Privacy Policy

Last updated: August 22, 2026

1. Introduction

Hemistich ("we," "our," or "us") is a student utility service designed for African tertiary students. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use Hemistich, whether through our WhatsApp bot, our website, our web app, or our mobile app.

By using Hemistich, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Information You Provide

  • WhatsApp Phone Number: Your phone number is collected automatically when you message our bot.
  • Messages and Content: Text messages, documents (PDFs), and images you send to the bot for processing.
  • Academic Data: Course information, grades, and GPA data you provide for calculations.
  • Reminders: Reminder content and scheduling information you set.
  • Resources: Files and materials you choose to save in your resource vault.

2.2 Information Collected Automatically

  • Usage Data: How you interact with the service, including commands used, features opened, and frequency of use.
  • Timestamps: When you send messages and interact with the service.
  • Message Metadata: Message type (text, image, document) and file sizes.
  • Device and Browser Information: On the website and apps, the browser and device type, screen size, and operating system.
  • Approximate Location: We derive your country from your IP address so that we can show and charge prices in your local currency. We do not collect GPS or precise location.
  • Pages and Screens Viewed: Which pages of the website and app you visit, and in what order.
  • Session Recordings: On the web app, a recording of your on-screen interactions. What is and is not recorded is described in section 5.

3. How We Use Your Information

We use the information we collect to:

  • Provide and maintain our service (summarize documents, calculate GPA, send reminders, etc.)
  • Process and respond to your requests
  • Store your resources and academic data for future retrieval
  • Improve and optimize our service
  • Send you reminders you have set
  • Detect and prevent spam or abuse
  • Comply with legal obligations

4. Third-Party Services

We use the following third-party services to operate Hemistich:

  • Meta (WhatsApp Cloud API): For message delivery and receiving. Subject to WhatsApp's Privacy Policy.
  • Google (Gemini AI): For AI-powered features like summarization, quiz generation, and flashcards. Your content is processed but not stored by Google for model training.
  • Supabase: For secure data storage and file hosting.
  • Amazon Web Services (AWS): For application (server) hosting on a private virtual server.
  • PostHog: For product analytics and session recording on our web app, so we can see which features are used and find broken screens. Subject to PostHog's Privacy Policy. See section 5.
  • Paystack: For processing payments. We do not store your full card details.

5. Product Analytics and Session Recording

On our web app we use PostHog to understand how the product is actually used, so we can fix what is broken and improve what is useful. This applies to the web app only. It is not used on the WhatsApp bot, and it is not included in our mobile app.

5.1 What we record

  • Pages and screens you open, and the order you move through them.
  • Clicks and taps on buttons, links, and menus.
  • Account events such as signing up, confirming your email, and signing in.
  • Errors and failed requests, so we can find out when the service is broken before you have to tell us.
  • A replay of your on-screen interactions, subject to the exclusions in 5.2.

5.2 What we deliberately do not record

We built specific exclusions into the app because your schoolwork is yours. The following never leaves your device as part of analytics or a session recording:

  • Your questions and our AI's answers. Chat messages and all AI-generated output are excluded at source.
  • Anything you type into a form. All input fields are masked, including your email address, password, and verification codes.
  • The contents of requests to our servers, which is where your questions and answers travel.
  • Your name, email address, and phone number. Analytics identifies your account by its internal ID only. We attach your plan, country, and course details so we can compare how different groups use the product, but not information that names you.
  • Anything in a web link. We strip everything after the page address, so codes carried in links are not recorded.

These exclusions are applied in your browser, which means the excluded content is never transmitted to us or to PostHog, rather than being sent and then hidden.

5.3 Why we do this

Our lawful basis is legitimate interests: operating, securing, and improving the service. We have limited what is collected so that this interest does not override your privacy, as described in 5.2.

5.4 Your choice

You can opt out of analytics and session recording at any time by enabling "Do Not Track" in your browser settings, or by contacting us at privacy@hemistich.com and asking us to exclude your account. Opting out does not affect your access to any feature. Most ad and tracker blockers also stop this collection.

6. Data Storage and Security

Your data is stored securely using Supabase's infrastructure with the following measures:

  • Encrypted data transmission (HTTPS/TLS)
  • Row-level security on database tables
  • Temporary files are automatically deleted after 24 hours
  • Access controls and authentication for all data access

7. Data Retention

  • Account Data: Retained as long as you use the service. When you delete your account it is closed immediately, and your data is kept for a 30-day grace period so an accidental deletion can be undone, then erased permanently. See our Data Deletion page.
  • Messages: Processed in real-time and not permanently stored (only AI cache for common queries).
  • Resources: Stored until you delete them or request account deletion.
  • Temporary Files: Automatically deleted after 24 hours.
  • Usage Analytics: Aggregated and anonymized after 90 days.
  • Session Recordings and Analytics Events: Held by PostHog for a limited retention period and then deleted automatically. We do not keep separate copies.

8. Your Rights

You have the right to:

  • Access: Request a copy of your personal data.
  • Deletion: Request deletion of all your data. See our Data Deletion page for instructions.
  • Correction: Request correction of inaccurate data.
  • Portability: Request your data in a portable format.
  • Objection: Object to certain processing of your data.

9. Children's Privacy

Hemistich is designed for tertiary (university/college) students. We do not knowingly collect information from children under 16. If you believe a child under 16 has provided us with personal information, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of any material changes through the WhatsApp bot and in the app. Your continued use of the service after changes constitutes acceptance of the updated policy.

11. Legal Basis & Compliance (NDPA 2023 & GDPR)

Hemistich is operated from Nigeria and serves students in Nigeria and, increasingly, worldwide. We aim to comply with the Nigeria Data Protection Act (NDPA) 2023 and to follow the core principles of the EU General Data Protection Regulation (GDPR), regardless of where you are located.

11.1 Principles we follow

  • We process personal data lawfully, fairly, and transparently.
  • We collect only what we need for the purposes described in this policy (data minimization).
  • We keep data only as long as necessary, then delete or anonymize it.
  • We apply reasonable technical and organizational measures to keep data secure.

11.2 Lawful bases for processing

  • Performance of a contract: to deliver the features you ask for.
  • Consent: where required, for example for optional communications. You can withdraw consent at any time.
  • Legitimate interests: to operate, secure, and improve the service, balanced against your rights.
  • Legal obligation: where the law requires us to process or retain data.

11.3 Your rights

Subject to applicable law, you may request access to, correction of, deletion of, or a portable copy of your data, and you may object to or restrict certain processing. To exercise any right, contact us (section 12) or use our Data Deletion page. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) or your local data-protection authority.

11.4 International transfers

Some of our service providers (for example, Meta, Google, Supabase, AWS, and PostHog) may process data on servers outside your country. Where data is transferred across borders, we rely on the providers' safeguards and applicable legal mechanisms to protect it.

12. Contact Us

If you have questions about this Privacy Policy or your data, contact us:

  • WhatsApp: Message our bot and type /help
  • Email: privacy@hemistich.com