Privacy Policy

1. Who We Are

GENIE is an education technology platform developed and operated by Genesis Systems Labs & Technologies Limited, a company incorporated in Nigeria. We provide attendance management, academic records, grading, and related services to universities, polytechnics, and other tertiary institutions across Africa.

For students and staff onboarded by a tertiary institution, that institution is the data controller and Genesis Systems Labs & Technologies Limited acts as data processor on its instruction. Your institution decides what is collected and why; we process it on their behalf under contract. Where you deal with us directly — a support request, or an account you create yourself — we are the controller.

Questions about this policy: privacy@thegenieos.com

2. What We Collect

The table below lists every category of personal data we collect through the GENIE Student app and the web portal, together with the reason for collection.

We do not collect data that is not listed above. In particular, we do not read your contacts, camera roll, microphone, calendar, or any other sensor not explicitly listed.

3. How We Use Your Data

• Verify your identity and authenticate you to the platform.
• Record and display your attendance at lectures, labs, and exams.
• Send push notifications and SMS/WhatsApp alerts about attendance, grades, and timetable changes.
• Process subscription payments and manage billing for your institution.
• Generate academic reports for your institution and (where applicable) regulatory bodies.
• Detect and fix crashes and errors in the app (via Sentry error monitoring).
• Comply with legal obligations applicable to educational institutions in Nigeria.

Under the Nigeria Data Protection Act 2023, we rely on contract performance (to provide the service you enrolled in) and legitimate interests (platform security, fraud prevention, crash monitoring) as our lawful bases for processing. Where consent is required — for example, for background location — we request it explicitly through the operating system permission dialog.

4. Location & Bluetooth

Why we need precise location

Attendance in GENIE is geofence-verified. When you start a check-in, the app reads your GPS coordinates once and compares them against the registered perimeter of the classroom. If you are inside the perimeter, attendance is logged. The raw coordinates are not stored on our servers; only the binary result (present / absent) is recorded.

Background location

We request background location access on both Android and iOS to support auto-checkout — when you physically leave the classroom mid-session, the app automatically marks you as departed. This prevents a student from checking in and then leaving. Background location is active only during an open class session and stops when the session ends or you clock out.

Bluetooth (BLE)

As a secondary proof-of-presence mechanism your device communicates with the lecturer's device over Bluetooth Low Energy (BLE). The BLE exchange is local, encrypted, and ephemeral — no Bluetooth identifiers leave your device. BLE is used in addition to GPS, not instead of it, to prevent location spoofing.

Biometric authentication — what we do not receive

When GENIE asks you to authenticate at check-in, your device performs the check using its own fingerprint or face unlock. The device returns only whether the check succeeded. Your biometric template never leaves your phone, is never transmitted to us, and is never stored on our servers. We record only a yes-or-no result alongside your attendance. If your device has no biometric hardware or you have not enrolled, check-in proceeds without it.

5. Who We Share Data With

We do not sell your personal data. We share it only as described below:

• Your enrolled institution — attendance records, grades, and academic data are accessible to authorised staff at your institution.
• Flutterwave — payment processing for subscription fees. Flutterwave is PCI-DSS compliant. We share only the data necessary to complete a transaction.
• Paystack — payment processing, alongside Flutterwave. We share only the data necessary to complete a transaction.
• Africa's Talking — SMS delivery. Receives your phone number and the message body of an SMS we send you.
• Expo Push Notification Service — push-notification delivery. Receives your device push token, student first name, course, and the related record IDs.
• AI language-model providers (OpenAI, Google Gemini, Anthropic) — the support assistant sends your name, institution, role, and the message you type, in order to answer it. The academic assistant sends only pseudonymous figures — attendance percentage and eligibility status — with no name or matriculation number.
• Google Scholar and ResearchGate — lecturer name and institution only, for academic-profile validation.
• Google Cloud (Cloud Run, Cloud SQL) — our infrastructure provider for hosting and database storage, located in the EU (europe-west1).
• Sentry — crash and error reporting. Only anonymised technical data (stack traces, device model, OS version) is shared. No names, emails, or location data are sent to Sentry.
• Regulatory authorities — where required by Nigerian law (e.g. NUC), aggregated non-identifiable statistics may be shared.

Your data is stored and processed in the European Union (Google Cloud, europe-west1, Belgium). Some of our service providers are established in the United States and personal data may be transferred to them for the purposes described above. These transfers are made under contractual safeguards with each provider.

6. How Long We Keep Data

• Account and academic data: retained for the duration of your enrolment and for 5 years after graduation or withdrawal, in accordance with Nigerian tertiary education record-keeping requirements.
• Payment records: retained for 7 years for tax and audit compliance.
• Location data: not retained — only the attendance outcome is stored.
• Crash reports: retained for 90 days in Sentry before automatic deletion.
• When you request account deletion (see Section 8), identifiable data is purged within 30 days. Anonymised aggregate statistics may be retained.

7. Security

All data in transit is encrypted using TLS 1.2 or higher. Data at rest is encrypted by our infrastructure provider, Google Cloud, using AES-256 encryption applied by default to Cloud SQL and Cloud Storage. Access tokens are short-lived (JWT) and are stored in the device's encrypted secure keystore (iOS Keychain / Android Keystore via Expo SecureStore), never in plain AsyncStorage or cookies.

Further detail on our security practices is available on our Security page.

8. Your Rights

Under the Nigeria Data Protection Act 2023 you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — request deletion of your account and associated personal data.
• Restriction — ask us to pause processing your data in certain circumstances.
• Portability — receive your data in a machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — withdraw location or notification permission at any time through the device OS settings; this will disable the features that depend on those permissions.
• Complain — you may lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your data has not been handled lawfully.

To exercise any right, email privacy@thegenieos.com with the subject line "Data Request — [your right]". We will respond within 30 days.

To request deletion of your account, email privacy@thegenieos.com with the subject line "Data Request — Erasure". We will respond within 30 days. Where your institution is the data controller for your records, we will process the request on their instruction and tell you if any part of it must be directed to them.

9. Students Under 18

Nigerian tertiary institutions admit some students under the age of 18. Under the Nigeria Data Protection Act 2023, a person under 18 is a child, and processing a child's personal data requires the consent of a parent or legal guardian.

Where a student is onboarded by an institution, that institution is the data controller and obtains any consent required from a parent or guardian as part of its own admission process. Our agreements with institutions require them to warrant that they have obtained that consent before a student's data is provided to GENIE.

If you are a parent or guardian and you wish to withdraw consent or ask what data we hold about your child, contact your institution in the first instance, or email privacy@thegenieos.com and we will direct your request appropriately.

10. Third-Party Services

The app and platform integrate with the following third-party services. Each has its own privacy policy:

• Google Cloud Platform — https://cloud.google.com/terms/cloud-privacy-notice
• Flutterwave — https://flutterwave.com/ng/privacy-policy
• Sentry — https://sentry.io/privacy/
• WhatsApp Business API (Meta) — https://www.whatsapp.com/legal/privacy-policy

11. Changes to This Policy

We may update this policy as the platform evolves. When we make material changes, we will notify you via a push notification and update the "Last updated" date at the top. Continued use of GENIE after a policy change constitutes acceptance of the updated terms.

12. Contact Us