Privacy Policy

SkillSwap (“SkillSwap”, “we”, “us”) is a peer-to-peer skill-exchange platform for Nigerian university students. It is operated by CALM Global Information Technologies Limited, a company incorporated in Nigeria with its principal office in Lagos.

This policy explains what personal data we collect, how we use it, who we share it with, and what rights you have. It reflects our obligations under the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Regulation (NDPR).

Questions? Email privacy@skillswapafrica.com.

Information you provide directly

• Full name, email address, and (optionally) phone number.
• University, course of study, year of study, and city.
• Profile photo, bio, and the skills you teach or want to learn.
• Your availability and preferred hours.
• Referral code (if you were invited by another user).

Information collected automatically

• IP address, device type, browser, and operating system.
• Pages visited and features used on the platform.
• Session timestamps and platform actions (bookings, messages, reviews, disputes).

Payment information

All card and bank details are collected and processed by Paystack, our PCI-DSS-compliant payment processor. We do not store card details on our servers. We keep only the transaction reference, amount, success/failure status, and which coin package was purchased.

Cookies

We use cookies to keep you logged in and understand how the platform is used. See our Cookie Policy for the full list.

• Match you with other students based on skills, university, and availability.
• Facilitate swap requests, coin bookings, sessions, and messaging between users.
• Send transactional emails: sign-up confirmations, session reminders, booking notifications, and payment receipts.
• Prevent fraud, enforce our Terms of Service, and resolve disputes.
• Improve the platform through aggregated analytics. We do not track individuals for advertising purposes.
• Comply with legal, regulatory, and tax obligations.

With other users

Your public profile — name, university, course, skills, avatar and average rating — is visible to other signed-in users so they can decide whether to swap or book with you. Private data (email, phone, availability schedule details, wallet balance, chat history) is never shown to other users.

With service providers

• Supabase — database, authentication, storage.
• Vercel — application hosting and edge network.
• Paystack — payment processing.
• Resend — transactional email delivery.

Each is bound by its own data-processing agreements and privacy policies.

Law enforcement and legal process

We disclose data only when legally required — for example under a valid court order, subpoena, or in response to a criminal investigation by Nigerian authorities.

We do NOT sell your data

SkillSwap does not sell, rent, or trade your personal data to advertisers, marketers, or any third party.

Business transfers

If SkillSwap is acquired, merged, or transferred to a new operator, user data may transfer as part of that transaction. We will notify affected users in advance and honour the commitments in this policy under any new operator.

• Card and bank details are collected and processed by Paystack, a PCI-DSS-compliant payment processor licensed in Nigeria.
• We only see the transaction reference, Naira amount, success/failure status, and the coin package purchased.
• SkillCoins (“SC”) are internal platform credits. They are not legal tender.
• Purchased coins are non-refundable except in cases of clear system error or a Paystack chargeback we honour.
• SkillCoins cannot be exchanged for cash. The economy is closed: coins only move between wallets on the platform.

• Data is stored on Supabase infrastructure with row-level security policies enforcing per-user access.
• All connections use HTTPS/TLS in transit.
• Passwords are hashed with bcrypt (via Supabase Auth). We never store plain-text passwords.
• The SkillCoin ledger is append-only and reconciled daily; every money movement is auditable end-to-end.
• No system is perfectly secure. We follow industry best practices but cannot guarantee absolute security. Report suspected incidents to privacy@skillswapafrica.com.

Under the Nigeria Data Protection Act 2023 you have the right to:

• Access: request a copy of the personal data we hold about you.
• Correction: fix inaccurate data yourself in Settings, or ask us to correct it.
• Deletion: request full deletion of your account and personal data by emailing privacy@skillswapafrica.com. Note: financial records may be retained for legal and audit purposes for up to six years after deletion.
• Object: opt out of non-essential communications. Transactional emails (session confirmations, payment receipts) cannot be disabled without deleting your account.
• Data portability: request your data in a machine-readable format.
• Complaint: lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

• SkillSwap is intended for users aged 16 and above.
• Users under 18 need parental or guardian consent before signing up.
• We do not knowingly collect personal data from anyone under 16. If we learn we have, we delete it and terminate the account.

• Essential cookies: authentication session cookies. Required to log in — disabling them breaks the site.
• Analytics cookies: help us understand aggregated platform usage. Anonymous and never used for advertising.
• You can control cookies via your browser settings. See our Cookie Policy for details.

Some processing happens outside Nigeria — Supabase and Vercel host infrastructure in the US and EU, and Resend delivers email from the EU. These transfers are governed by standard contractual clauses and, where applicable, adequacy decisions. We ensure the same level of protection as we do domestically, regardless of where the processing takes place.

• Active accounts: data retained for the life of the account.
• Deleted accounts: profile data deleted within 30 days of a verified deletion request.
• Financial records: transactions and receipts retained for six years to satisfy Nigerian tax and audit law.
• Legal hold: data may be retained longer if subject to a legal proceeding, regulatory investigation, or ongoing dispute.

• We update this policy periodically as the platform evolves.
• Material changes are emailed to registered users at least 14 days before they take effect.
• Continued use of the platform after the effective date means you accept the updated policy.
• Prior versions of this policy are available on request from privacy@skillswapafrica.com.

• Email: privacy@skillswapafrica.com
• Data Protection Officer: [DPO name and role — to be appointed].
• Address: CALM Global Information Technologies Limited, Lagos, Nigeria.
• Response time: we aim to reply within seven business days.