Privacy Policy

Nitah (“Nitah”, “we”, “us”) is a learning and assessment service for Cambridge IGCSE subjects, provided to schools and used by their teachers and students at asknitah.com. This policy explains what personal data we collect, why, what we do with it, and the choices you and your school have. We have written it in plain English because students and parents should be able to read it — not only lawyers.

Nitah is a closed system: there is no open sign-up. Students can only join through a class code issued by their school, and their accounts are managed by their teacher. Schools decide who uses Nitah; we process students’ data to provide the service to their school.

1. The data we collect

Account data

• Students: the name entered when joining a class, a sign-in name Nitah generates (e.g. neo.molefe), a password (stored only as a secure hash — we cannot read it), and the school and class the account belongs to. We do not ask students for an email address or phone number.
• Teachers and school administrators: name, school email address, and a password (also stored only as a hash).

Learning data

• The maths working and answers a student types, the marks and feedback Nitah gives, hint usage, and confidence taps.
• Mastery records per syllabus topic, mistake cards and re-test schedules, and practice streaks.
• Assignments set by teachers and each student’s progress on them.

Conversations with Nitah

• Messages sent to the Ask Nitah study helper, and photos a student chooses to upload there. Photos are used to talk a question through — they are never marked and are visible to the student’s teachers.
• For safety, messages are screened for signs that a student may be at risk of harm. Such messages are shown to the school’s teachers so a real person can check in. Teachers can also review conversations for answer-fishing or misuse.

Technical data

• A single sign-in cookie that keeps you logged in for up to 12 hours. We use no advertising or analytics trackers.
• IP addresses, used only to protect sign-in and joining against abuse (rate limiting) and in standard server logs.
• Your device may hold a small local copy of unsent working and answers written while offline, so nothing you type is lost. That copy stays on your device until it syncs.

2. What we use it for

• To run the service: mark typed working, build each student’s mastery map and re-test schedule, and deliver assignments.
• To show teachers how their own class is doing — heatmaps, weekly class reports, and the working behind every number.
• To keep students safe: surfacing concerning messages to teachers, and letting teachers review chat use.
• To secure and improve the service: preventing abuse, fixing faults, and understanding aggregate usage. Where we look at numbers to improve Nitah, we use counts and rates, not browsing profiles of individual children.

We do not sell personal data. We do not show advertising. We do not build profiles for any purpose other than teaching and learning.

3. Automated marking and AI

Marking in Nitah is done by a deterministic rules engine that applies an examiner-style mark scheme — it is not a language model guessing. When the engine is not confident, it does not guess: the attempt goes to the student’s teacher to decide, and the student sees “Your teacher is checking this one.” Students can flag any marking they think is wrong, and teachers can overrule it.

Parts of the Ask Nitah chat may be processed by Anthropic’s Claude models, acting as our service provider, to generate replies. Under the commercial terms we use, that content is not used to train their models. If AI chat is not enabled for your school, conversations are handled entirely by Nitah’s own deterministic responses.

4. Who can see what

• Students see their own work, marks, mastery and conversations — never another student’s.
• Teachers see the work, marks, hint usage and Nitah conversations of students in their own school, so they can teach, safeguard and correct marking.
• School administrators can view school-level statistics and export or delete the school’s data.
• Nitah staff access personal data only when needed to operate, support or secure the service.

Every record in Nitah is partitioned by school. One school can never see another school’s data.

5. Service providers

We use a small number of providers to run Nitah, each processing data only on our instructions:

• Railway — application hosting and our database.
• Cloudflare — networking, content delivery and security in front of the service.
• Anthropic — AI replies in Ask Nitah, where enabled (see section 3).

These providers may store data on servers outside Botswana. Where data leaves Botswana, we take the safeguards required by the Botswana Data Protection Act, 2018.

6. How long we keep it

• Learning data is kept while the school’s Nitah account is active — the mastery map and mistake book only work because they remember.
• When a school leaves Nitah, its administrator can export everything as a single file and then permanently delete the school — every student, teacher, attempt, card and conversation. Deletion is immediate and has no undo.
• Individual corrections or deletions (for example, a student who leaves the school) are handled through the school — see section 8.
• Server logs and backups age out on a rolling basis.

7. Security

• All traffic is encrypted in transit (TLS). Passwords are stored only as bcrypt hashes.
• Access is role-based (student / teacher / admin), every request is checked against the signed-in role, and sessions expire after 12 hours — school devices are often shared.
• Sign-in and class-joining are rate-limited against guessing attacks. Temporary passwords issued by teachers expire in 72 hours and must be changed on first use.

No system is perfectly secure; if we become aware of a breach affecting personal data we will notify affected schools and, where required, the regulator, without undue delay.

8. Your rights

Under the Botswana Data Protection Act, 2018 (and equivalent laws where they apply), you have rights to access, correct and delete personal data, and to object to certain processing. Because student accounts are created and managed by schools:

• Students and parents/guardians: please ask the school first — teachers can correct names, reset access and remove a student from a class, and the school administrator can request full deletion. You may also contact us directly at pilot@asknitah.com and we will work with your school to resolve it.
• Schools: email pilot@asknitah.com, or use the export and deletion tools in the admin dashboard.

9. Children

Nitah is designed for school students, most of whom are under 18. That is exactly why the system is closed: children cannot sign up on their own, we collect no contact details from them, there is no advertising, no public profiles, and no student-to-student interaction. Schools authorise each student’s use of Nitah and are responsible for obtaining any parental consent their own policies or law require.

10. Changes to this policy

If we change this policy in a way that matters, we will tell schools directly and update the date at the top. The current version always lives at this address.

11. Contact

Questions, concerns or requests: pilot@asknitah.com. See also our Terms of Service.