NITACON policy

Privacy notice

NITACON connects Nigerian students and new graduates with employers. This notice explains what we collect, why, who can see it, and what you can do about it under the Nigeria Data Protection Act 2023.

Version 2026-09-26

The short version

  • Other students cannot find your profile, and search engines never index it. If you switch on your public link, the people you share it with see your work — never your contact details.
  • When an employer opens your passport, you see which company it was. Employers who have confirmed their phone number can also read your published profile in their search results; that preview is not recorded.
  • Your email and phone number go only to an employer whose conversation you accept.
  • You can delete your account from Settings. It is erased seven days after you ask.

Who we are

NITACON is the data controller for the personal data described here. Contact our data protection lead at privacy@nitacon.ng.

What we collect

  • Account details: your name, email address and password (the password is held by our sign-in service and never visible to us).
  • Your phone number, if you confirm it, and a record that you did.
  • What you add to your profile: headline, bio, education, NYSC status, city, skills, projects, links and a video link.
  • Verification results: for example, that commits in a repository were authored by your GitHub account, or that you control a domain. If you connect GitHub, we keep your GitHub account id and username — never an access token.
  • For employers: company details, any company registration document you upload for review, and — if you confirm a work email — the address the code was sent to, kept as the record of that check, and its domain, which students see.
  • Messages you send and receive on NITACON, and reports you file.
  • Roles you apply to, the note you write with each application, and where each application stands. For employers: the roles you post and the applications they receive.
  • When an employer opened your full profile: which company, how far NITACON had verified it at the time, the date, and how many times.
  • If you switch on your public link: its address, and how many times it was opened each day (a count, kept for eight days — not who opened it).
  • The notifications we send you, and whether the email copy was delivered.
  • For payments: what you bought and the payment reference. Card details are handled by Paystack and never reach us.
  • Your consent to this notice, which version, when, and the IP address it came from.

Why, and on what basis

  • To make your profile discoverable to employers — on the basis of your consent, given at signup, which you can withdraw by unpublishing or deleting your account.
  • To run your account, messages and payments — to provide the service you asked for.
  • To prevent fraud and keep people safe — our legitimate interest: rate limits, scam-message detection, reports, and reviewing employers.
  • To keep financial records — our legal obligations.

Who can see your profile

  • Other students: nobody can find it on NITACON.
  • Anyone you give your public link to, if you switch it on: your published profile — your work, skills, checks and education. Never your email, phone number, salary expectations or video. You can switch it off, or replace the address, at any time.
  • Employers who have not confirmed their phone number: an anonymised card — your first name and initial, headline, skills, NYSC status, city and work preference, graduation year and type of institution, how many projects you have and how many are verified, which checks you passed, when you were last active, and how many employers opened your profile this week. Never your surname, projects, links or contact details.
  • Employers who have confirmed their phone number: your full published profile, including as a preview in their search results. Opening your passport is recorded and shown to you; a preview in search is not.
  • An employer whose role you apply to: your full published profile and the note you write.
  • Employers see how many different employers opened your profile in the last seven days — a number, never which ones.
  • Your email and phone number: only an employer whose conversation you accept.
  • Search engines: never. Profiles and public links are marked not to be indexed.
  • NITACON staff: only as needed to review reports and verification, and every access to a verification document is logged.

What students see about employers

  • When an employer opens a student’s full profile, the student sees the company’s name and logo, and how far NITACON had verified it, with the date.
  • A role you post shows your company’s name and verification to the students it is posted to.
  • If you confirmed a work email, students see the domain it is at — never the address — in the note beside your messages and roles.
  • Students never see who at the company looked, and never see another employer’s activity.

Services that process data for us

  • Cloudflare — network protection and the anti-bot check on forms.
  • Vercel — hosting of this website.
  • Oracle Cloud Infrastructure — hosting of our servers, database and stored documents.
  • Termii — sending your phone confirmation code by SMS.
  • Paystack — taking payments from employers.
  • Our email delivery provider — sending the notification emails you have not switched off.
  • GitHub — only if you choose to connect it, to check authorship of your repositories.
  • YouTube and Loom — only when someone plays a video pitch; nothing loads from them until then.

Some of these are based outside Nigeria. We use them only for the purpose listed.

How long we keep it

  • Company registration documents: deleted 30 days after the review decision. The decision itself is kept.
  • Counts of public-link opens: eight days.
  • Your account: until you delete it.
  • Payment records and our records of consent and staff actions: kept after deletion, because the law or our accountability require it.

Deleting your account

You can delete your account from Settings. It is erased seven days after you ask — you can cancel until then. Your profile, projects, skills, verification results, view history, applications and saved roles are removed, and your public link stops working. Messages you sent are replaced with a note that they were removed, so the other person’s side of the conversation stays intact. We keep the record that you consented, and when, without your IP address.

Your rights

You can ask to see the data we hold about you, to correct it, to have it deleted, to object to processing, and to withdraw your consent at any time. Most of this you can do yourself in the app; for anything else, write to privacy@nitacon.ng. If you are not satisfied with our answer, you can complain to the Nigeria Data Protection Commission.

Changes

If we change this notice in a way that matters, we will ask you to read and agree to the new version the next time you sign in.