Privacy Policy

This policy explains what personal data TobiStylx Academy collects, why we collect it, who we share it with, and the rights you have over it. It applies to our website, our online courses, and our residential academy.

For the purposes of the Nigeria Data Protection Act 2023 (NDPA), TobiStylx Academy is the data controller of your personal data. We are based at 4 Tiwadayo Estate, Opposite Dele Yes Sir, Bolanle, Osogbo, Osun State. Contact us about anything in this policy at hello@tobistylx.com or +2349135581405.

1. What we collect

Information you give us

• Account details — your name, email address, and password (stored only as a secure hash; we never see it).
• Profile details — phone number, country, date of birth, gender, address, city and state, where you choose to add them to your profile.
• Enquiries — your name, email and message when you use our contact form, and anything you send us on WhatsApp (including proof-of-payment images).
• Residential applications — the details you provide when applying for a cohort.

Information created as you learn

• Enrolments and payment records — which courses you enrolled in, the amount due, and whether your bank transfer has been approved.
• Progress — which lessons you have completed, and any certificate issued to you (including its serial number).

Information collected automatically

• Essential cookies — used to keep you signed in. See our Cookie Policy.
• Technical logs — our hosting provider records standard request data such as IP address, browser type and time of request, for security and reliability.

What we do not collect

We do not take card details, bank passwords, or BVNs. Course payments are made by direct bank transfer from your own bank to ours — that transfer happens entirely with your bank, not on this website. We only see the proof of payment you choose to send us.

2. Why we use it, and our legal basis

• To provide the Services — creating your account, granting course access after we confirm your payment, tracking progress, issuing certificates. Basis: performance of our contract with you.
• To confirm and reconcile payments — matching your bank transfer to your enrolment. Basis: performance of our contract, and our legal obligation to keep financial records.
• To communicate with you — enrolment confirmations, certificate notifications, password resets, and replies to your enquiries. Basis: performance of our contract and our legitimate interest in supporting students.
• To run and secure the platform — preventing account sharing, content piracy, fraud and abuse. Basis: our legitimate interests.
• To meet legal obligations — tax, accounting and responding to lawful requests. Basis: legal obligation.

We do not sell your personal data, and we do not use it for automated decision-making that produces legal effects about you.

3. Who we share it with

We share data only with service providers who help us run the academy, and only as far as needed. These are:

• Supabase — our database and authentication provider; stores your account, profile, enrolments and progress.
• Vercel — hosts the website and processes requests.
• Resend — delivers our transactional emails (enrolment confirmations, certificates, password resets, contact-form messages).
• Bunny.net — hosts and streams lesson videos.
• YouTube (Google) — where a lesson is a YouTube video, it is embedded in privacy-enhanced mode.
• WhatsApp (Meta)— if you choose to message us there. Your conversation is subject to WhatsApp's own privacy policy.

We may also disclose data where required by law, or to establish or defend legal claims.

4. International transfers

Some of the providers above store or process data outside Nigeria. Where data is transferred internationally, we rely on providers that offer recognised safeguards and contractual protections consistent with the NDPA.

5. How long we keep it

• Account, profile and progress — for as long as your account exists. Course access is intended to be lifetime access, so we keep enrolment records while your account is active.
• Certificates — retained so a certificate can be re-issued and verified.
• Payment and enrolment records — kept as long as needed for accounting and tax purposes.
• Enquiries — kept only as long as needed to deal with your enquiry and any follow-up.

When you ask us to delete your account, we remove your personal data except where we must retain some records (for example financial records) by law.

6. Security

Your data is protected by access controls at the database level, so students can only read their own enrolments, progress and certificates. Passwords are hashed, connections are encrypted in transit, lesson videos are served through signed, expiring links, and administrative functions are restricted to authorised staff accounts. No system is perfectly secure, but we take these responsibilities seriously and will notify you and the regulator of a breach where the law requires.

7. Your rights

Under the NDPA you have the right to:

• access the personal data we hold about you;
• correct data that is inaccurate or incomplete — you can update most of this yourself on your profile page;
• request deletion of your data;
• object to or restrict certain processing;
• ask for a copy of your data in a portable format;
• withdraw consent where we rely on it;
• lodge a complaint with the Nigeria Data Protection Commission (NDPC).

To exercise any of these, email hello@tobistylx.com. We will respond within the timeframe required by law. We may need to verify your identity first.

8. Children

The Services are not intended for children under 16. If you believe a child has given us personal data, contact us and we will delete it.

9. Changes to this policy

If we change this policy we will update the “Last updated” date above, and tell you by email where the change is material.

10. Contact us

TobiStylx Academy
4 Tiwadayo Estate, Opposite Dele Yes Sir, Bolanle, Osogbo, Osun State
Email: hello@tobistylx.com
Phone / WhatsApp: +2349135581405