Privacy policy

Who I am

I'm Francisca Osaigbovo, and I trade as Francisca Creates. My books are published under my imprint, Golden Press. The company behind it all is Goldencrest Services Limited, registered in Nigeria with registration number RC 9277930, and I work from Nigeria. Under the Nigeria Data Protection Act 2023 that company is the data controller for this website, which is a formal way of saying I decide what gets collected here and I answer for how it's handled.

The short version

I collect very little. There are no analytics tools on this site, no advertising trackers, no marketing cookies and no third-party pixels. The only cookies are the ones that keep you signed in. If you never write to me and never create a student account, I collect nothing about you at all.

When you send me an enquiry

If you use my contact form, I keep what you send: your name, your email address, the category you picked and the message itself. I use it to reply to you, and for nothing else.

To keep spam and scammers out, my server also records your browser's user-agent string and a scrambled version of your internet address. The scrambling deserves a proper explanation. Your raw IP address is never stored. Instead, the server mixes it with a secret value that only the server holds, plus the day's date, and runs the result through a one-way hash. Without that secret the stored value can't be turned back into your address, and visits on different days can't be matched to each other. It exists purely to spot abuse, such as someone flooding the form with messages.

When you create a student account

Some of my books and courses sit behind a sign-in. To create an account I ask for your name, your email address and a password. The password is hashed by my authentication provider before it's stored, which means nobody can read it. Not the provider's staff, and not me.

If you choose Continue with Google instead, Google passes me the name and email address on your Google account, along with your profile picture. Either way, the account only starts working once the email address has been confirmed. That confirmation matters here, because your email address is the key that unlocks what you've bought.

Access records

When you buy one of my books or courses, I switch on your access by hand using the email address you bought with. To do that, I keep a small record: which email owns which title, how it was paid for (a short label such as Selar or bank transfer), an optional note like an order number, and when the access was granted and by whom. This record is what proves you're entitled to the content, so it lasts for as long as the access does.

If you ever write in to claim access after paying, for example by sending a bank transfer reference, I keep that request and what came of it too.

Payments

This site never sees your card details or your bank credentials, and it never will. Purchases happen on Selar, or you arrange them with me directly. Selar is a separate company with its own privacy policy, and when you buy there you're dealing with Selar, not with my website. After you've paid, the only thing I use is your email address, so I can grant your access.

Cookies

This site sets authentication session cookies and nothing else. They're the strictly necessary kind: their only job is to remember that you're signed in while you move between pages. There's no cookie banner here because there's nothing to consent to. I don't use analytics or marketing tools, so there are no cookies for them.

Who helps me run this

A few companies process data on my behalf, and only on my instructions. Supabase provides my database, my sign-in system and the storage behind my protected content, hosted in London on AWS infrastructure. Vercel hosts the website itself and serves it to visitors around the world. Google is involved only if you choose to sign in with Google.

One person helps me too. My brother looks after the technical side of this site, and the admin area we share means he can also see enquiries and student records. Nobody else has that access.

Some video lessons are hosted on outside platforms. When you press play on one of those, you're visiting that platform, and it will see your visit the way any website you open does.

Where your data lives

The database sits in London. That covers enquiries, student accounts, access records and the protected files themselves. London is outside Nigeria, but my providers commit to recognised data protection safeguards in their agreements, and everything travels there over encrypted connections. Because Vercel serves the site globally, the pages you see may be delivered from a server near you, wherever in the world you are.

Why I'm allowed to use it

The NDPA asks me to name a lawful basis for each use, so here they are. Replying to your enquiry and running your account rest on taking steps you've asked for. Granting and proving your access rests on the contract between us when you buy. The anti-abuse measures on the contact form rest on my legitimate interest in keeping the site working. Anything that rests on your consent, you can withdraw at any time.

How long I keep things

Enquiries stay until I've dealt with them, then I archive or delete them, and the technical anti-abuse data goes with them. A student account lasts until you ask me to close it. Access records are different: they last as long as the access itself, and if access is ever revoked I keep the record marked as revoked rather than erasing it, because I need to be able to show what happened and when.

How I protect it

Everything between your browser and this site travels over HTTPS, so it's encrypted on the way. Inside the database, row-level rules are enforced by the database itself rather than trusting my code to behave: a signed-in student can only ever read their own records and the content they own. Protected files have no public web address at all, and when you download one, the site creates a private link that expires within minutes. Passwords, as I said above, are hashed before storage.

No website can promise perfect security, and I won't pretend this one can. What I can promise is this: if a breach ever puts your data at real risk, I'll report it as the NDPA requires and I'll tell you about it plainly. I also deliberately keep the amount of data I hold small. The less I store, the less there is to lose.

Your rights

The Nigeria Data Protection Act 2023 gives you rights over your information, and I honour them. You can ask for a copy of what I hold about you, or have it corrected if it's wrong. You can ask me to delete it, to restrict what I do with it, or to hand it over in a portable form. You can object to how I'm using it, and withdraw any consent you've given. I don't do automated decision-making or profiling, so there's nothing of that kind to object to.

To use any of these rights, write to me through the contact form and tell me which email address your request concerns. I may ask you to confirm you control that address, since these rights belong to you and I shouldn't hand your data to someone else. I'll respond within thirty days.

If you're not satisfied with how I respond, you can complain to the Nigeria Data Protection Commission, the regulator for data protection in Nigeria, at ndpc.gov.ng.

If the law compels me

If a court, a regulator or another lawful authority requires me to disclose data, I'll comply with what the law actually demands and no more than that.

Children

This site isn't directed at children, and in Nigeria that means anyone under eighteen. I don't knowingly collect a child's information without a parent or guardian's consent. If you're a parent or guardian and you believe a child has given me their information, write to me and I'll remove it.

Changes to this policy

If I change this policy, the new version goes up on this page with a new effective date at the top. That date always tells you when the words you're reading took effect. I won't bury a significant change; if something important shifts, I'll say so plainly.

How to reach me

For anything in this policy, use the contact form on this site. Messages arrive in the admin area I described above, and I answer them.