Privacy Policy

• Account info: name, username, email, password, matric number (students), university
• When you agreed to these terms and which version you saw
• Verification documents: ID photo, selfie, proof of enrolment
• Face data: the live pictures you take when you register or update your face registration, and a numerical face template made from them
• Face change history: when you register or replace your face, we keep the new photo and the details of the previous version for a short time so administrators can review the change
• Attendance: the classes you sign in and out of, when, and whether the face check passed with its match score
• Device and location at sign-in: an identifier for the phone you use to sign in to class, and your phone's location at that moment (see section 3)
• Support messages: what you write to us through the chat button, and our replies
• Activity data: attendance, course registrations, comments
• Device data: push notification subscription, if enabled

• Verify you're a real student or staff member before your account is approved
• Check that the person marking attendance is the student the account belongs to
• Let administrators review changes to a face registration, as a safeguard against someone else taking your place
• Run core features: attendance and course tracking
• Send account notifications
• Investigate complaints and reports
• Prevent fraud and abuse

We use your account details to run your account, which is the agreement you make with us when you sign up. We use your face data only because you agree to it when you register, and you can take that agreement back at any time by deleting your account. Other uses, such as stopping fraud, rest on our legitimate interest in keeping UniHub honest and safe.

Your face is sensitive personal data. This is exactly what we do with it:

• At registration, the app uses your camera to take a few pictures while you look at the camera, turn your head and smile. They are checked on our server to confirm a real person is in front of the camera. One clear picture is kept as your face photo, and a numerical face template is made from the pictures. The rest are discarded as soon as the check finishes
• When you sign in or out of class, the picture you take is compared with your template and then discarded. We keep only whether it matched and the match score
• The template and face photo are used only for attendance and for protecting you from impersonation. They are never used for advertising, never sold, and never shared with anyone outside UniHub's hosting
• Face photos can be viewed only by administrators of your university and UniHub's platform administrators, and every time one of them opens a screen showing ID or face photos, that is written to an audit log
• When you sign in to class, the app reads your phone's location once, to check you are in the room by comparing it with the lecturer's location. Your location is not stored
• We store an identifier for your phone against each class sign-in, to catch one phone being used to sign in for several students
• You can replace your face registration from Settings, and you can delete it, with the rest of your account, at any time

• Our hosting provider, which runs the server your data is stored on
• An encrypted offsite backup provider. Backups are encrypted on our server before they leave it, so the provider cannot read them
• Resend, which sends our emails (verification codes, receipts, notices)
• Cloudflare Turnstile, which checks that a sign-up or login is made by a person and not a script
• Sentry, our error-monitoring service — it receives technical details when something breaks in the app (such as the error message, the page, and your browser or device type)
• Your browser's push notification service, if enabled
• University administrators, only as needed for their role
• We never sell your data to anyone

Some of these providers run their servers outside Nigeria, and so does the server UniHub is hosted on. When your data is held or processed abroad we send only what the job needs, encrypt backups before they leave our server, and use providers that publish their own data-protection terms. If you want to know where a particular kind of data is held, ask us using the contact below.

• Your account details, attendance and academic records: for as long as your account exists
• Face template and current face photo: for as long as your account exists, or until you replace or delete them
• Old and new photos from a face change: 90 days after an administrator has reviewed the change
• ID photo of an approved student: one year after sign-up. It is needed to approve you, not to keep you enrolled
• Everything a rejected applicant uploaded: 30 days after the rejection, so there is time to appeal or apply again
• Support messages: until you delete your account
• Backups: copies are replaced on a rolling schedule and the oldest are about 100 days old, so deleted data can remain in an encrypted backup until it is replaced

• Encrypted in transit (HTTPS)
• Passwords are hashed, never stored in plain text
• Verification documents and face photos are stored privately, never public
• Face photos can be viewed only by administrators of your university and UniHub's platform administrators, and those views are part of an administrator's job, not browsing
• Backups are encrypted before they leave our server

Under Nigeria's Data Protection Act, you can ask what data we hold about you, correct it, object to how it is used, withdraw your consent, and have it deleted, subject to legal and record-keeping needs.

• Download a copy: Settings, then Password and your data, then Download. It includes your details, attendance, messages and activity. Your password and the numbers inside your face template are left out
• Delete your account: Settings, then Password and your data, then Delete my account. Your name, email, photos, face data, devices and messages are removed and you can no longer sign in. You will be asked to finish or cancel anything still open and to empty your wallet first if you have one
• Records other people rely on, such as finished Help requests, payments and attendance totals, stay but no longer carry your name
• Staff, lecturer and operator accounts are deleted by our team: message support and we will do it
• For anything else, including correcting details, contact us below. We aim to answer within 30 days

If you are not happy with how we handle your data, you can complain to the Nigeria Data Protection Commission.

Some newly admitted students may be under 18. If that's you, a parent or guardian should be aware of your use of UniHub.

We don't use tracking or advertising cookies. Your session is kept in local storage, not a cookie.

If this policy changes in a way that matters to you, we'll let you know before it takes effect.

Data protection questions and requests: email support@unihub.com.ng with "Data protection" in the subject, or use the chat button on any page.