About This List
Sierra Africa Limited uses third-party companies to operate, host and improve Whollify. Where those companies process personal data on our behalf, they are sub-processors under the Nigeria Data Protection Act 2023 and, where applicable, the GDPR and UK GDPR. This page lists every one of them, what they do, and where they are located.
We enter into a written data processing agreement with each sub-processor and require it to protect your data to at least the standard set out in our Privacy Policy. Where a provider is outside Nigeria, the transfer is made under the safeguards described under International Data Transfers in that Policy, in most cases the European Commission's Standard Contractual Clauses. Even where a sub-processor only stores data without using it for its own purposes, storage is processing and is disclosed here.
Each provider's own privacy policy governs their handling of the data they receive; the names below link to them.
Infrastructure and Hosting
Cloud infrastructure and hosting services for the Whollify platform.
Frontend application hosting, deployment pipeline, and managed database hosting. Stores user account data, coursework and submissions, grading results, evaluation history, and academic records.
Cloud infrastructure services.
Content delivery network (CDN), DDoS protection, and web security. Processes request metadata including IP addresses.
Data Storage
Vector database used for semantic search and AI-related data retrieval within the platform.
AI Services
We use AI language model providers as part of the grading service, hints, and learning assistance features. When your coursework or project outputs are analysed by AI, the relevant content is transmitted to one or more of the providers below. We do not send personally identifying information (such as your name or email) to AI providers beyond what is technically necessary, and we do not permit them to train publicly available models on your content.
AI language model services used within Whollify's grading and assistance features.
AI language model services used within Whollify's grading and assistance features.
AI language model services used within Whollify's grading and assistance features.
Research Processing
The providers below process content within Research. When you draft, analyse, parse a document, or search, the relevant content is transmitted to one or more of them. In addition, academic metadata sources (including arXiv, Semantic Scholar, and Crossref) are queried for publicly available paper records using your search terms or identifiers; these queries do not include your personal data.
Routes Research's writing, chat, and analysis tasks to language models. Receives your project text, prompts, and selected source content.
Generates the vector embeddings used for semantic search and relevance over your papers and writing. Receives text excerpts from your sources and documents.
Extracts full text from PDF research papers you add or upload, so they can be searched and cited.
Optional general web search used during research discovery. Receives your search queries.
Locates legally available open-access PDFs for papers by DOI. Receives paper identifiers, not personal data.
Analytics
Product analytics. Inside the platform, usage events are recorded server-side by Whollify and sent to PostHog; no script runs in your browser there and no analytics cookie is set. On the public website a PostHog script does run in your browser and does set a cookie, but only if you accept analytics cookies; decline, or ignore the banner, and it is never downloaded. Session recording is switched off. Data is processed in the European Union.
Payments
Subscription payments are processed by Stripe and/or Paystack depending on your region, account type and payment method. Sierra Africa does not receive, store or process your card number, CVV or bank account details at any point; that information goes directly to the processor over an encrypted connection. We share your email address, the plan and amount, and your IP address and device metadata for fraud prevention; we receive back a transaction reference and a payment status. Both processors adhere to PCI-DSS.
Payment processing for card and international payment methods. Retains transaction records under its own retention policy.
Payment processing for Nigerian and other African payment methods. Retains transaction records under its own retention policy.
Internal Communications
Internal team communication and operational system notifications. User-identifiable data (such as account events or payment status) may appear in internal notifications sent to Sierra Africa's team channels. Discord also hosts an optional public community server, which you join separately and under Discord's own terms.
Notice of Changes
Before a new sub-processor begins processing personal data, we update this page. Nothing starts processing before it is listed here.
Institutional customers may subscribe to change notifications by emailing support@whollify.com. Subscribers receive at least 30 days' notice of a new or replaced sub-processor before it is engaged.
Objecting to a Sub-Processor
An institutional customer may object, on reasonable data protection grounds, to a new sub-processor within the 30-day notice period. We will work with you to find an alternative: a different provider, a different configuration, or excluding your tenant from the processing in question. Where no reasonable alternative exists and the objection stands, you may terminate the affected part of your subscription without penalty for the remainder of the term.
Individual users who object to a particular sub-processor should write to support@whollify.com. Some processing is essential to running the platform and cannot be disabled for a single account; where that is the case we will say so plainly rather than leave the request open.