This policy explains what personal data NSIBRA collects, why, how it is protected, and the rights you have over it. It applies to nsibra.com, to GVP, to Institution OS and to the Sovereign Compute Node services, together called "the services". It is written to meet the Nigeria Data Protection Act 2023.
1. Who we are
NSIBRA is the controller of the personal data described in this policy, except where an institution uses the services for its own staff, as explained in section 8. You can reach us about anything in this policy at contact@nsibra.com.
2. What we collect
Account details. Your name, email address, and, where you give them, your institution, department and role.
Your work. What you ask GVP to do, files you attach, pages you send to Act, and the work GVP produces for you. Screenshots are read only where your institution has switched this on; a screenshot is read once and is not kept.
Payment details. Payments are processed by Paystack. We receive confirmation of payment and the plan you are on. We do not receive or store your full card details.
Activity records. When work passes through the Sovereign Compute Engine, we record that it happened: the time, the stage, which model family was used, where it was processed, and how many details were removed before sending. Our own operational view of the services records activity, not the content of your work.
Support messages. What you send us by WhatsApp or email when you ask for help.
Technical data. Basic information your browser sends, such as device type and browser, needed to deliver and secure the services.
3. How we use it
We use personal data to provide the services you ask for; to check, format and return your work; to manage your account and payments; to keep the services secure and working; to answer you when you contact us; and to meet our legal obligations. We do not sell personal data, and we do not use your work to advertise to you.
4. Our legal basis
We process personal data because it is necessary to perform our contract with you, because we must meet a legal obligation, because it is in our legitimate interest to keep the services secure and working, or because you have given consent. Where we rely on consent, you can withdraw it at any time.
5. How your work is processed
Every request passes through the Sovereign Compute Engine before it reaches any AI model. Identifying details, such as names and account numbers, are replaced with placeholders before anything is sent, and restored when the work returns. Figures are left unchanged so the work remains correct.
Where an institution has its own Sovereign Compute Node, its work is processed on that machine. Where the institution requires its node, work that cannot reach it is stopped rather than sent elsewhere.
Your work is stored in your account so that you can return to it, reuse it and build your library. You can delete it from your account.
6. Who we share it with
AI model providers. Providers of the models GVP uses receive the text of a request after identifying details have been removed, in order to process it.
Service providers. Companies that host our database and website and process payments, acting on our instructions and bound to protect the data.
Your institution. Where you use the services through your institution, as described in section 8.
Where the law requires it. When we are legally obliged to disclose information to a lawful authority.
7. Transfers outside Nigeria
Some of our service providers, including AI model providers, operate outside Nigeria. Where personal data leaves Nigeria, we rely on safeguards recognised by the Nigeria Data Protection Act 2023, and identifying details are removed from requests before they are sent to model providers. An institution that needs its work to stay in Nigeria can use its own Sovereign Compute Node.
8. When you use the services through your institution
Where an institution provides the services to its staff, for example through Institution OS, the institution decides how its staff's data is used and is the controller of that data. NSIBRA processes it on the institution's behalf and under its instructions. Questions about that data should go first to your institution.
9. How long we keep it
We keep personal data only as long as needed for the purposes above. Account details are kept while your account is open. Your work is kept until you delete it or close your account. Activity records and payment records are kept for as long as the law requires or as needed to resolve disputes. When data is no longer needed, it is deleted or made anonymous.
10. How we protect it
We use access controls, encryption in transit, the removal of identifying details before model processing, and records of every crossing to protect personal data. No method is perfect. If a breach affects your personal data, we will notify the Nigeria Data Protection Commission and, where required, you, within the time the law sets.
11. Your rights
Under the Nigeria Data Protection Act 2023 you have the right to be informed; to access your personal data; to have it corrected; to have it deleted; to restrict or object to its processing; to receive it in a portable form; and to withdraw consent. To use any of these rights, write to contact@nsibra.com. We will respond within the time the law allows. You also have the right to complain to the Nigeria Data Protection Commission.
12. Children
The services are for adults at work. They are not intended for anyone under 18, and we do not knowingly collect personal data from children.
13. Changes to this policy
We may update this policy. The date at the top shows when it last changed. Where a change is significant, we will tell you in the services or by email before it takes effect.
14. Contact
For any question about this policy or your personal data, write to contact@nsibra.com.