Litu Privacy Policy

Effective date: Oct 27, 2026

1. Introduction and Scope

This Privacy Policy explains how RMN Labs (operating the Litu visual-first AI tutoring product, referred to as "Litu," "we," "us," or "our") collects, uses, discloses, and protects information when a student, parent, guardian, teacher, or school ("you" or "User") uses the Litu website, mobile application, or related services (the "Service").

Litu is a visual-first AI tutoring product: students primarily learn through visual content and interaction, with spoken/voice interaction offered as an additional feature of the platform. Because students may include minors, this Policy pays particular attention to how we handle children's information; see Section 3 below.

This Policy is written to comply with the Nigeria Data Protection Act 2023 ("NDPA") and the regulations and guidance issued by the Nigeria Data Protection Commission ("NDPC"), our primary legal framework as a business operating out of Abuja, Nigeria. Because Litu may be used by people outside Nigeria, we also describe our practices consistent with common international data protection principles, including the EU General Data Protection Regulation ("GDPR") and other widely recognized privacy frameworks, so users in other jurisdictions have a clear picture of their rights.

By creating an account or using the Service, you agree to the collection and use of information as described in this Policy. If you are a parent or guardian registering a child, your acceptance of this Policy is made on behalf of yourself and your child.

2. Information We Collect

We collect the following categories of information:

Account and profile information. Name, email address, phone number, date of birth or age range, school or grade level, parent/guardian name and contact details (for accounts belonging to a minor), and login credentials.

Voice and audio data. Where a student uses Litu's voice features, we record and process spoken audio when a student speaks with the AI tutor, including the audio itself, automatically generated transcripts, and derived data such as pronunciation, fluency, or comprehension signals used to personalize tutoring.

Photos of questions. A student can photograph or upload a picture of a maths question instead of typing it. The picture is sent to Alibaba Cloud Model Studio, an AI model provider, only so that the question and any diagram in it can be read. Litu does not store or log the picture itself: it is discarded once it has been read. The question text read from it, and the diagram as it is redrawn on the board, become part of the lesson in the same way as a typed question, and are handled as learning data below. Photos are chosen by the student through the device's own camera or file picker; Litu does not access the camera directly.

Learning and usage data. Lessons completed, subjects studied, answers given, performance and progress metrics, session length, time and frequency of use, and feedback submitted through the Service.

Device and technical data. IP address, device type and identifiers, operating system, browser type, mobile network information, and general location (such as city or region) inferred from IP address. We also record how you arrived at Litu, such as the website, search engine or AI assistant that linked to us, so we can understand which sources bring students to the Service.

Payment information. If you buy credits, our payment processor, Paystack, collects billing details such as card or bank information; Litu itself does not store full card numbers. We send Paystack your account's email address (for the receipt) and keep a record of each purchase: the amount, the credits it bought, the date, and the type of payment method (for example card or bank transfer).

Communications. Messages you send us through support channels, surveys, or feedback forms.

3. Children's Privacy and Parental Consent

Litu is designed for use by students, some of whom are under the age of 18. We take children's privacy seriously and process children's personal data, including voice recordings, only in the following ways:

Parental or guardian consent. Where a student is a minor, an account may only be created and used with the involvement and consent of a parent or legal guardian, or through a school that has obtained the necessary consents on parents' behalf. The parent or guardian is responsible for reviewing this Policy and our Terms of Service before allowing a child to use Litu.

What we collect from children. We limit data collected from children to what is reasonably necessary to provide tutoring: voice recordings and transcripts of tutoring sessions, learning progress, and basic account information. We do not knowingly use children's data for third-party advertising or behavioral targeting.

Parental rights. A parent or guardian may, at any time, request to review the personal data we hold about their child, request corrections, request deletion of the child's account and associated data, or withdraw consent for further collection, by contacting us using the details in Section 13. Withdrawing consent may limit or end the child's access to the Service.

No public sharing. Children's voice recordings, transcripts, and profile information are not made publicly visible and are not shared with other students.

If we learn that a child's account was created without the required parental or guardian consent, we will take steps to suspend the account and delete the associated data, unless retention is required by law.

4. How We Use Information

We use the information described above to:

• Provide, operate, and maintain the Service, including running voice-based tutoring sessions and generating spoken and written responses;
• Personalize learning content, pacing, and feedback based on a student's progress and performance;
• Convert speech to text and text to speech using our own systems and/or third-party AI and speech-processing providers, in order to power the tutoring experience;
• Monitor, evaluate, and improve the accuracy and quality of our AI tutor, including reviewing anonymized or aggregated samples of interactions;
• Communicate with users and parents/guardians about accounts, updates, and support;
• Process payments for credits and keep records of purchases;
• Detect, investigate, and prevent misuse, fraud, or security incidents;
• Comply with legal obligations, including those under the NDPA.

We do not use children's voice or learning data to build advertising profiles, and we do not sell personal data to third parties.

5. Legal Basis for Processing

Under the NDPA and comparable international frameworks, we rely on the following legal bases to process personal data:

Consent. For creating an account, processing a child's data, and for optional features such as marketing communications, we rely on the consent of the user or, for minors, their parent or guardian. Consent may be withdrawn at any time, without affecting the lawfulness of processing carried out before withdrawal.

Performance of a contract. To provide the tutoring service you or your school has signed up for, including account management and billing.

Legitimate interests. To secure the Service, prevent fraud and abuse, and improve our AI tutor, balanced against your rights and interests; we do not rely on legitimate interests for processing that primarily benefits Litu at the expense of a child's privacy.

