Privacy Policy

1. Who is responsible for your data

PxLabs, operating from Lagos, Nigeria, is the data controller for pxlabs.space. Contact for anything privacy-related: [email protected].

This policy is effective from 30 July 2026 and covers the PxLabs site, courses, and community.

2. What we collect

Account: your name, email address and profile picture, provided by Google when you sign in. We do not see your Google password.

Course registration: your name, email, and WhatsApp number, so we can enrol you and add you to the class group.

Payments: the Paystack payment reference, amount, payment channel and the email you paid with. Card numbers never touch our servers — Paystack processes them.

Community: your membership status, and any posts you write in the forum. The forum is text-only; the platform does not accept file uploads from users.

Enquiries: whatever you submit through the business, enterprise, or Vibe Session forms — again, text only.

Analytics: aggregate page-view counts via Vercel Analytics, which is cookieless and does not build a profile of you.

3. What we deliberately do not collect

No card or bank details — Paystack handles payment data end to end.

No file or image uploads from users — the platform is text-only by design.

No advertising trackers, no third-party ad cookies, no cross-site tracking.

No precise location. Meet-up venues are places we announce, not places we track you to.

4. Why we use your data

To provide what you signed up for: confirming enrolment automatically after payment, granting membership, showing your posts, and answering your enquiries.

To send transactional email — payment confirmations, course access, class group invites. We do not run marketing email lists off your signup.

To keep the platform safe: moderating the forum and preventing abuse or fraudulent payments.

To understand what content is useful, using aggregate, anonymous page-view counts.

5. We do not sell your data

We do not sell, rent, or trade your personal data to third parties. We do not share it with advertisers. We do not use it to target you with ads. This is a promise, not a preference — the platform is funded by courses and memberships, not by your data.

6. Who we share data with

We use a small set of service providers to run the platform, each receiving only what their job requires: Supabase (account and database hosting), Paystack (payment processing), Vercel (site hosting and cookieless analytics), and Google (sign-in).

Embedded media — lesson videos on YouTube, workbooks and reels on Google Drive — is served by Google. When you play or open embedded media, Google may set its own cookies under its own privacy policy.

Class groups run on WhatsApp or Telegram. Joining one is your choice, and those platforms’ own policies apply there.

We will disclose data if lawfully required to — for example by a court order — and will tell you when we are allowed to.

7. Legal bases

Under the Nigeria Data Protection Act 2023, we process your data on the basis of: contract (running the courses and membership you paid for), legitimate interests (keeping the platform safe and understanding aggregate usage), and consent (where you choose to sign in, post, or submit a form).

8. How long we keep it

Your account and posts: until you delete them or ask us to.

Payment records: for as long as tax and accounting law requires us to keep them.

Enquiries: for as long as the conversation is live, then archived or deleted.

9. Your rights

You can ask us for a copy of your data, ask us to correct it, ask us to delete it, or object to how we use it. Email us and we will act on it — deletion requests are honoured except where the law requires us to keep something (such as payment records).

If you believe we have mishandled your data, you can complain to the Nigeria Data Protection Commission (NDPC). We would rather you told us first so we can fix it.

10. Security

All traffic to the site is encrypted (HTTPS). Database access is controlled with row-level security — for example, payment records are readable only by administrators, and can only be written by our payment-verification server after Paystack cryptographically signs the transaction.

No system is perfectly secure; if a breach affects your data, we will tell you promptly.

11. International transfers

Our service providers (Supabase, Vercel, Google, Paystack) may store or process data on servers outside Nigeria. Each operates a recognised data-protection compliance programme, and we only send them the minimum described in section 6.

12. Children

The platform is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will remove it.

13. Changes to this policy

If we change how we handle data, we will update this page and its effective date, and flag material changes on the site. We will never quietly add data selling — see section 5.

14. Contact

Privacy questions and data requests: [email protected].