Privacy Policy
Effective 19 October 2026
UniDraft helps you turn your own verified academic work into a structured, submission-ready document. This page explains, in plain language, what we collect to do that, why, and what say you have over it. It applies to every UniDraft account: student, university contributor, and admin.
1. Who we are
UniDraft (unidraft.ng) is the data controller for the personal data described below. For any privacy question or request, contact [email protected].
2. What we collect
| Category | Examples |
|---|---|
| Account identity | Full name, email address, password (stored as a salted hash, never in plain text), university, department, and role. |
| Academic intake answers | Your project topic, workplace or study setting, methods, results, references, and preliminary-page details (supervisor name, dedication, acknowledgements) — whatever the guided questionnaire asks for your specific document type. |
| Uploaded files | Results documents, evidence images, and any supervisor-corrected DOCX you attach when requesting a correction. |
| Generated output | The structured document content and rendered DOCX/PDF files UniDraft produces for you, and every prior version if you request a correction. |
| Payment records | Transaction status and reference from our payment processors (Flutterwave and Monnify). We do not receive or store your card or bank details — the payment processor handles that directly. |
| Referral and payout data | If you use the referral programme, the bank name, account name and account number you give us for cash-out (the account number is stored encrypted). For everyone, when you sign up and when you check out we keep hashed network and browser signals: a keyed one-way hash of your network address and of your network address plus browser, never the address or browser details themselves. They are kept only to detect referral fraud, such as someone referring themselves. |
| Usage & support data | Login sessions, AI generation job history, support messages you send us, and admin action logs (for accounts with review permissions). |
3. Why we collect it
- To provide the service you asked for — generating, rendering, and correcting your document is not possible without your verified answers and files. This is necessary to perform our contract with you.
- To process payment for a document package or a correction round.
- To prevent abuse and protect accounts — for example, detecting unusual login activity or fraudulent correction requests.
- To improve document quality — for example, learning a department’s confirmed formatting preferences so the next student’s form is pre-filled correctly (see section 5).
- To provide support when you contact us.
- To send reminder emails — if you start a project or an outline and do not finish, or a payment is left unconfirmed, we may send you a few short reminder emails (at most five in total, and never more than one a day). Every one has an unsubscribe link, and pressing it stops them straight away. We also send service emails that are not reminders and cannot be switched off: a receipt when a payment is confirmed and a notice when your document is ready. If you use a referral link, we also email you about your referral rewards and cash-outs (a friend signing up, a reward added, a cash-out approved, paid or not approved), which are service messages too, plus a couple of reminders such as adding your bank details, which you can stop. If an email address bounces permanently or someone marks our email as spam, we stop emailing that address. Account emails such as password resets and support replies are not affected by the reminder setting.
5. Reference documents & department learning
When a university contributor uploads an approved past project as a reference, UniDraft may analyze its structure — chapter order, section purposes, formatting conventions — to help draft outlines for future students in that department. We do not copy another student’s wording, results, or personal details into your document; every reference document’s actual content stays scoped to drafting the structural template only, and your own document is built exclusively from your own confirmed evidence.
Similarly, if you confirm formatting preferences (fonts, margins, reference style) for your own project, that choice may become the pre-filled default offered to the next student in your department for the same document type — again, only the formatting choice, never your personal or academic content.
6. How long we keep it
We keep your account and project data for as long as your account is active, plus a limited period afterward to handle disputes, refunds, or legal obligations. If you ask us to delete your account, we will delete or anonymize your personal data within a reasonable period, except where we are legally required to retain payment records.
7. Your rights
Under Nigeria’s Data Protection Act and NDPR, you have the right to:
- Access the personal data we hold about you;
- Correct inaccurate or incomplete data;
- Request deletion of your data, subject to our legal retention obligations;
- Object to or restrict certain processing;
- Receive a copy of your data in a portable format;
- Lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your rights have been violated.
To exercise any of these, email [email protected].
8. Security
Passwords are stored as salted hashes, never in plain text. Uploaded files are stored with private, access-controlled links rather than public URLs. Access to admin functions is role-restricted and every review or correction action is logged. No system is perfectly secure, and we continuously work to improve these protections.
If a breach occurs that is likely to affect your rights or freedoms, we will notify the Nigeria Data Protection Commission (NDPC) without undue delay, and notify you directly where the breach poses a meaningful risk to you, describing what happened, the data involved, and the steps we are taking in response.
9. International transfer
Some of our processors (including OpenAI and Vercel) operate infrastructure outside Nigeria. Where your data is transferred internationally, we rely on those providers’ own data-protection safeguards and contractual commitments to keep it protected to a standard consistent with the NDPR.
10. Age requirement
UniDraft is intended for tertiary-level students capable of entering a binding agreement in their jurisdiction. We do not knowingly collect data from children under the age required by Nigerian law to consent to this kind of service.
11. Changes to this policy
We may update this policy as the service changes. We will update the effective date above, and for material changes we will make reasonable efforts to notify you directly.
12. Contact
Questions, requests, or complaints about this policy: [email protected].