Privacy Policy

This draft Privacy Policy sets out the proposed framework for how Prompt AI Limited ("Prompt AI", "we", "us" or "our") handles personal information in connection with our public website, enquiries, waitlists, training and relevant products. It is for business and legal confirmation and is not yet adopted. Practices described as service-dependent apply only where that service or feature is used.

We act as a controller when we decide why and how personal information is used for our own activities, such as handling an enquiry. Where we process personal information for a client or institution under its instructions, we may act as a processor. The client's privacy notice and our agreed data-processing terms govern that activity. Product-specific notices may add detail; they should identify any different roles or purposes.

You may provide information through forms, email, telephone, meetings, waitlist registration or programme enrolment. Where relevant, an authorised organisation, institution, parent or guardian may provide information on your behalf. Technical information may be generated when you access a website or service.

If someone supplies another person's information, they should have the authority and lawful basis to do so and provide any required privacy information. We should request only information appropriate to the purpose and explain additional requirements before a service collects it.

Contact details provided for an enquiry should be used to respond and manage that conversation. A waitlist registration should be used for the product updates described at sign-up. Neither interaction should be treated as blanket permission for unrelated marketing.

If optional marketing is offered, the relevant sign-up should explain your choice and the lawful basis. You can ask us to stop marketing by using the unsubscribe option where provided or by emailing Contactus@promptai.com. Necessary replies, contractual notices or service communications may still be sent where appropriate. You can also ask to leave a waitlist.

Where cookies or similar technologies are used, essential technologies may support functions such as security, session management or remembering a privacy choice. Non-essential technologies, such as optional analytics or marketing tools, should be distinguished from those necessary to provide a requested function.

Where consent is required, non-essential technologies should not be activated before you make that choice. You should be able to decline or withdraw consent through the available preference controls. Browser settings may also block or delete cookies, although this can affect some functions. A service's cookie information should explain the technologies actually deployed; this draft does not assert that particular tools are in use.

Personal information may be shared with service providers only where necessary for the relevant activity, such as hosting, communications, technical support or administering an agreed service. Providers should receive access appropriate to their role and be subject to suitable contractual confidentiality, security and data-protection requirements.

Information may also be disclosed to professional advisers or competent authorities where needed to meet a legal obligation, establish or defend legal claims, or protect lawful rights. If an organisational change requires a transfer of relevant records, applicable safeguards and notice requirements should be followed. This draft does not authorise unrelated disclosures or identify unconfirmed vendors.

Where an engagement involves AI, analytics or automation, personal information and client materials must be handled according to the agreed purposes, instructions and access arrangements. A project should identify the data needed, the providers involved, any proposed model-development use and the safeguards appropriate to the information.

Do not assume that sending us data makes it suitable for every AI system. Before using client information for a new purpose, including any training or model-improvement activity, the parties must confirm the relevant authority, lawful basis, transparency and contractual permissions. This policy does not promise that every service follows an identical training practice, or grant permission to reuse client data outside agreed instructions.

Where we are a processor, we should assist the controller with applicable requests and obligations under the agreed terms. Direct requests about data controlled by a client or institution may need to be routed to that organisation.

Depending on a service's infrastructure and support arrangements, information may need to be accessed or processed outside Nigeria. Any such transfer must meet applicable data-protection requirements; the safeguards depend on the destination, recipient and nature of the processing.

Where applicable, safeguards may include an assessment of the recipient country's protection, appropriate contractual measures or another lawful transfer mechanism. The relevant service notice or agreement should explain material transfer arrangements. You may contact us for information about safeguards applicable to your interaction or engagement.

Information should be retained only as long as reasonably necessary for its stated purpose, taking account of the relationship, legal obligations, dispute requirements and the sensitivity of the information. Enquiry records, waitlist entries, learner records and client project data may therefore require different retention decisions.

When information is no longer needed, it should be deleted or anonymised as appropriate, subject to lawful exceptions. Client data return and deletion should follow the signed agreement and the controller's instructions. A deletion request may be limited where records must lawfully be kept; any applicable reason should be explained. This draft sets no unverified fixed retention periods.

Appropriate technical and organisational measures should protect personal information against unauthorised access, misuse, loss or disclosure, taking account of the risks and service context. Access controls, confidentiality agreements and proportionate security review should be addressed for the systems involved.

No website, storage system or transmission method is completely secure. Avoid sending passwords or unnecessary sensitive records through ordinary enquiry channels. If a personal-data breach occurs, assessment, response and any required notification must follow applicable law and the relevant contractual arrangements.

Tell us what you are requesting and enough context to locate the relevant interaction, such as the email address used for an enquiry or enrolment. We may need proportionate information to verify your identity or authority before disclosing or changing records. Please do not send unnecessary identity documents unless requested through an appropriate channel.

Requests should be handled within the time required by applicable law. If a request cannot be met in full, the applicable reason and available next steps should be explained. Where a client or institution controls the information, we may refer you to it or assist it under our agreed instructions. Rights are not an unconditional entitlement to remove records that must lawfully be retained.

Scholaris and other learning services may involve children's information depending on their intended users and how a school or family accesses the service. Before collecting such information, the relevant arrangements should establish the child's age, the roles of Prompt AI and the institution, the lawful basis and any required parent or guardian consent or authorisation.

Learner notices should be clear and age-appropriate, collection limited to what is necessary, and access suitable for the learning context. A general waitlist is not permission to collect detailed child records. Parents, guardians and institutions can contact us about a learner's information; rights requests may require verification and coordination with the organisation that controls it.

This draft may change following confirmation of our practices and legal review. Once adopted, the policy should be updated when relevant services, processing or legal requirements change, with the revised version and date made available. Significant changes should be communicated where required.

A policy update is not, on its own, consent to a new purpose or permission to alter a client's data-processing instructions. Where a change requires additional notice, a new lawful basis or consent, those requirements must be addressed before the relevant processing.

For privacy questions, preferences or a data-protection request, contact Prompt AI Limited. Please include the relevant service or interaction so that your message can be directed appropriately.