Privacy Policy

1. Introduction & Welcome

THEBLACKNURSE provides community, study resources, and anonymous venting tools for students navigating academic life. Individuals and students of all backgrounds use our technology and services to access honest resources, connect with community, and release stress through our anonymous Venting Void.

This Privacy Policy ("Policy") describes the Personal Data that we collect, how we use and share it, and how you can reach us with privacy-related inquiries. The Policy also outlines your rights and choices as a data subject, including the right to object to certain uses of your Personal Data.

We are committed to protecting your privacy and ensuring compliance with applicable data protection laws, including the General Data Protection Regulation (GDPR), the Nigerian Data Protection Regulation (NDPR), and other international privacy standards.

2. Defined Terms

In this Policy, "THEBLACKNURSE," "we," "our," or "us" refers to THEBLACKNURSE and its associated services and platforms.

"Personal Data" refers to any information associated with an identified or identifiable individual, which can include data that you provide to us, and that we collect about you during your interaction with our Services.

"Services" refers to the products, services, devices, and applications that we provide, including our website, the Venting Void, contact forms, partner inquiry forms, newsletter services, and other THEBLACKNURSE applications and online services.

"Venting Void" refers to our anonymous venting feature where users can submit messages without providing any identifying information.

"Data Controllers" refers to THEBLACKNURSE as the entity that determines the purposes and means of processing Personal Data.

"Data Processors" refers to third-party service providers who process Personal Data on our behalf, such as Brevo (for email services) and Supabase (for database hosting).

3. Personal Data We Collect

We collect different types of Personal Data depending on how you interact with our Services:

Venting Void Submissions

The Venting Void is designed to be completely anonymous. We collect only:

• Message text — the content you submit
• Timestamp — when the message was submitted

We do not collect: IP addresses, email addresses, names, or any other identifying information. Venting Void submissions cannot be traced back to you.

Contact Forms

When you submit our contact form, we collect:

• Name — your provided name
• Purpose — the reason for your inquiry (e.g., General Inquiry, Book Support, Media Request)
• Message — the content of your message

We do not require email for contact submissions.

Partner Inquiry Forms

When organizations submit partnership inquiries, we collect:

• Organization name — the organization's name
• Organization type — type of organization (e.g., University, NGO, Investor)
• Contact name — the representative's name
• Email — the representative's work email
• Purpose — the reason for partnership inquiry
• Message — details about the partnership proposal

Newsletter Signups

When you subscribe to our newsletter, we collect:

• Email address — your email address for newsletter delivery
• Consent timestamp — when you agreed to the Privacy Policy
• Source page — where you signed up (e.g., home page)

Newsletter services are powered by Brevo, a third-party email service provider. Your email data is stored and processed by Brevo in accordance with their privacy policy.

Technical Data

We may collect limited technical data for service improvement and security:

• Device information — browser type, operating system
• Usage data — pages visited, time spent (aggregated, anonymized)

Note: We do not currently use cookies or tracking technologies for analytics or advertising purposes.

4. How We Use Personal Data

We use Personal Data for the following purposes:

• Venting Void: To store and display anonymous messages as intended by the feature design
• Contact forms: To respond to your inquiries and provide requested information
• Partner forms: To evaluate partnership opportunities and follow up on inquiries
• Newsletter: To send you occasional updates about study tools, workshops, and content (you can unsubscribe at any time)
• Service improvement: To analyze usage patterns and improve our Services (using anonymized, aggregated data)
• Security: To protect against fraud, abuse, and security threats
• Legal compliance: To comply with legal obligations and protect our rights

5. Legal Bases for Processing

Our legal bases for processing Personal Data depend on the type of data and processing activity:

• Consent: When you explicitly consent, such as newsletter signups and form submissions with privacy agreement checkboxes
• Legitimate interests: For service improvement, security, and fraud prevention (when your interests do not override ours)
• Contractual necessity: When processing is necessary to fulfill a service you've requested
• Legal obligation: When required by law (e.g., data retention requirements)

Under GDPR, we rely primarily on consent and legitimate interests. Under NDPR, we ensure similar compliance with Nigerian data protection principles.

6. Data Sharing & Third Parties

We share Personal Data with the following third-party service providers:

Brevo (Email Services)

We use Brevo to send newsletter emails. Your email address is stored in Brevo's systems. Brevo processes data in accordance with their privacy policy and may be located outside your country. We have appropriate agreements in place to protect your data.

