Privacy Policy

1. Who We Are

GENIE is an education technology platform developed and operated by Genesis Systems Labs & Technologies Limited, a company incorporated in Nigeria. We provide attendance management, academic records, grading, and related services to universities, polytechnics, and other tertiary institutions across Africa.

For students and staff onboarded by a tertiary institution, that institution is the data controller and Genesis Systems Labs & Technologies Limited acts as data processor on its instruction. Your institution decides what is collected and why; we process it on their behalf under contract. Where you deal with us directly — a support request, or an account you create yourself — we are the controller.

Questions about this policy: privacy@thegenieos.com

2. What We Collect

The table below lists every category of personal data we collect through the GENIE Student app and the web portal, together with the reason for collection.

We do not collect data that is not listed above. In particular, we do not read your contacts, camera roll, microphone, calendar, or any other sensor not explicitly listed.

3. How We Use Your Data

• Verify your identity and authenticate you to the platform.
• Record and display your attendance at lectures, labs, and exams.
• Send push notifications and SMS/WhatsApp alerts about attendance, grades, and timetable changes.
• Process subscription payments and manage billing for your institution.
• Generate academic reports for your institution and (where applicable) regulatory bodies.
• Detect and fix crashes and errors in the app (via Sentry error monitoring).
• Comply with legal obligations applicable to educational institutions in Nigeria.

Under the Nigeria Data Protection Act 2023, we rely on contract performance (to provide the service you enrolled in) and legitimate interests (platform security, fraud prevention, crash monitoring) as our lawful bases for processing. Where consent is required — for example, for location access during attendance check-in — we request it explicitly through the operating system permission dialog.

4. Location & Bluetooth

Why we need precise location

Attendance in GENIE is geofence-verified. When you start a check-in, the app reads your GPS coordinates and sends them to GENIE. If you are inside the perimeter, attendance is logged. GENIE checks GPS coordinates against the classroom's registered perimeter and does not keep them with the attendance record. While a class session is open, the app sends a location reading roughly every 15 minutes to confirm you are still in the classroom; GENIE keeps the result of each reading, inside or outside the perimeter, together with the reported GPS accuracy, the Bluetooth signal strength where a classroom beacon is used, and whether the device reported a simulated location. It does not keep the coordinates. A check-in sent as a WhatsApp location pin keeps that pin's coordinates with the check-in as anti-fraud evidence for 90 days, after which they are erased. When a lecturer maps a classroom by walking its perimeter, those GPS waypoints are kept as the classroom boundary.

Location during an open class session

While a class session is open, the app may continue to use your location in the foreground to support auto-checkout — when you physically leave the classroom mid-session, the app marks you as departed. This prevents a student from checking in and then leaving. We do not request background ("allow all the time") location access on Android or iOS: location is used only while the app is in use during an open session, and stops when the session ends or you clock out.

Bluetooth (BLE)

As a secondary proof-of-presence mechanism your device communicates with the lecturer's device over Bluetooth Low Energy (BLE). The BLE exchange is local, encrypted, and ephemeral — no Bluetooth identifiers leave your device. BLE is used in addition to GPS, not instead of it, to prevent location spoofing.

Biometric authentication — what we do not receive

When GENIE asks you to authenticate at check-in, your device performs the check using its own fingerprint or face unlock. The device returns only whether the check succeeded. Your biometric template never leaves your phone, is never transmitted to us, and is never stored on our servers. We record only a yes-or-no result alongside your attendance. If your device has no biometric hardware or you have not enrolled, check-in proceeds without it.

5. Who We Share Data With

We do not sell your personal data. We share it only as described below:

• Your enrolled institution — attendance records, grades, and academic data are accessible to authorised staff at your institution.
• Flutterwave — payment processing for subscription fees. Flutterwave is PCI-DSS compliant. We share only the data necessary to complete a transaction.
• Paystack — payment processing, alongside Flutterwave. We share only the data necessary to complete a transaction.
• Africa's Talking — SMS delivery. Receives your phone number and the message body of an SMS we send you.
• Expo Push Notification Service — push-notification delivery. Receives your device push token, student first name, course, and the related record IDs.
• AI language-model providers (OpenAI, Google Gemini, Anthropic) — the support assistant sends your name, institution, role, and the message you type, in order to answer it. The academic assistant sends only pseudonymous figures — attendance percentage and eligibility status — with no name or matriculation number.
• Google Scholar and ResearchGate — lecturer name and institution only, for academic-profile validation.
• Google Cloud (Cloud Run, Cloud SQL) — our infrastructure provider for hosting and database storage, located in the EU (europe-west1).
• Sentry — crash and error reporting. Only anonymised technical data (stack traces, device model, OS version) is shared. No names, emails, or location data are sent to Sentry.
• Regulatory authorities — where required by Nigerian law (e.g. NUC), aggregated non-identifiable statistics may be shared.

