Alphalock Ltd
Privacy policy
Draft, reviewed for accuracy against how the platform actually works, not yet reviewed by counsel. Last updated 22 August 2026.
Boardmak LMS is operated by Alphalock Ltd ("Alphalock", "we", "us"), a company registered in Nigeria. This policy explains what personal data we collect through the platform, why, and what you can do about it. It applies to everyone who uses Boardmak LMS, whether you were assigned a course by your employer or signed up directly.
What we collect
Account and enrolment data: your name and email address, whether provided by you directly or by your employer/organisation when they enrol you in a course.
Course activity: which lessons you have viewed, exam answers and scores, and completion status. This is what makes a completion record meaningful.
Payment records: if you pay for a course directly, payment is handled entirely by Paystack. We never receive or store your card details, only confirmation that a payment succeeded, its amount, and a transaction reference.
Administrative action logs: for organisations we manage directly, we keep a record of administrative actions (invitations sent, records reset, organisation settings changed) for audit purposes.
Points and badges: if you complete courses, we record points earned and badges awarded against your email, and any reward you redeem points for. Unlike a completion record, this is not kept permanently and is deleted along with your account on request.
What we do not do
We do not run advertising, do not sell personal data, and do not use third-party tracking or analytics cookies. The only cookies this platform sets are the ones that keep you signed in.
Who else sees it
Paystack processes payments on our behalf for paid courses. Supabase hosts our database and handles authentication (the one-time sign-in codes you receive by email). Neither is authorised to use your data for their own purposes. If your course was assigned by an employer or another organisation, that organisation's administrators can see your name, email, and progress on courses they assigned you, which is inherent to how employer-assigned training works.
Verification records
If a course issues a certificate, we create a public verification record, reachable only if someone already has the certificate number or record ID printed on it, showing your name, the course, and completion date. This exists specifically so a third party (an employer checking a certificate, an auditor) can confirm a certificate is genuine. It never shows your email, your organisation, or your score.
How long we keep it
Completion records and administrative audit logs are kept permanently and cannot be edited or deleted, by design. This is what makes a completion record trustworthy for compliance and audit purposes; a record that could quietly be altered or removed later would not be worth much as proof of anything. Other account data is kept for as long as your account is active, or as long as your organisation's contract requires.
Your rights
Under Nigeria's Data Protection Act, you can see what personal data we hold about you, ask us to correct inaccurate data, object to certain uses of it, or ask us to delete your account. If you are signed in, Your data lets you download everything tied to your account immediately, and submit any of these requests directly. A person reviews every request, so it is not instant. Because completion records and audit logs exist specifically to be a permanent, tamper-evident record, we cannot alter or delete those even on request, but everything else, we can. You can also contact us directly (below) instead.
Changes to this policy
If this policy changes in a way that affects how we handle your data, we will update the date at the top of this page.
Contact
Questions about this policy or your data: contact@alphalockltd.com.