Privacy Policy

General

At Sierra Africa Limited, we are committed to safeguarding your privacy and protecting your personal data. This Privacy Policy explains how Sierra Africa Limited ("Sierra Africa," "we," "us," or "our"), a company registered in Nigeria with its office at 27 Kola Amodu Crescent, Magodo GRA, Lagos State, Nigeria, collects, uses, processes, and shares your personal data when you use our websites, mobile applications, and related services (collectively, the "Service"). By using the Service, you consent to the collection, use, and sharing of your personal data as described in this Privacy Policy, in accordance with the Nigeria Data Protection Regulation (NDPR) and other applicable laws.

Schools and Institutional Tenants

Whollify can be used in two ways, and which one applies to you changes who is responsible for your personal data.

• Your school runs its own Whollify tenant. If you were given a Whollify account by a university, polytechnic, bootcamp or other institution, that institution is the data controller for your academic data and Sierra Africa acts as its data processor. The school decides what is collected, which staff hold which roles, how long records are kept, and what becomes part of your official record. We process that data on the school's instructions in order to provide the Service, and not for our own purposes.
• You joined Whollify School directly. Whollify School is the school Sierra Africa runs on its own platform. Where you signed up yourself rather than through an institution, Sierra Africa is the data controller and this Policy governs directly.

Where a school is the controller, some requests have to go through it rather than through us. If you ask us to correct or delete an academic record held in your school's tenant, we will refer you to the school, because a school is required to keep records we are not entitled to alter on our own initiative. Requests about your account itself (your login, your contact details, your device sessions) you can always make to us directly.

Each school's tenant is logically separated from every other school's. Staff at one institution cannot see students, records or messages belonging to another. We do not combine data across tenants to build profiles, and we do not use one school's data to provide the Service to another.

Institutions considering Whollify should raise data protection terms, retention periods and export formats with us before signing, at hello@whollify.com. Those are agreed per institution and are not set by this Policy.

Information We Collect

We collect several types of information for various purposes to provide and improve our Service to you. The types of data we collect include:

Personal Data

While using our Service, we may ask you to provide us with certain personally identifiable information that can be used to contact or identify you ("Personal Data"). This may include, but is not limited to:

• Email address
• First name and last name
• Phone number
• Address, State, Province, ZIP/Postal code, City
• Cookies and Usage Data
• Profile information (e.g., display name, profile picture)

Academic and Platform Data

Whollify is one platform covering an institution's teaching, evaluation, communication and records. Depending on which parts your school uses and what role you hold, we process:

• Coursework submissions, including repositories, files, documents, links and recordings you submit
• Peer evaluation records: who evaluated whom, when, against which rubric, the scores given and received, evaluator comments, and the rating you give your evaluator in return
• Automated grading inputs and outputs from Whollify Sia, including where its assessment diverged from a peer score and was referred to staff
• Course structure, section completion, deadlines and submission history
• Attendance, which is derived from participation rather than a separately kept register
• Messages, channels, threads, reactions, mentions, attachments and read state within your school
• Forum posts and the reputation ledger that determines earned permissions
• Calendar entries, scheduled sessions, evaluator availability and to-dos
• Admissions and application data where you applied through Whollify
• Academic records: academic periods, results and transcripts, together with the audit trail behind each entry
• Directory records, which may include people who do not hold Whollify logins (guardians, employers, external evaluators, alumni and applicants), where a school has entered them

Live peer evaluations happen in video rooms Whollify operates. What is retained from a session is the rubric scoring, comments and participation record described above. Whether the audio or video of a session is recorded and for how long is configured by your school; ask your institution if you need to know its setting.

Usage Data

We may also collect information on how the Service is accessed and used ("Usage Data"). This Usage Data may include information such as your computer's Internet Protocol address (e.g., IP address), browser type, browser version, the pages of our Service that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers, and other diagnostic data.

Tracking & Cookies Data

The only cookies Whollify sets in your browser are the session cookies required for authentication. Without them you cannot log in. We do not currently set analytics or marketing cookies, and we do not currently run any third-party tracking script in your browser.

Our public pricing page asks our own servers which country you are connecting from, so that it can show you prices in naira or in dollars. The answer is a two-letter country code, we use it to pick a currency, and we do not store it. No third party is involved and your IP address is not shared with one. You can override the result yourself with the currency switch on that page.

Separately from cookies, we record product usage events on our own servers to understand which parts of the platform are used and where they fail. See Service Providers and Sub-Processors below for the processor involved. This is server-side and does not depend on a cookie or a browser identifier.

The consent controls in our cookie banner record your preference for browser-based analytics and marketing cookies, so that the preference is already in place if we introduce them. You can instruct your browser to refuse all cookies, but doing so will prevent you from logging in and using the Service. If we add browser-based analytics or performance tracking, this section will be updated before they are deployed.

Version Control and Repository Integration

When you register a project on Whollify, the platform automatically provisions a private repository on your behalf. Depending on the infrastructure in use at the time, this repository may be hosted on GitHub or on Whollify's own self-hosted version control infrastructure. This repository is used solely to receive your project submissions. By using the Service, you authorize Sierra Africa to:

• Create and manage a private repository on your behalf, within Whollify-controlled infrastructure or a third-party hosting provider.
• Read the contents of that repository to run automated grading and make it accessible to your assigned peer evaluator during the evaluation session.
• Retain a copy of committed code for grading, analytics, and Capability Report generation.

All repository access is managed through Whollify's own tooling. You do not share external Git hosting credentials with Whollify. Your repository is private and visible only to you, your assigned peer evaluator during a live evaluation session, and Whollify's automated grading systems. Where a third-party hosting provider (such as GitHub) is used, that provider's own Privacy Policy additionally governs data stored on their infrastructure.

Automated Grading by Whollify Sia

Whollify grades your project submissions automatically, independently of and in parallel with your peer evaluation. The grading pipeline varies by project type and may involve one or more of the following:

• Code runners: For projects with executable components, Whollify runs your code in an isolated execution environment. The outputs, test results, and runtime behavior are collected and passed to the grading service for scoring.
• Whollify Sia's grading service: For certain project types, or in addition to runner outputs, Whollify passes your submission (or the results of execution) to Whollify Sia, which assesses correctness, logic, structure, and implementation quality. The result is a confidence-scored assessment (e.g., "100.0/100, High confidence").

The specific combination of runners and AI analysis applied to any given project is determined by Sierra Africa and may change over time as the platform evolves. In all cases, grading inputs and outputs (including your code, execution results, scores, confidence levels, and analysis notes) are stored against your submission record.

Grading results populate your Capability Report and may inform platform-wide quality benchmarks. Aggregated and anonymized grading data may be used to improve grading accuracy and fairness. We do not use individual grading data to train publicly available AI models. If you believe a grade is inaccurate, see the Grading Disputes section in our Terms of Service.

Peer Evaluation Sessions

Peer evaluation on Whollify is a live, synchronous session (typically 10 to 35 minutes) in which another Whollify user opens your repository, runs your code, reads your functions, asks you questions, and grades your submission via the platform. These sessions are conducted in real time and are not pre-recorded submissions or asynchronous comment threads.

By participating in peer evaluation sessions, whether as an evaluatee or an evaluator, you acknowledge and consent to the following:

• Session monitoring: Sierra Africa may monitor live evaluation sessions for quality assurance, dispute resolution, and platform integrity purposes. Session activity, including evaluator grades, comments, and timing data, is logged.
• Recording: We may record evaluation sessions for the purposes of resolving grading disputes, investigating misconduct, or improving platform quality. If a session is recorded, both parties will be notified at the start of the session where technically feasible. Recordings are retained for no longer than 90 days unless required for an active dispute.
• Evaluator identity: Your evaluator's display name is visible to you during the session. Full personal details (email, legal name) are not disclosed unless necessary for dispute resolution.

If you do not consent to session monitoring or recording, you may not participate in peer evaluation sessions and should not use Whollify's graded project features. Contact support@whollify.com if you have concerns about a specific session.

Research

Research is the feature of Whollify used to supervise and carry out research projects, and to write academic documents such as theses, dissertations, journal articles, research papers, and literature reviews. It runs on the same account as the rest of the platform, but it processes categories of data the rest of the platform does not. This section describes the additional data Research collects and how it is processed. Where this section and the general terms above differ, this section governs your use of Research.

Information Research Collects

• Project content: the title, document type, research question, and citation style of each project you create, and the text of the documents and drafts you write in the editor.
• Research sources: academic papers you add to a project, whether discovered through our integrated search, added by identifier (e.g. DOI), or uploaded by you as PDF or DOCX files, together with their metadata, extracted full text, and the search queries you run.
• Writing-style samples: if you choose to set up a writing-style profile, the writing samples you upload (as text, PDF, or DOCX). These are optional and are used only to help the assistant match your voice.
• Generated and derived content: AI-generated drafts and suggestions, document version history, citation relationships, extracted claims and concepts, and the vector embeddings we compute from your papers and writing to power semantic search and relevance.
• Usage data: AI calls, token consumption, papers processed, and active project counts, which we track to enforce plan limits and for billing.

