Privacy Policy

1. Introduction and identity of the operator

This Privacy Policy explains how Makebee Technologies ("Makebee", "we", "us" or "our") collect, use, store, disclose and otherwise process personal data in connection with Pivotant (the "Platform" or "Service"). Pivotant is an artificial-intelligence-assisted educational service through which users upload course materials, generate practice examinations, answer questions and receive automated marking and feedback.

Data controller / responsible operator: Makebee Technologies

Contact address in Nigeria: Lagos, Nigeria
Privacy contact: [email protected]
Website: pivotant.makebeehq.com

For the purposes of the Nigeria Data Protection Act 2023 ("NDPA"), the responsible operator determines why and how personal data are processed for Pivotant and acts as the data controller in respect of that processing. Where our service providers process data on our instructions, they ordinarily act as processors, although some providers may act as independent controllers for particular purposes identified in their own notices.

2. Scope

This Policy applies to visitors to the Platform, people who register accounts, users who upload educational materials or undertake practice examinations, and persons who contact us for support. It does not govern websites or services controlled independently by third parties, even when linked from Pivotant.

3. Personal data and content we process

Depending on how you use Pivotant, we process the following categories:

3.1 Registration and account data. Your name, email address, account identifiers and authentication credentials or related security records required to create and protect your account. We use our own backend authentication system; we do not ask you to provide your password by email or in support messages.

3.2 Uploaded educational materials. PDFs, lecture notes, slides and other study content you choose to submit, together with document titles, file metadata and references to the account or course with which they are associated. Materials may contain personal information about you or other people if it is included in the uploaded document.

3.3 Learning and examination data. Course selections, generated practice questions, submitted answers, automatically assigned marks or scores, marking explanations, feedback, and related activity. Some of these records may be retained where the relevant feature saves a practice attempt. For information on retention and deletion, see section 9.

3.4 Technical and security information. Information reasonably necessary to operate and safeguard the Service, which may include IP addresses, browser or device characteristics, request timestamps, authentication events and diagnostic or error records produced by our systems and hosting providers.

3.5 Communications. Information you provide when you email us, submit a support request, report a defect or otherwise communicate with the team.

Please avoid uploading government identifiers, financial details, health information, another person's private records or other sensitive personal data unless they are genuinely necessary and you have a lawful basis to share them. Pivotant is intended for study materials, not for storing confidential personal records.

4. Purposes and lawful bases of processing

We process personal data only where there is a lawful basis under the NDPA. The principal processing activities are:

4.1 Performance of our agreement with you. We use account data to register and authenticate you; receive and organise your educational materials; extract and index document content; generate practice examinations; process your answers; and provide scores, explanations and feedback requested through the Platform.

4.2 Legitimate interests, where not overridden by your rights. We may process proportionate technical and usage information to maintain system security, prevent abuse, diagnose failures, protect the Platform, and understand and improve service reliability. We assess these interests against the rights and expectations of affected individuals.

4.3 Compliance with legal obligations. We may preserve or disclose relevant records where reasonably necessary to comply with an applicable legal obligation or lawful direction of a competent authority.

4.4 Consent, where required. We request consent for processing activities that legally require it, such as optional non-essential cookies or certain promotional communications if these are introduced. Consent may be withdrawn through the method provided or by contacting us, without affecting processing lawfully completed before withdrawal.

If we wish to use uploaded materials or identifiable examination data for a materially different purpose—for example, training a proprietary general-purpose AI model—we will first provide appropriate information and establish a separate lawful basis, including consent where required. This Policy does not itself authorise such a new use.

5. How the AI-assisted functions work

Pivotant processes submitted educational materials to extract text, divide it into searchable portions and create numerical representations or embeddings. Such information may be stored in the Platform's document, relational and vector-data systems, including PostgreSQL and ChromaDB, to make relevant course content available during exam generation.

Pivotant uses Google Gemini to support generation of practice questions and automated grading and feedback. To fulfil a request, relevant portions of your uploaded materials, prompts, answers or other task-related content may be transmitted to Google's AI services for processing. We do not need to send every account field with every request; the information transferred depends on the feature being used and its technical implementation.

AI-generated questions, marking and feedback may be incorrect or incomplete. These outputs are learning aids, not official academic decisions. If you believe an output is wrong, you may challenge it or report the issue using our support address. For more information about academic reliance, please see the Terms and Conditions.

Google and other service providers may process information in countries outside Nigeria. Their own terms, privacy commitments and applicable data-processing arrangements also affect how their services operate. We do not represent that all information remains physically within Nigeria.

6. Disclosure of personal data

We do not sell personal data or provide users' names and email addresses to advertisers for sale or independent marketing.