Your data is stored and processed in the European Union (Google Cloud, europe-west1, Belgium). Some of our service providers are established in the United States and personal data may be transferred to them for the purposes described above. These transfers are made under contractual safeguards with each provider.

6. How Long We Keep Data

• Account and academic data: retained for the duration of your enrolment and for 5 years after graduation or withdrawal, in accordance with Nigerian tertiary education record-keeping requirements.
• Payment records: retained for 7 years for tax and audit compliance.
• Location data: GENIE checks GPS coordinates against the classroom's registered perimeter and does not keep them with the attendance record. While a class session is open, the app sends a location reading roughly every 15 minutes to confirm you are still in the classroom; GENIE keeps the result of each reading, inside or outside the perimeter, together with the reported GPS accuracy, the Bluetooth signal strength where a classroom beacon is used, and whether the device reported a simulated location. It does not keep the coordinates. A check-in sent as a WhatsApp location pin keeps that pin's coordinates with the check-in as anti-fraud evidence for 90 days, after which they are erased. When a lecturer maps a classroom by walking its perimeter, those GPS waypoints are kept as the classroom boundary.
• Crash reports: retained for 90 days in Sentry before automatic deletion.
• When you request account deletion (see Section 8), identifiable data is purged within 30 days. Anonymised aggregate statistics may be retained.

7. Security

All data in transit is encrypted using TLS 1.2 or higher. Data at rest is encrypted by our infrastructure provider, Google Cloud, using AES-256 encryption applied by default to Cloud SQL and Cloud Storage. Access tokens are short-lived (JWT) and are stored in the device's encrypted secure keystore (iOS Keychain / Android Keystore via Expo SecureStore), never in plain AsyncStorage or cookies.

Further detail on our security practices is available on our Security page.

8. Your Rights

Under the Nigeria Data Protection Act 2023 you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — request deletion of your account and associated personal data.
• Restriction — ask us to pause processing your data in certain circumstances.
• Portability — receive your data in a machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — withdraw location or notification permission at any time through the device OS settings; this will disable the features that depend on those permissions.
• Complain — you may lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your data has not been handled lawfully.

To exercise any right, email privacy@thegenieos.com with the subject line "Data Request — [your right]". We will respond within 30 days.

Deleting your account

You do not need to email us to delete your account. In the GENIE app, go to Settings → Account → Delete Account. If you no longer have the app, use thegenieos.com/delete-account.

Your account closes immediately — you are signed out on every device and cannot sign back in — and it is deleted 30 days later. At any point inside those 30 days you can cancel and everything is restored.

What happens to each category of data is not uniform, so we set it out plainly:

• Deleted — your password and session credentials, name, email address, telephone number, profile photograph, device identifier, biometric verification hash, push-notification registrations, and your support conversations.
• Anonymised, not deleted — attendance, enrolment, grades and examination eligibility. These form your institution’s academic record. Under the Nigeria Data Protection Act 2023 your institution is the data controller for them and GENIE processes them only on your institution’s instructions, so we cannot erase them at your request. What we remove is your identity: the rows survive as figures in your institution’s statistics and the identity attached to them is replaced with a random label that cannot be reversed. To have the underlying record erased, you must ask your institution; we will tell them you have asked us to delete your account.
• Retained where the law requires — financial and audit records, for the statutory retention period. These carry no contact details after deletion.

You also choose what happens to your GENIE Master Student Record and your GABS credential. By default we keep them, so you can obtain proof of your academic record later and so an institution asking us to verify it can be answered — with your contact details removed from that record. You may instead choose to erase them permanently, in which case anyone later asking GENIE to confirm your record or verify your GABS credential will be told we hold nothing. That choice cannot be undone.

If you would rather not use either self-service route, email privacy@thegenieos.com from your registered address with the subject line "Data Request — Erasure". We will respond within 30 days.

9. Students Under 18

Nigerian tertiary institutions admit some students under the age of 18. Under the Nigeria Data Protection Act 2023, a person under 18 is a child, and processing a child's personal data requires the consent of a parent or legal guardian.

Where a student is onboarded by an institution, that institution is the data controller and obtains any consent required from a parent or guardian as part of its own admission process. Our agreements with institutions require them to warrant that they have obtained that consent before a student's data is provided to GENIE.

If you are a parent or guardian and you wish to withdraw consent or ask what data we hold about your child, contact your institution in the first instance, or email privacy@thegenieos.com and we will direct your request appropriately.

10. Third-Party Services

The app and platform integrate with the following third-party services. Each has its own privacy policy:

• Google Cloud Platform — https://cloud.google.com/terms/cloud-privacy-notice
• Flutterwave — https://flutterwave.com/ng/privacy-policy
• Sentry — https://sentry.io/privacy/
• WhatsApp Business API (Meta) — https://www.whatsapp.com/legal/privacy-policy

11. Changes to This Policy

We may update this policy as the platform evolves. When we make material changes, we will notify you via a push notification and update the "Last updated" date at the top. Continued use of GENIE after a policy change constitutes acceptance of the updated terms.

12. Contact Us