Supabase (Database Hosting)

We use Supabase as our database hosting provider. Supabase stores form submissions, newsletter signups, and other data. Supabase processes data in accordance with their privacy policy and may be located outside your country.

External Services

When you leave our website to access third-party services (such as Selar for purchases), your data is governed by those services' privacy policies. We encourage you to review their privacy policies before providing personal information.

We do not sell your Personal Data to third parties for marketing purposes. We only share data as necessary to provide our Services or as required by law.

7. Your Rights & Choices

Depending on your jurisdiction, you may have the following rights regarding your Personal Data:

• Access: Request a copy of the Personal Data we hold about you
• Rectification: Request correction of inaccurate or incomplete Personal Data
• Deletion: Request deletion of your Personal Data (subject to legal retention requirements)
• Portability: Request transfer of your Personal Data to another service
• Objection: Object to certain processing activities, particularly those based on legitimate interests
• Restriction: Request restriction of processing in certain circumstances
• Withdraw consent: Withdraw consent at any time (e.g., unsubscribe from newsletter)

To exercise these rights, please contact us using the information provided in the "Contact Us" section below. We will respond to your request within the timeframes required by applicable law.

Newsletter unsubscribe: You can unsubscribe from our newsletter at any time by clicking the "unsubscribe" link in any email or by contacting us directly.

8. Security Measures

We implement appropriate technical and organizational measures to protect your Personal Data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and at rest
• Secure authentication and access controls
• Regular security assessments and updates
• Employee training on data protection
• Selection of reputable third-party service providers with strong security practices

However, no method of transmission over the internet is 100% secure. While we strive to protect your Personal Data, we cannot guarantee absolute security.

9. Data Retention

We retain Personal Data for different periods depending on the purpose:

• Venting Void messages: Retained indefinitely as part of the anonymous feature design (no identifying data)
• Contact and partner inquiries: Retained for 2 years from submission, or as long as necessary to resolve the inquiry
• Newsletter signups: Retained until you unsubscribe or request deletion
• Technical data: Retained in anonymized, aggregated form for service improvement

When Personal Data is no longer needed for its original purpose, we securely delete or anonymize it unless we are required by law to retain it.

10. International Data Transfers

Your Personal Data may be transferred to and processed in countries other than your country of residence. This includes transfers to:

• Brevo servers (may be located in the EU, US, or other regions)
• Supabase servers (may be located in the US or other regions)

When we transfer Personal Data to countries outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Compliance with GDPR requirements for international transfers
• Adequacy decisions where applicable

For transfers to and from Nigeria, we ensure compliance with NDPR requirements for cross-border data transfers.

11. Children's Privacy

Our Services are not directed to children under the age of 13. We do not knowingly collect Personal Data from children under 13. If we become aware that we have inadvertently collected Personal Data from a child under 13, we will take steps to delete such information immediately.

If you are a parent or guardian and believe your child has provided us with Personal Data, please contact us, and we will address the situation.

12. Nigerian Data Protection (NDPR)

In addition to GDPR compliance, we are committed to complying with the Nigerian Data Protection Regulation (NDPR). This includes:

• Obtaining valid consent before processing Personal Data
• Processing Personal Data only for specified, lawful purposes
• Ensuring data accuracy and relevance
• Implementing appropriate security measures
• Providing data subjects with rights to access, correct, and delete their data
• Conducting data protection impact assessments where required
• Ensuring lawful cross-border data transfers

If you believe our processing of your Personal Data violates NDPR requirements, you have the right to lodge a complaint with the National Information Technology Development Agency (NITDA) or contact us directly.

13. Cookies & Tracking

We do not currently use cookies or similar tracking technologies for analytics, advertising, or personalization purposes. We may use essential cookies for basic website functionality in the future, but we will notify you and obtain consent where required by law.

If we implement cookies or tracking technologies in the future, we will update this Policy to provide detailed information about their use and your choices.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or other factors. We will notify you of material changes by:

• Posting the updated Policy on our website with a new "Last updated" date
• Sending an email notification to newsletter subscribers (for significant changes)
• Displaying a prominent notice on our website

Your continued use of our Services after the effective date of the updated Policy constitutes acceptance of the changes.

15. Contact Us

If you have questions about this Privacy Policy, our data practices, or your rights as a data subject, please contact us:

• Email: blacknursethe1@gmail.com
• Website: www.blacknurse.ng

For GDPR-related inquiries from EU residents, or NDPR-related inquiries from Nigeria, we will respond within the timeframes required by applicable law.

If you believe our processing of your Personal Data violates applicable data protection laws, you also have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction.