What we collect, why, and what you can do about it.

Codality Africa is run by Codality Africa Ltd, B6115, Block B, Apo Urban Shelter, Apo Resettlement, Abuja, Nigeria, which decides how your personal data is used. For anything about your data, write to privacy@codality.africa or use the contact page and mark the message “privacy”.

Data protection officer: Not yet appointed; write to privacy@codality.africa.

• Your account: name, email address, country, and a password that our sign-in provider stores only as a hash.
• Your profile, if you fill it in: username, headline, about text, website, and your visibility choices.
• Your learning: the courses you start, pause and finish, each lesson you mark done and when, and each assessment attempt (score, pass or fail, and time). We do not keep the answers you chose.
• Your credentials: certificates and completion badges we issue, and the title, issuer, date and link of anything you import yourself.
• Your payments: what you bought, the amount, currency, payment provider, our reference and the dates. Card and bank details go straight to Paystack or Stripe; we never see or store them.
• Messages and applications you send through our forms: whatever you write in them.
• Technical data our hosting provider processes to serve and protect the site, such as your IP address and browser type.

• To run your account, save your progress and give you the access you have paid for.
• To issue certificates and let anyone holding a certificate code check that it is genuine.
• To show your profile, but only if you choose to make it public.
• To take payments, keep accounting records and handle refunds.
• To answer your messages and applications.
• In aggregate and without names, to report enrolment, completion and pass rates to organisations that sponsor programmes, and to partners for their own courses.

• Your profile is private by default. If you make it public, anyone with the link sees your name, username, headline, about text, website, certificates, completion badges, imported credentials (labelled self-reported) and completed courses. Your country and the courses you are taking now are shown only if you also switch those on.
• A public profile never shows your email, plan, payments or assessment answers or scores.
• Anyone who has one of your certificate codes can open its verify page, which shows your name, the certificate and the date it was issued, whether or not your profile is public. That is how an employer checks a certificate you gave them.
• We ask search engines not to index profile and verify pages.
• Partners who teach on Codality see totals for their own courses, never your name or details.
• Codality staff can see account and payment records when they need to run the service or help you.
• Our service providers process data for us under contract: Supabase (database and sign-in), Vercel (hosting), Paystack and Stripe (payments).
• There is no employer search today. If we build one, being found by employers will be a separate choice you make.
• We do not sell personal data.

Your account and learning data are stored with Supabase in the European Union, encrypted at rest and in transit. Hosting and payment providers may process data in other countries, including the United States, under their own safeguards. We follow the Nigeria Data Protection Act 2023, and the principles of the GDPR for learners elsewhere.

We keep account and learning data while your account is open. Payment records are kept for as long as tax and accounting law requires. Messages sent through our forms are kept for 12 months, then deleted.

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to move it elsewhere. You can change your profile details and visibility yourself at any time from your dashboard.

Exporting your data and deleting your account are not yet buttons in the product. Until they are, write to us and we will do it for you. We reply within three working days to confirm we have the request.

If you delete your account, we remove your profile, progress and imported credentials. Certificates we issued stay checkable by their code, so an employer who already holds one is not misled, but the record no longer carries your name.

If you are not happy with how we handle your data, you can complain to the Nigeria Data Protection Commission.

We set only the cookies needed to keep you signed in. They are set by our sign-in provider, Supabase, and are named sb-…-auth-token (sometimes split into numbered parts). While you confirm your email, a short-lived sb-…-auth-token-code-verifier cookie is also set.

We do not use advertising cookies, analytics cookies or third-party trackers. When you pay, you complete payment on Paystack's or Stripe's own pages, under their own cookie and privacy policies.