Who is responsible for your data
FirstVersion is operated by Prysm AI Technologies Ltd (RC 9444284), based in Uyo, Akwa Ibom State, Nigeria. Prysm AI Technologies Ltd is the data controller for the FirstVersion website, cohort applications, programmes and companion software. Questions and privacy requests may be sent to privacy@prysmai.io.
This notice applies to applicants, participants, parents and guardians, facilitators, website visitors and people who contact us. A third-party website or tool has its own privacy terms when you leave FirstVersion.
Information we collect
- Applications: name, email, optional phone number, city and country, age group, house choice, project idea, six-week goal, application code and, for an applicant under 18, parent or guardian name and email.
- Partnership enquiries: organisation type and name, contact person and role, email, phone number, intended learners, location, timing, available resources, delivery preference, enquiry code and messages exchanged with the AI programme planner.
- Accounts and family registration: parent and student names, emails, grade, cohort, password hash, consent choices and account activity. We do not store readable passwords.
- Programme records: attendance, module progress, assessment attempts and answers, reflections, project reviews, completion evidence, certificates, support messages and parent digests.
- Optional AI tutor: messages sent to the tutor, its replies, the learning module used as context and the parent's AI-consent status.
- Security and technical data: the necessary login cookie, hashed identifiers used to limit abusive requests, and ordinary hosting or error logs such as time, device/browser information and IP address.
We receive most information directly from an applicant, parent or participant. Facilitators may add attendance and project records, and the service creates security and progress records when it is used. Please do not submit passwords, financial details, health information, home addresses or other sensitive data in an idea, reflection or AI message.
Why we use it
We process personal data only for stated purposes and on an applicable lawful basis:
- to receive and review an application and take steps requested before enrolment;
- to review a school or organisation's proposed programme, provide AI-assisted planning, prepare for human follow-up and take requested steps before a partnership agreement;
- to create accounts, deliver the programme, support participants, assess work and issue completion evidence under our programme agreement;
- with consent, to process a child's data, enable the optional AI tutor, or publish identifiable participant work;
- for our legitimate interests in securing, administering and improving FirstVersion, where those interests do not override a person's rights; and
- to meet legal, safeguarding, accounting, complaint-handling or regulatory obligations.
Admissions are reviewed by people. We do not use AI or solely automated decision-making to accept or reject a cohort application or approve a partnership.
Applicants and participants under 18
Under Nigerian data-protection law, a parent or legal guardian must authorize the processing of a child's personal data. An application for a person under 18 must therefore be reviewed and submitted by the named parent or guardian. We collect the applicant's age group and guardian contact to support age and authority checks, and we may ask for further confirmation before admission or platform access. We do not ask for government identity documents during the initial application.
A parent or guardian can exercise the child's privacy rights. Public posting, photography, recordings, testimonials and use of identifiable work require a separate choice; they are not a condition of applying.
Application graphics and public sharing
After submission, the browser can create a graphic containing the applicant's name, house, cohort date and application code. The image is produced on the applicant's device. Downloading or sharing it is optional. The code is a receipt reference—not proof of acceptance—and applicants should avoid posting it if they prefer to keep their application private.
Who processes information for us
We do not sell personal data. Authorized FirstVersion personnel, facilitators and a partner school may receive only what they need to administer a relevant cohort. Essential technology providers currently include Vercel for hosting, Turso/libSQL for the database, Resend for email and Groq for optional tutor and programme-planner responses. The planner receives the submitted programme outline and recent conversation, but not the contact's email address or phone number. These providers act under their contracts and their own security obligations. We may also disclose information when lawfully required, to protect a person from harm, or as part of a properly safeguarded business reorganisation.
Some providers process data outside Nigeria. Where personal data is transferred internationally, we use a lawful transfer basis and assess appropriate contractual, organisational and technical safeguards as required by the Nigeria Data Protection Act.
Cookies and security
FirstVersion currently uses one necessary, HTTP-only login cookie that normally expires after seven days. We do not currently use advertising or behavioural-tracking cookies. We use HTTPS, password hashing, hashed session tokens, access controls, rate limits and restricted administrative access. No online system is completely risk-free; if a breach is likely to create a high risk, we will notify affected people and the Nigeria Data Protection Commission where the law requires it.
How long we keep information
Our normal retention baselines are:
- unsuccessful or withdrawn cohort applications: up to 12 months after the relevant cohort begins;
- partnership enquiries and programme-planner conversations: up to 24 months after the last contact, unless an agreement or legal obligation requires a different period;
- participant accounts, consent and core learning/completion records: up to three years after the last programme activity;
- AI tutor conversations: up to 12 months after the participant's cohort ends; and
- short-lived login and abuse-prevention records: only for their security purpose.
We may keep a minimal record longer when required for tax, legal claims, safeguarding, fraud prevention or certificate verification. Backups are protected and removed on their normal rotation. When a retention period ends, data is deleted or anonymised unless a lawful reason requires it to remain.
Your rights
Subject to applicable law, you may ask to be informed about processing; access, correct or delete data; restrict or object to processing; receive portable data; withdraw consent; and request human review of a significant automated decision. Withdrawal does not invalidate processing that was lawful before withdrawal, and some records may have to be retained.
Send a request to privacy@prysmai.io. We may verify identity and authority before acting. You may also complain to the Nigeria Data Protection Commission.
Changes to this notice
We will place a new effective date on this page when the notice changes. We will give additional notice, and obtain fresh consent where required, before a material change affects children's data, optional AI use or a new incompatible purpose. This notice explains our practices and does not reduce any right provided by law.