Privacy Policy

1. Who this policy covers

This policy applies to personal data processed through: (a) our website at ambezi.com; and (b) the Rubric platform, including its web application, desktop application, mobile application and application programming interfaces (together, the "Platform").

It is written for the people whose data we handle: website visitors, Institution administrators, lecturers, invigilators and students ("you"). "Institution" means a university, polytechnic, college of education or other tertiary institution that uses the Platform.

We process personal data in line with the Nigeria Data Protection Act 2023 (NDPA), the General Application and Implementation Directive 2025 (GAID) issued by the Nigeria Data Protection Commission (NDPC), the right to privacy in section 37 of the Constitution of the Federal Republic of Nigeria 1999 (as amended), and, to the extent it remains in force alongside the NDPA, the Nigeria Data Protection Regulation 2019 (NDPR).

2. Who is responsible for your data

The NDPA distinguishes between a data controller, who decides why and how personal data is used, and a data processor, who handles it on the controller's behalf. Which we are depends on the data:

You can reach us about anything in this policy at support@ambezi.com.

3. The personal data we collect

Account data

• •First, middle and last name; email address; role (student, lecturer, administrator)
• •Institution identifier, such as a matriculation or staff number, and the Institution you belong to
• •Your password, stored only as a one-way hash. We cannot read it.
• •Account status (for example active, locked or deactivated) and when the account was created or changed

Examination and academic data

• •Examination questions, marking schemes and the images lecturers attach to questions
• •Students' answers (typed text, selected options and any images they upload), submission times and scores
• •AI-suggested scores and written feedback, and any score a lecturer changes, with who changed it
• •Enrolment in courses and semesters

Examination integrity records

To help lecturers judge whether an examination was fair, the Platform records when a student leaves the examination screen: switching tabs or windows, the window losing focus, leaving full-screen mode, or the mobile app moving to the background. Each event is stored with its time. The Platform also records the IP address and browser or device type of each session. These records are evidence for a human reviewer. They do not by themselves prove misconduct (see section 7).

Billing data (Institutions)

• •Institution name, billing contact, invoices and payment status
• •A payment reference and a payment token or direct-debit mandate reference from our payment provider. We never see or store full card numbers, card security codes or bank passwords.

Technical data

• •IP address, browser and device type, and log-in and log-out times
• •An audit log of important actions: sign-ins and failed sign-ins, password resets, edits to accounts, grade changes, deletions and billing changes, each with the time, the user and the IP address
• •Server logs of requests and errors, used to keep the Platform running and secure

Website data

• •When you use the contact form, your browser opens your own email app with a message addressed to us. We receive only what you choose to send, normally your name, job title, institution, institution type, country, work email, approximate student numbers and message.
• •Emails you send to info@ambezi.com or support@ambezi.com, and our replies
• •Standard request data (IP address, browser type, pages requested) processed by our hosting provider for delivery and security

What we do not collect

4. Why we process data and our lawful basis

Section 25 of the NDPA allows us to process personal data only where a lawful basis applies. Ours are:

We do not use personal data for marketing to students. We do not use it for any purpose incompatible with those above.

5. How we use personal data

• •To provide, secure, support and improve the Platform
• •To suggest scores for written answers and to show lecturers the results
• •To show lecturers when a student left the examination screen, so they can review the attempt
• •To bill Institutions and process payments
• •To send necessary emails: verification codes, password resets, invoices, results notifications and service or policy notices
• •To detect, investigate and prevent fraud, abuse and security incidents
• •To meet our legal obligations and to establish or defend legal claims
• •To produce statistics that do not identify any individual or Institution, for example how many examinations ran in a month

6. AI-assisted grading and automated decisions

For theory (written) questions, the Platform can send the question text, the lecturer's model answer and marking rules, and the student's answer text to an AI model, which returns a suggested score and a short explanation. For questions that include images, those images may also be sent. Student names, matriculation numbers and email addresses are not sent.

Section 37 of the NDPA gives you the right not to be subject to a decision based solely on automated processing that significantly affects you. Rubric is built so that this does not happen: an AI score is a suggestion. The lecturer can review, adjust or replace it, and results are published only after the Institution approves them.

If you disagree with a score, use your Institution's academic appeals process and ask for human review. Our AI provider's API terms state that it does not use data sent through its API to train its models. We rely on those terms and on our contract with the provider.

7. Examination integrity records

The Platform detects, and records, certain actions during an examination (listed in section 3). It detects and records them; it cannot prevent them, and ordinary things such as a notification, a network drop or a phone call can trigger a record. Lecturers see the number and timeline of events and may set a threshold for flagging or automatically submitting an attempt.

A record is a prompt for a person to look, not a finding of misconduct. Institutions are responsible for fair procedures: students should be told what is recorded and have a chance to respond before any penalty. Students who believe a record is wrong should raise it with their Institution.

8. Who we share personal data with

We do not sell personal data and we do not share it with advertisers. We share it only as follows.

With the Institution. Results, integrity records and examination records are available to the student's Institution, which is the controller.

With service providers (sub-processors). We use the providers below to run the Platform. Each is bound by a written contract to protect the data and to use it only for our purposes.