Legal obligation. Where processing is required to comply with Nigerian law, a court order, or a lawful request from the NDPC or another authority.

6. How We Share Information

We do not sell personal data. We share information only in the following circumstances:

Service providers. With vendors who help us operate the Service, such as cloud hosting providers, speech-to-text and text-to-speech / AI model providers, payment processors (Paystack), customer support tools, and analytics providers (PostHog, for product analytics). These providers are contractually required to protect the data and to use it only to provide services to us. For example, photos of questions are sent to Alibaba Cloud Model Studio to be read (see Section 2).

Photos on the board. To show a real example, the tutor can put an openly licensed photo on the board, with its author and licence written underneath. Litu finds it by searching Wikimedia Commons and Openverse with a few topic words only (for example "early blight tomato"), never anything about the student. The student's device then loads that photo directly from Wikimedia or Openverse, which can see the device's IP address, as with any web page that shows their images.

Schools and parents/guardians. Where a student is enrolled through a school, we may share progress reports and relevant account data with the school and with the student's parent or guardian.

Legal and safety reasons. Where required by law, regulation, court order, or a lawful request from the NDPC or another competent authority, or where we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Litu, our users, or the public.

Business transfers. If Litu, RMN Labs, or substantially all of the relevant assets are involved in a merger, acquisition, financing, or sale, personal data may be transferred as part of that transaction, subject to this Policy or a policy offering at least equivalent protections.

We require any third party we share data with to implement appropriate technical and organizational safeguards.

7. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including:

Account information: for as long as the account is active, and for a limited period afterward to allow reactivation and to comply with legal, accounting, or dispute-resolution obligations.

Voice recordings and transcripts: retained for a limited period to support tutoring continuity and quality review, after which they are deleted or anonymized, unless a longer period is needed for safety, legal, or dispute-resolution reasons, or a parent/guardian has requested earlier deletion.

Photos of questions: not retained by Litu. A photo is used only to read the question and is discarded once it has been read; the question text read from it is kept as learning data.

Payment records: retained as required by applicable tax, accounting, and financial regulations.

When data is no longer needed, we securely delete or anonymize it so it can no longer be linked to an individual.

8. Data Security

We use administrative, technical, and physical safeguards designed to protect personal data against unauthorized access, alteration, disclosure, or destruction, including encryption of data in transit, access controls limiting who can view voice recordings and account data, and regular review of our security practices.

No method of transmission or storage is completely secure. If we become aware of a data breach affecting personal data in a way that creates a real risk of harm, we will notify affected users and, where required, the NDPC, in accordance with the NDPA's breach-notification requirements and within the timelines those rules set out.

9. Your Rights

Subject to applicable law, you (or, for a minor, their parent or guardian) have the right to:

• Access a copy of the personal data we hold about you or your child;
• Correct inaccurate or incomplete personal data;
• Request deletion of personal data, including voice recordings and transcripts, subject to limited exceptions such as legal retention requirements;
• Restrict or object to certain processing, including processing based on legitimate interests;
• Request a portable copy of certain data in a structured, commonly used format;
• Withdraw consent at any time where processing is based on consent, without affecting processing already carried out;
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC) or another applicable supervisory authority if you believe your data protection rights have been violated.

To exercise any of these rights, contact us using the details in Section 13. We will respond within the time limits set by the NDPA and may need to verify your identity, or a parent/guardian's authority over a child's account, before acting on a request.

10. International Data Transfers

We are based in Abuja, Nigeria, but may use service providers, cloud infrastructure, and AI/speech-processing vendors located outside Nigeria to operate the Service. Where personal data is transferred outside Nigeria, we take steps required by the NDPA to ensure an adequate level of protection, such as using providers in jurisdictions recognized as offering adequate protection, entering into contractual safeguards (such as standard contractual clauses), or relying on another lawful transfer mechanism recognized by the NDPC.

11. Cookies and Tracking Technologies

Our website and app may use cookies, local storage, and similar technologies to keep you signed in, remember preferences, understand how the Service is used, and improve performance. These may include essential technologies needed for the Service to function and, where applicable, analytics technologies that help us understand usage patterns.

We honour Global Privacy Control: if your browser sends this signal, Litu collects no analytics.

We do not use tracking technologies to serve behavioral advertising to children. Where required by law, we will provide a cookie banner or in-app setting allowing you to manage non-essential cookies. You can also control cookies through your browser or device settings, though disabling essential cookies may affect how the Service works.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. If we make material changes, especially any that affect how we handle children's data, we will notify users and, where applicable, parents or guardians, by email or through a prominent notice in the Service before the changes take effect. The "Effective date" at the top of this Policy shows when it was last updated. Continued use of the Service after changes take effect means you accept the revised Policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or how we handle personal data, including a child's data, please contact us at:

RMN Labs (Litu)
Abuja, Nigeria
Email: [insert privacy contact email, e.g. privacy@litu.app]
Data Protection Contact: [insert name/role if a Data Protection Officer or compliance officer has been designated]

If you are not satisfied with our response, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC) or the data protection authority in your own country of residence.

This Privacy Policy is a draft prepared for RMN Labs / Litu and has not been reviewed by a licensed attorney. Given that the Service processes voice data and children's personal data, we strongly recommend having this Policy reviewed by a lawyer qualified in Nigerian data protection law (and, if you have users elsewhere, in the relevant foreign jurisdiction) before publishing it or relying on it.