How Your Content Is Processed

To provide the service, your project content and sources are processed by AI and document-processing providers. Uploaded PDFs may be sent to a document-parsing provider to extract their text; your text, papers, and writing samples are sent to language-model and embedding providers to generate drafts, suggestions, analysis, and embeddings; and, where you enable web or open-access search, your queries are sent to the relevant search providers. We send only the content necessary to perform the requested operation, and we do not use your documents, sources, or writing samples to train publicly available AI models. The specific providers are listed in the "Service Providers and Sub-Processors" section below.

Storage and Access

Your projects, papers, drafts, and embeddings are associated with your account and are private to you and any collaborators you explicitly invite to a project. Retention, your data subject rights, security, and the international-transfer terms described elsewhere in this Privacy Policy apply equally to data you create in Research.

How We Use Your Information

We use the collected data for various purposes:

• To provide and maintain our Service
• To personalize your learning experience
• To notify you about changes to our Service
• To allow you to participate in interactive features of our Service when you choose to do so
• To provide customer support
• To gather analysis or valuable information so that we can improve our Service
• To monitor the usage of our Service
• To detect, prevent and address technical issues
• To process payments and prevent fraudulent transactions
• To send you transactional emails, such as deadline reminders, account confirmations, and evaluation notifications
• To send you marketing emails, such as product updates, feature announcements, and promotions. You may opt out of marketing emails at any time by clicking the unsubscribe link in any such email or by contacting us at support@whollify.com. Opting out of marketing emails does not affect transactional emails required to operate your account.

How We Process Your Information

Sierra Africa processes your personal data based on legal grounds under the Nigeria Data Protection Regulation (NDPR), including to provide the Service, pursue legitimate interests, comply with legal obligations, or with your consent. We collect all data you provide as it is necessary for the system functionality. We may process and share your data with relevant third parties as necessary to provide the services you use, operate our business, meet our contractual and legal obligations, protect the security of our systems and our customers, or fulfill other legitimate interests.

Data Retention

We will retain your Personal Data for as long as your account remains active. If you delete your account, we will retain your Personal Data for up to two (2) years following deletion to comply with our legal obligations, resolve disputes, and enforce our legal agreements and policies. After this period, your data will be permanently deleted or anonymised.

We will also retain Usage Data for internal analysis purposes. Usage Data is generally retained for a shorter period, except when this data is used to strengthen the security or to improve the functionality of our Service, or we are legally obligated to retain this data for longer time periods.

Data Security

The security of your data is important to us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. Your data is stored in secure cloud environments with appropriate security measures in place. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.

We implement appropriate technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure.

Disclosure of Data

Business Transaction

If we are involved in a merger, acquisition or asset sale, your Personal Data may be transferred. We will provide notice before your Personal Data is transferred and becomes subject to a different Privacy Policy.

Legal Requirements

We may disclose your Personal Data in the good faith belief that such action is necessary to:

• Comply with a legal obligation
• Protect and defend the rights or property of Whollify
• Prevent or investigate possible wrongdoing in connection with the Service
• Protect the personal safety of users of the Service or the public
• Protect against legal liability

Your Data Subject Rights

Under the Nigeria Data Protection Regulation (NDPR) and other applicable laws, you have the following rights:

• Right to Access: You have the right to request copies of your personal data.
• Right to Know: You have the right to know which third parties receive your data.
• Right to Rectification: You have the right to request that we correct any information you believe is inaccurate or complete information you believe is incomplete.
• Right to Erasure: You have the right to request that we erase your personal data, though this will result in the deletion of your account.
• Right to Restrict Processing: You have the right to request that we restrict the processing of your personal data, under certain conditions.
• Right to Object to Processing: You have the right to object to our processing of your personal data, under certain conditions.
• Right to Data Portability: You have the right to request that we transfer the data that we have collected to another organization, or directly to you, under certain conditions.
• Right to Delete Account: You can delete your account and associated data through the platform.

To exercise these rights, please use the tools available within the Whollify platform or email support@whollify.com. We may refuse requests if we cannot verify your identity, if they violate laws or third-party rights, or if they disrupt Service delivery. For NDPR complaints, contact the National Information Technology Development Agency (NITDA) at https://nitda.gov.ng/.

Service Providers and Sub-Processors

Sierra Africa Limited uses third-party companies to operate, host, and improve the Service. Where those companies process your personal data on our behalf, they are sub-processors under applicable data protection law. We enter into data processing agreements with sub-processors and require them to protect your data to at least the same standard as this Privacy Policy. Even where a sub-processor stores your data without actively using it for their own purposes, storage of personal data constitutes processing and is disclosed here.

The following table lists our current sub-processors, what they are used for, and where they are located. Each provider's own privacy policy governs their handling of any data they receive.

Infrastructure and Hosting

Data Storage

AI Services

Sierra Africa uses AI language model providers as part of its grading service, hints, and learning assistance features. When your code or project outputs are analyzed by AI, the relevant content is transmitted to one or more of the providers below. We do not send personally identifying information (such as your name or email) to AI providers beyond what is technically necessary.

Research Processing

The providers below process content within Research (see the "Research" section above). When you draft, analyse, parse a document, or search, the relevant content is transmitted to one or more of them. We do not send personally identifying information beyond what is technically necessary, and your documents and sources are not used to train publicly available models. In addition, academic metadata sources (including arXiv, Semantic Scholar, and Crossref) are queried for publicly available paper records using your search terms or identifiers; these queries do not include your personal data.

Analytics

Payments: Stripe and Paystack

Subscription payments for Whollify Pro and Whollify Max are processed by one or more third-party payment processors, which may include Stripe and/or Paystack depending on your region, account type, or the payment method selected. When you initiate a payment, you interact with that processor's secure checkout interface. Sierra Africa does not receive, store, or process your card number, CVV, or bank account details at any point. That information is transmitted directly to the payment processor over an encrypted connection.

The data Sierra Africa shares with the relevant payment processor to facilitate a transaction includes:

• Your email address, as the unique identifier for your Whollify account.
• The subscription plan name and amount being charged.
• Your IP address and device metadata, as required for fraud prevention.

Each processor retains transaction records, including your email and payment history, in accordance with its own Privacy Policy and applicable financial regulations. Sierra Africa receives and stores a transaction reference ID and payment status (e.g., successful, failed, refunded) to manage your subscription. Both Stripe and Paystack adhere to PCI-DSS standards as managed by the PCI Security Standards Council. For questions about how a specific processor handles your payment data, refer to Stripe's Privacy Policy at stripe.com or Paystack's Privacy Policy at paystack.com.

Internal Communications

We review and update this sub-processor list when we add or change providers. If you have questions about a specific provider or wish to object to processing by a particular sub-processor, contact us at support@whollify.com.

Children's Privacy

Our Service is available to users aged 10 and above. For users under the age of 18, we recommend parental supervision and consent. If you are a parent or guardian and you are aware that your child has provided us with Personal Data without your consent, please contact us. If we become aware that we have collected Personal Data from children without appropriate parental consent where required, we take steps to remove that information from our servers.

Links to Other Websites

Our Service may contain links to other websites that are not operated by us. If you click on a third-party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit. We have no control over and assume no responsibility for the content, privacy policies or practices of any third-party sites or services.

California Privacy Rights

If you are a California resident, you are entitled to learn what data we collect about you, ask to delete your data and not to sell (share) it. To exercise your data protection rights, you can make certain requests and ask us:

• What personal information we have about you. If you make this request, we will return to you:
  • The categories of personal information we have collected about you
  • The categories of sources from which we collect your personal information
  • The business or commercial purpose for collecting your personal information
  • The categories of third parties with whom we share personal information
  • The specific pieces of personal information we have collected about you
• To delete all of the personal information that we have about you. If you make this request, we will delete the personal information we hold about you as of the date of your request from our records and direct any service providers to do the same. In some cases, deletion may be accomplished through de-identification of the information.
• To stop selling your personal information. We don't sell or rent your personal information to any third parties for any purpose. We do not sell your personal information for monetary consideration. However, under some privacy laws, sharing your data might be considered a "sale".

Please note, you are entitled to ask us to provide you with this information up to twice every 12 months.

Data Transfer

Sierra Africa is based in Nigeria, and we primarily store and process your data within Nigeria. While we do not routinely transfer data outside of Nigeria, we may do so if necessary for providing our services. In such cases, we ensure compliance with the Nigeria Data Protection Regulation (NDPR) and international data transfer requirements.

Your consent to this Privacy Policy followed by your submission of such information represents your agreement to that transfer.

Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date at the top of this Privacy Policy.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

Contact Us

Sierra Africa Limited is the data controller under the NDPR. Contact us at:

• Sierra Africa Limited
• 27 Kola Amodu Crescent, Magodo GRA
• Lagos State, Nigeria
• Email: support@whollify.com

For support and privacy concerns, email us at support@whollify.com.

Last revised on July 29, 2026