Privacy Policy.

Information We Collect

Koinivo is operated under the registered business name Koinivo Campus Technologies. This Policy covers our website, First Wave registration and dashboard, and Koinivo app features made available to you. First Wave Marketing and the main application use separate Supabase projects.

Student First Wave registration collects your name, email, optional referral code, email-verification status, referral attribution, optional marketing choice, and information needed to manage dashboard access. Vendor interest registration can collect representative and business names, email, optional phone, campus, service category, description and Instagram handle. Student-body interest registration can collect representative name, email, optional phone, selected organization and claimed role.

Where app features are available, information may include profile and academic identity, organization membership and roles, dues and clearance records, event and ticket records, payment references, content or media you share, messages, and safety reports. The categories depend on what you use. We also process limited request and device information for security and service operation.

How We Use Information

We use information to process requested registrations, verify email, provide secure dashboard or app access, attribute eligible referrals, evaluate interest from vendors and student bodies, operate available community, organization, event, dues and payment features, respond to requests, and prevent abuse.

The lawful basis depends on the purpose. Taking steps you request and providing an available service may support registration and service processing. Security and fraud prevention may rely on legitimate interests assessed against your rights. Some records may be needed for legal obligations or claims. Optional promotional marketing relies on your affirmative consent and is separate from verification or login messages.

Email Verification

First Wave can send a verification link and, for eligible verified students, a dashboard login link to the submitted email. Token hashes are stored server-side. Dashboard sessions can expire or be revoked. An email verification confirms access to an address; it does not establish academic identity. First Wave dashboard access is separate from main-app authentication.

Referral Attribution & Privacy

A valid referral code may be held in your browser and sent with a student registration. We record the relationship between a referrer and a referred registration and count only eligible verified referrals. We may invalidate abuse or ineligible attribution. A referral code alone does not reveal a referrer’s identity or grant dashboard access.

We use rate limits and pseudonymous request identifiers, including a hash derived from an IP address, to limit misuse. Such identifiers can still be personal data in context. Reaching a referral milestone does not automatically issue a physical reward.

Optional Marketing Consent

Student and vendor choices about promotional messages are separate from the information needed to process an interest request. Declining promotional messages does not prevent registration or necessary verification and login messages. We record students’ affirmative marketing choice separately.

You may withdraw marketing consent at any time by emailing privacy@koinivo.com. We will stop future promotional processing based on that consent after handling the request. Withdrawal does not affect processing that was lawful before it. You may separately request access, correction or deletion of your information through the same address.

Third-Party Service Providers

Koinivo Campus Technologies uses Supabase for its separate First Wave and application data services, Vercel to host the First Wave website and server functions, and Resend to deliver configured First Wave emails. Cloudflare routes messages sent to our business contact addresses to an inbox operated through Google/Gmail. Paystack processes information for supported Koinivo application payment flows when those flows are used; First Wave registration itself does not require a Paystack payment. We share information with each provider as needed for its role. Other users, authorized organization leaders or event organizers may see information relevant to a feature you use and its audience. We may disclose information when required by law or to protect people and service security.

The First Wave Marketing Supabase database is hosted in Zurich, Switzerland, and the main application Supabase database is hosted in Ireland. These database locations do not mean all processing stays in those regions. Our providers and their subprocessors may process or access information outside Nigeria. For information about locations and transfer arrangements relevant to your information, contact privacy@koinivo.com.

Data Retention

We keep First Wave student registration and referral information while needed to administer the waitlist and referrals. We keep vendor and student-body interest information while assessing and following up on those requests. We keep consent and opt-out information while needed to respect and demonstrate a person’s choice. Authentication, email-delivery and security records are kept while needed to operate and protect the service. A legal obligation, dispute or claim may require longer retention for a particular record.

We review First Wave Marketing records manually each month and again when First Wave closes to assess whether they are still needed. Verification and login links and dashboard sessions stop being usable after their applicable expiry periods; expiry does not itself remove stored records. We do not have an automatic deletion schedule covering every category of First Wave or application data.

You may request deletion or anonymization at privacy@koinivo.com. The founder currently handles privacy requests manually, including reviewing linked records and any lawful reason to retain information. We may need to verify your identity before acting and will explain any applicable limit on a request.

Security Practices

The reviewed workflows use controls such as row-level database access policies, server-side Marketing credentials, token hashing, time-limited sessions and rate limits. No internet service can guarantee absolute security. Koinivo investigates and responds to incidents as applicable law requires.

Data-Subject Rights

Subject to applicable law, you may ask whether we process your information, request access or correction, seek erasure or restriction, object to processing, withdraw consent, and complain to the Nigeria Data Protection Commission. Rights concerning portability and automated decisions apply where the law provides. We may need to verify your identity before acting and may explain lawful limits on a request.

Marketing withdrawal is separate from deleting a registration or app account. The Commission provides information about privacy rights at ndpc.gov.ng.

Cookies & Local Storage

First Wave uses session storage and a first-party referral cookie, which can last up to 30 days, to retain a valid referral code. Its dashboard uses a first-party authentication cookie with a maximum age of seven days. Browser controls can clear or block storage, although doing so may interrupt those functions. The audited Marketing code did not establish a third-party advertising or analytics cookie.

Initial student First Wave registration is for people aged 18 or older. We ask for confirmation, not a date of birth. If we learn that a child’s information was collected without any authorization required by law, we will assess and address it.

Changes to this Policy

Effective date: November 5, 2026.

We may update this Policy when our services or practices change. We will show the effective date of the current version and communicate material changes where required by law or appropriate to their effect. An update does not remove rights that apply to information already collected.