Where the law requires. We disclose personal data when a court order or a lawful request from a competent authority (such as the NDPC, the Economic and Financial Crimes Commission or the police) requires it, after checking that the request is valid and limited to what is necessary.

In a business transfer. If Ambezi merges with, or sells part of its business to, another company, personal data may pass to the successor, which must honour this policy. Institutions will be told in advance.

We keep this list current. Institutions are told of new sub-processors before they start handling Institution data, and can object (see the data processing terms in our Terms of Service).

9. Sending data outside Nigeria

Several providers above operate outside Nigeria, so some personal data leaves the country. Sections 41 to 43 of the NDPA allow that only if the destination or recipient ensures an adequate level of protection, or one of the other lawful routes applies, such as binding contractual safeguards or your informed consent.

We rely on written data processing agreements with standard protective clauses, on minimising what we send (for example, no names go to the AI provider), and on the security measures in section 11. On request we will describe the safeguards for a particular provider. Email support@ambezi.com.

10. How long we keep personal data

We keep personal data only as long as needed for the purposes in this policy and as the law requires. For Institution data, the Institution as controller can give different written instructions, for example to keep records longer for accreditation.

Accounts that an Institution deletes are removed from view immediately and permanently purged within 30 days. Backups held by our providers are overwritten on a rolling cycle.

11. Security and data breaches

We protect personal data with measures suited to the risk, including:

• •Encryption in transit (HTTPS) and encryption at rest provided by our infrastructure providers
• •Passwords stored as salted one-way hashes; signed session tokens that are revoked at sign-out
• •Strict separation between Institutions, so one Institution cannot read another's data, and role-based access for students, lecturers and administrators
• •Rate limiting and lockout protections against password guessing; verified (signed) payment notifications
• •An audit log of sensitive actions, and access to production systems limited to staff who need it and who are bound by confidentiality duties
• •Regular security testing and dependency updates

No system is entirely free of risk. If a personal data breach occurs that is likely to put people's rights and freedoms at risk, then under section 40 of the NDPA: we will tell the affected Institution without undue delay so it can meet its own duties; where we are the controller we will notify the NDPC within 72 hours of becoming aware; and we will tell affected individuals without undue delay where the breach is likely to result in a high risk to them.

To report a suspected vulnerability or incident, email support@ambezi.com.

12. Your rights

Under the NDPA you have the right to:

• •be told how your data is used (this policy)
• •access your personal data and get a copy
• •have inaccurate or incomplete data corrected
• •have data deleted when it is no longer needed or was processed unlawfully
• •restrict or object to processing in the circumstances the law allows, including objecting to direct marketing
• •receive your data in a structured, commonly used, machine-readable format (portability)
• •withdraw consent at any time, without affecting what was done before
• •not be subject to a decision based solely on automated processing that significantly affects you (section 6)

Students and staff of an Institution: the Institution controls Platform data, so please contact your Institution's administrator or data protection officer first. If you contact us, we will pass your request to the Institution promptly and tell you we have done so. We will help the Institution respond.

Everyone else (Institution accounts, website visitors, people who email us): write to support@ambezi.com. We will respond within one month of receiving a valid request. We may need to confirm your identity first. We do not charge a fee unless a request is clearly unfounded or excessive.

Some rights have limits. For example, we cannot delete records we are legally required to keep, such as tax records, and an Institution may need to keep examination records for accreditation.

Complaints. You may complain to the Nigeria Data Protection Commission (ndpc.gov.ng) and may seek a remedy in the Nigerian courts. We would welcome the chance to resolve your concern first.

13. Cookies and local storage

Website (ambezi.com). We use only two small cookies, both to make the site work: one remembers your language, and one remembers the country shown in the footer. We do not use analytics, advertising or tracking cookies, and we do not use tracking pixels.

Platform. The Rubric apps keep your session token and your display preferences in your browser's local storage, or in secure storage on your phone, rather than in cookies. If you turn on device unlock, the app also stores a flag and a credential identifier on your device. Signing out removes the session token. Clearing your browser data removes all of it.

14. Students under 18

Some tertiary students are under 18. The NDPA treats a person under 18 as a child and, in section 31, requires a parent or guardian's consent for processing a child's data unless another lawful basis applies. The Institution, as controller, is responsible for getting that consent where it is needed. We apply the same protections to every student, never use student data for marketing or profiling, and will delete data we learn was collected from a child without proper authority.

15. What Institutions must do

As controller of Platform data, each Institution is responsible for: giving its students and staff a privacy notice; identifying its lawful basis for processing; getting any consent needed, including parent or guardian consent for students under 18; telling students what the Platform records during an examination; running any data protection impact assessment that the NDPA or GAID requires; and responding to its students' and staff's requests. Our data processing terms are in the Terms of Service.

16. Links to other sites

Our website and apps may link to sites we do not run. We are not responsible for their privacy practices. Please read their policies.

17. Changes to this policy

We may update this policy as the law, the Platform or our providers change. We will post the new version here with a new "Last updated" date. For material changes we will email Institution administrators at least 30 days before they take effect.

18. Contact us

Questions, requests and complaints about privacy: support@ambezi.com. General enquiries: info@ambezi.com.

Ambezi Technologies Solutions Limited, a company incorporated in the Federal Republic of Nigeria.