw your choices at any time using the Cookie preferences link in the footer of every page. Withdrawing analytics consent stops further collection immediately; it does not delete events already recorded, which you can ask us to erase under Your Data Subject Rights.

Our public pricing page asks our own servers which country you are connecting from, so that it can show you prices in naira or in dollars. The answer is a two-letter country code, we use it to pick a currency, and we do not store it. No third party is involved and your IP address is not shared with one. You can override the result yourself with the currency switch on that page.

We do not respond to browser "Do Not Track" signals, because there is no common standard for how a service should interpret one. The cookie banner is the control that works.

Data Retention

We retain your Personal Data for as long as your account remains active. If you delete your account, we retain your Personal Data for up to two (2) years following deletion to comply with our legal obligations, resolve disputes, and enforce our legal agreements and policies. After this period, your data is permanently deleted or anonymised.

Specific periods worth knowing:

• Academic records in a school tenant: retained for as long as the institution requires, which is set by the institution and its regulator, not by us. This can be considerably longer than two years and can outlast your account.
• Payment and tax records: retained for the period Nigerian tax law requires, regardless of account deletion.
• Usage and analytics data: retained in identifiable form for no more than 24 months, then aggregated.
• Backups: deleted data may persist in encrypted backups for up to 90 days before those backups rotate out.

We may retain information that is otherwise deleted in de-identified and aggregated form, which is no longer personal data and is not re-identified.

Data Security

We implement appropriate technical and organizational measures designed to protect your personal data: encryption in transit and at rest, role-based access control, tenant isolation between institutions, audited administrative access, and least-privilege access for our own staff. Our security page describes these in more detail.

No method of transmission over the Internet, and no method of electronic storage, is 100% secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security. You are responsible for keeping your password confidential and for signing out of shared devices.

Personal Data Breaches

If a personal data breach occurs, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, and the relevant supervisory authority where the GDPR or UK GDPR applies. Where the breach is likely to result in a high risk to your rights and freedoms, we will notify you directly and without undue delay, describing what happened, what data was involved, what we are doing about it, and what you can do to protect yourself.

Where we act as a processor for a school, we notify that school without undue delay after becoming aware of a breach affecting its tenant, and support it in meeting its own notification obligations. The school, as controller, decides what its students are told.

Disclosure of Data

Business Transaction

If we are involved in a merger, acquisition or asset sale, your Personal Data may be transferred. We will provide notice before your Personal Data is transferred and becomes subject to a different Privacy Policy.

Legal Requirements

We may disclose your Personal Data in the good faith belief that such action is necessary to:

• Comply with a legal obligation
• Protect and defend the rights or property of Sierra Africa
• Prevent or investigate possible wrongdoing in connection with the Service
• Protect the personal safety of users of the Service or the public
• Protect against legal liability

We do not sell your personal data, and we do not share it with third parties for their own direct marketing purposes.

Your Data Subject Rights

Under the NDPA, and if you are in the EEA or the UK under the GDPR and UK GDPR, you have the following rights:

• Right of access: to request a copy of the personal data we hold about you.
• Right to be informed: to know which third parties receive your data and why.
• Right to rectification: to have inaccurate data corrected and incomplete data completed.
• Right to erasure: to have your personal data deleted, subject to records we are required to keep.
• Right to restrict processing: to have processing paused while a dispute about accuracy or legitimacy is resolved.
• Right to object: to object to processing based on our legitimate interests, and to object to direct marketing at any time and without qualification.
• Right to data portability: to receive your data in a structured, commonly used, machine-readable format, or have it sent to another organisation where technically feasible.
• Right to withdraw consent: where we rely on consent, to withdraw it at any time without affecting processing already carried out.
• Right to human review: to contest a decision made solely by automated means. See Automated Decisions and Human Review.
• Right to delete your account: available in the platform, without needing to contact us.

To exercise these rights, use the tools in the Whollify platform or email support@whollify.com. We aim to respond within 1 business day, and in any event within the 30 days the law allows. We will tell you if we need a reasonable extension. We may ask you to verify your identity first, and we may refuse requests that are manifestly unfounded or excessive, that would breach the rights of others, or that concern records a school or the law requires us to keep. Where we refuse, we tell you why.

If you are unhappy with how we have handled your data, we would like the chance to put it right first. You also have the right to complain to a supervisory authority: in Nigeria, the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng; in the EEA, your national data protection authority; in the UK, the Information Commissioner's Office at ico.org.uk.

Service Providers and Sub-Processors

Sierra Africa uses third-party companies to operate, host, and improve the Service. Where those companies process your personal data on our behalf, they are sub-processors under applicable data protection law. We enter into data processing agreements with each of them and require them to protect your data to at least the standard set out in this Policy. Even where a sub-processor only stores data without using it for its own purposes, storage is processing and is disclosed.

The current list of who they are, what they do, and where they are located is maintained at whollify.com/sub-processors. We keep it there rather than here because it changes more often than this document does.

