This Policy explains how we collect, use, disclose, and protect personal data on our websites, apps, VR/AR simulations, support channels, and events

We design for minors’ safety. Student experiences default to pseudonyms, restricted messaging, and educator oversight. Where schools onboard students, the school is generally the controller; BSSL is the processor. For direct-to-consumer products, BSSL is the controller and obtains verifiable parental/guardian consent where required.

• Account & Identity: name, email/username, role (student/teacher/school admin), school/ class, age band (not full DOB unless required by school).
• Learning Activity: simulations run, scores, badges, time-on-task, attempts, teacher feedback.
• Safety & Moderation: reports/blocks, message flags, moderation outcomes, incident logs (restricted access).
• Device & Usage: IP, device/browser, app version, telemetry, coarse location (for security/compliance).
• Support & Comms: tickets, emails, chat with our support teams.
• Events/Media (optional): photos/video at events with explicit consent.

We process personal data for:

• Provide & improve Services (performance of a contract, legitimate interest).
• Safeguarding & moderation (vital interests; substantial public interest; legitimate interests; legal obligation).
• Analytics & product safety (legitimate interests; data minimized/aggregated; k-anonymity thresholds).
• Legal compliance (legal obligation). Where consent is used, you may withdraw it at any time via settings or by contacting us.

Where we rely on legitimate interest, we balance it against your rights. Where required by law, we obtain consent.

We collect the minimum necessary. Typical retention:

• Learning data: academic year + configurable school window; deletion on contract end or request.
• Safeguarding logs: per legal requirement and case complexity (secure, restricted).
• Support tickets/billing: statutory retention.
• Backups are rotated; deletions propagate on the next cycle.

We may share data with:

• Schools/teachers (for classroom use/insight).
• Service Providers /Processors (hosting, logging, analytics, support )under NON-compliant DPAs.
• Authorities where legally required or to protect vital interests of a child.
• We do not sell personal data

We prefer Nigerian/regional data centers. If transfer occurs, we apply appropriate safeguards (standard contractual clauses or NDPR-recognized mechanisms) and record them in our DPIAs/Registers.

Encryption in transit/at rest, role-based access, MFA for staff, secure development practices, monitoring, and incident response. Production data is not used in lower environments without approved anonymisation.

Subject to exceptions, you may access, rectify, erase, restrict, object, and port your data. Parents/guardians may exercise rights for minors. Submit requests via privacy@[your-domain] or through your school administrator (if they are the controller). We will respond within the statutory period.

Submit requests e.g:nitag@[our-domain] or through your school administrator if they are the controller. We will respond within the statutory period.

We use essential cookies, preferences, analytics (with thresholds and IP truncation), and security cookies. See our Cookies Policy for details and choices.

We’ll post updates with a new effective date and, where material, notify users/schools.

You can contact us at hello@bluestemlabs.org

If unresolved, you may contact the Nigeria Data Protection Commission (NDPC).