We disclose only information reasonably needed for legitimate service functions, including to:

• Google (Gemini): to process relevant educational text, prompts, answers and generated content for AI-assisted functionality;
• Render: to host and operate backend application services and associated infrastructure, including relevant stored data;
• Cloudflare: to deliver or protect the web frontend, including technical traffic data handled through Cloudflare Pages and related services;
• Resend and/or Softgate (where enabled): to deliver account-related and other necessary transactional emails, which may require the recipient's email address and message content;
• Authorised team members or contractors: who need limited access to maintain, secure or support Pivotant and are subject to appropriate confidentiality and access restrictions;
• Regulators, courts or public authorities: where disclosure is required by applicable law or a valid legal process; and
• Successor operators: if the Platform is transferred or reorganised, subject to applicable law, appropriate notice and continuing safeguards.

PostgreSQL and ChromaDB are technologies used to maintain data; they are not, by themselves, additional organisations to whom we sell user information. We periodically review the services involved in data processing and will update this Policy if material providers or uses change.

7. International transfers

Because certain infrastructure and AI providers operate internationally, personal data may be accessed, transmitted, stored or otherwise processed outside Nigeria. Where an international transfer is subject to the NDPA, we will rely on an applicable legal transfer mechanism and take measures required by law, which may include appropriate contractual safeguards or another permitted basis. A transfer is not made lawful merely because this Policy mentions it.

8. Cookies and similar technologies

Pivotant may use cookies, authentication tokens, local storage or comparable technologies necessary to keep users signed in, secure sessions and maintain application functionality. Our hosting and security providers may also process limited technical information when a page is requested.

We will not intentionally enable optional advertising or non-essential analytics cookies without providing any notice, choice or consent required by applicable law. You may also use browser controls to clear or restrict cookies, although disabling essential technologies may prevent the Service from working correctly.

9. Retention and deletion

We retain information for the purposes described in this Policy and for the periods set out below, subject to our legal obligations.

• Account information: retained until your account is deleted.
• Uploaded documents and derived content: uploaded materials may remain stored after extraction, together with document chunks and embeddings used for retrieval. They are retained indefinitely and are not deleted after an examination has been generated. Requests to remove a document or account will be assessed against the relevant stored originals and derived records.
• Exam questions, answers, marks and feedback: saved sessions and attempts are retained indefinitely. Not all examination records are necessarily preserved for later retrieval.
• Support, diagnostics and security records: retained indefinitely for support, troubleshooting, abuse prevention and compliance purposes.
• Backups: where backups exist, deleted information may remain in restricted backup copies, which are retained indefinitely.

Retention schedule: Account data: until account deletion; uploaded documents and derived records: indefinite; saved exam records: indefinite; technical logs: indefinite; backups: indefinite.

10. Data security

We implement and maintain reasonable administrative, technical and organisational safeguards appropriate to the nature of the information and the risks involved, including access controls and measures intended to protect authentication and stored data. We review relevant incidents and will notify affected individuals and the Nigeria Data Protection Commission where and when applicable law requires notification.

No internet service, AI provider or storage system can be guaranteed completely secure. Please use a strong, unique password; keep your account credentials confidential; and notify us promptly if you suspect unauthorised access.

11. Your data protection rights

Subject to the NDPA and applicable exceptions, you may have the right to:

• receive information about the processing of your personal data;
• request access to personal data held about you;
• request correction or completion of inaccurate or incomplete information;
• request deletion of personal data where the legal conditions for deletion apply;
• withdraw consent for processing based on consent;
• object to certain processing or request a restriction where applicable;
• exercise data portability rights where provided by law; and
• contest qualifying solely automated decisions and request human intervention where the law provides that right.

To exercise a right, contact [email protected] with the subject "Pivotant Privacy Request". We may ask for proportionate information to establish that the request concerns your account. We will respond in accordance with applicable law, explain any lawful reason for refusing all or part of a request, and provide an appropriate complaints route.

You may also lodge a complaint with the Nigeria Data Protection Commission (NDPC) through its official channels at ndpc.gov.ng.

12. Children and younger students

Pivotant is designed for learners, a category that may include people under 18. Where personal-data processing concerns a child, we will apply the age-related safeguards, parent or guardian involvement and any applicable exceptions required by Nigerian law, including section 31 of the NDPA. The educational nature of Pivotant does not mean that all processing of children's personal data is automatically exempt from safeguards.

We may ask for age or authorisation evidence, restrict access or take other steps where necessary to satisfy these obligations. Parents or guardians who believe that a child has provided information without the legally required authorisation should contact us.

13. Links to other services

The Platform may contain links to third-party resources. We are not responsible for the privacy practices of independently operated websites and encourage you to review their notices.

14. Changes to this Policy

We may revise this Policy to reflect changes in law, providers or the Platform's functions. The effective date above will be updated when a revised version is published. Where a change materially affects how personal data are used, we will provide any additional notice or choice required by law before the new processing begins.

15. Contact

Pivotant — operated by Makebee Technologies
Legally responsible operator: Makebee Technologies
Address: Lagos, Nigeria
Email: [email protected]
Website: pivotant.makebeehq.com