Notice of change. Before we add a new sub-processor that will process personal data, we update that page. Institutional customers may subscribe to change notifications by emailing support@whollify.com and will receive at least 30 days' notice, during which they may object on reasonable data protection grounds.

Children and Young People

Whollify is available to users aged 13 and above. We do not knowingly create accounts for, or collect personal data from, children under 13. If you believe a child under 13 has given us personal data, contact support@whollify.com and we will delete it.

Users aged 13 to 17. A parent or legal guardian must consent to the account before it is used, and a young person under 18 cannot agree to our Terms of Service on their own behalf. How that consent is obtained depends on how you joined:

• Through a school. Your institution is the controller and is responsible for obtaining and recording guardian consent, or for identifying another lawful basis available to it as an education provider, before enrolling a pupil. We rely on the school's confirmation that it has done so. Schools warrant this in their agreement with us.
• Directly, through Whollify School. We ask for a parent or guardian's details during sign-up and seek their confirmation before the account is activated.

For users we know to be under 18 we do not send marketing email, do not use their data for marketing profiling, and do not make their profile discoverable outside their institution. A parent or guardian may exercise any of the rights in Your Data Subject Rights on the young person's behalf by writing to support@whollify.com.

Where the GDPR applies, the age of digital consent varies between 13 and 16 by member state; where your national law sets a higher age than 13, we apply that higher age.

Links to Other Websites

Our Service may contain links to other websites that are not operated by us. If you click on a third-party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit. We have no control over and assume no responsibility for the content, privacy policies or practices of any third-party sites or services.

International Data Transfers

Sierra Africa is established in Nigeria, but the Service does not run solely in Nigeria. Your personal data is transferred to, stored in, and processed in other countries, principally the United States and the European Union. That is where our hosting, infrastructure and AI providers operate. The sub-processors page states the location of each one.

We rely on the following to make those transfers lawful:

• Contractual safeguards. Every sub-processor is under a written data processing agreement that imposes obligations equivalent to those in the NDPA, and, where personal data of EEA or UK residents is involved, the European Commission's Standard Contractual Clauses (with the UK International Data Transfer Addendum where applicable).
• Necessity for the contract. Under NDPA s.43, certain transfers are permitted where they are necessary to perform the contract we have with you, as is the case for hosting the platform you are using.
• Adequacy, where it exists. Transfers within the EEA rely on the destination being covered by the same regime.

You should be aware that in some destination countries, courts, law enforcement and regulatory authorities may be entitled to access personal data, and that the legal protections may differ from those in your own country. You may request a copy of the safeguards we rely on for a particular transfer by writing to support@whollify.com.

If You Are in the EEA or the UK

Where you are in the European Economic Area or the United Kingdom, the GDPR and UK GDPR apply to our processing of your personal data in addition to the NDPA. The legal bases we rely on are set out under Our Legal Bases for Processing, and your rights (access, rectification, erasure, restriction, objection, portability, withdrawal of consent, and human review of automated decisions) are set out under Your Data Subject Rights. Those rights are exercisable against us directly, by writing to support@whollify.com.

Transfers of your data outside the EEA or the UK are made under the Standard Contractual Clauses and, for the UK, the International Data Transfer Addendum, as described under International Data Transfers. You may ask us for a copy of the clauses in place for any specific provider.

You have the right to lodge a complaint with the supervisory authority in the country where you live or work, or where you believe an infringement occurred. In the UK that is the Information Commissioner's Office. We ask that you contact us first, so that we have a chance to resolve it.

California Privacy Rights

If you are a California resident, you may request to know what personal information we collect about you, the sources it comes from, the purposes we collect it for, and the categories of third parties we share it with; and you may request that we delete it. You may exercise these rights up to twice in any 12-month period, free of charge, and we will not discriminate against you for exercising them.

We do not sell or share your personal information as those terms are defined under the California Consumer Privacy Act, and we have not done so in the preceding 12 months. We do not disclose personal information to third parties for their own direct marketing purposes within the meaning of California Civil Code s.1798.83. To make a request, email support@whollify.com.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of changes by posting the new Policy on this page and updating the "Last updated" date at the top. Where a change materially affects how we use your data, we will give you notice by email to the address on your account, or through the platform, before it takes effect.

Changes are effective when posted, except where we have said a later date applies. You are advised to review this Policy periodically.

Contact Us

Sierra Africa Limited is the data controller for the purposes described in this Policy, except where a school is the controller as described under Schools and Institutional Tenants. Contact us at:

• Sierra Africa Limited
• 8 Levante Estate, Adesham Street
• Bogije, Lagos State, Nigeria
• Data protection enquiries: support@whollify.com
• General support: support@whollify.com
• Institutional and procurement enquiries: hello@whollify.com

Our Data Protection Officer can be reached at the data protection address above. If you are writing about a specific data subject request, please say which right you are exercising so we can route it correctly.