Privacy Policy

Effective date: May 14, 2026 · Last updated: May 18, 2026

This Privacy Policy explains how Novus Technologies (“Solux,” “we,” “us,” or “our”), a company registered in Cameroon, collects, uses, discloses, and safeguards information about you when you use the Solux E-Learning platform at solux-elearning.com, our mobile and web applications, and any related services (collectively, the “Service”).

We are committed to protecting your personal information in line with applicable laws, including the EU General Data Protection Regulation (“GDPR”), the UK GDPR, and Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”).

Quick summary. We collect what we need to run an e-learning platform with social, commerce, and AI features: your account profile, your learning progress, content you publish, orders you place, messages you send, and the device data your browser provides. We do not sell your data. You can access, correct, export, or delete your data at any time by emailing novustechnologies7@gmail.com.

1. Who is the data controller

The data controller responsible for your personal information is:

• Novus Technologies
• Country of registration: Cameroon
• Privacy contact: novustechnologies7@gmail.com

If you are located in the European Union, the United Kingdom, or Canada, this email address is also the contact point for any data-protection enquiry, including requests to exercise your statutory rights described in Section 9.

2. Information we collect

We collect the following categories of personal information when you interact with the Service.

2.1 Information you provide

• Account & profile: name, username, email address, profile picture, optional phone number, language preference, and any biographical information you add to your profile. Authentication is handled on our behalf by Clerk.
• User-generated content: blog posts, comments, votes, bookmarks, FAQs, course notes, quiz answers, chat messages, group conversations, voice notes, images, video and document attachments, and any media you upload or share.
• Course & learning activity: courses you enrol in, lessons you complete, quiz scores, certificates issued, learning streaks, and experience points (XP).
• Orders & shipping:when you buy a physical product (“Goodie”) we collect the full name, email address, phone number, shipping address (line, city, region, country), the items ordered, and totals.
• Payment information: card or mobile-money details you enter to pay are collected and processed directly by our payment providers (Fapshi, NotchPay, Stripe). We do not store full card numbers on our servers; we keep the transaction identifier, amount, currency, status, and the masked phone number where applicable.
• Communications: messages you send to us by email or through the Service, and any content you submit through forms or surveys.
• AI assistant prompts: messages you send to the in-app AI assistant and the responses generated for you. These are stored under your account so that you can revisit your conversations.
• Referrals: the referral code you use, who you referred, and the rewards earned.

2.2 Information collected automatically

• Device & technical data: IP address, browser type and version, operating system, device identifiers, language settings, and time-zone.
• Usage data: pages visited, features used, search queries, click events, time spent, error and crash logs.
• Cookies & similar technologies: see Section 9.
• Push-notification subscriptions: if you opt in to web push notifications, we store the push endpoint and the encryption keys your browser provides so that we can deliver messages.

2.3 Information from third parties

If you sign in via a social provider (e.g. Google) through Clerk, we receive the basic profile information that provider shares with us. We may also receive payment-status updates from our payment providers and delivery-status updates from shipping partners.

3. How we use your information

We use personal information for the purposes below. The right-hand column lists the legal basis under the GDPR; in Canada, processing is based on your consent (express or implied) as required by PIPEDA.

• Provide and operate the Service — create your account, deliver courses, run quizzes, host the blog and chat, process orders, issue certificates. Basis: contract.
• Process payments and prevent fraud — share order and payment data with processors, verify transactions, investigate chargebacks. Basis: contract; legal obligation; legitimate interests.
• Personalise your experience— recommend courses, surface “frequently bought” products, display your XP and streaks. Basis: legitimate interests.
• Communicate with you — send transactional emails (order confirmations, password resets, course updates), respond to support requests, and, with your consent, send marketing or newsletter messages. Basis: contract; consent (for marketing).
• Send push notifications when you opt in. Basis: consent.
• Operate the AI assistant — process your prompts to generate responses and store the conversation in your history. Basis: contract.
• Run the referral, XP and rewards programmes. Basis: contract; legitimate interests.
• Secure the platform — detect abuse, enforce our Terms of Use, rate-limit endpoints, log security events. Basis: legitimate interests; legal obligation.
• Improve and analyse the Service — understand which features are used, identify bugs, develop new features. Basis: legitimate interests.
• Comply with legal obligations — tax, accounting, consumer-protection, and responding to lawful requests from authorities. Basis: legal obligation.

Where we rely on legitimate interests, we have carried out a balancing assessment to ensure your rights and freedoms are not overridden. You can request a summary of that assessment by contacting us.

4. How we share your information

We do not sell your personal information. We share it only with:

• Sub-processors and third partieswho provide infrastructure and services we rely on to operate the Service. The full list, with each provider’s purpose and region, is set out in Section 5 below.
• Other users of the Service — content you publish or share (blog posts, comments, votes, profile, chat messages with your conversation participants, public follower/following lists) will be visible to other users in the manner indicated by the relevant feature.
• Authorities and other parties when legally required — to comply with a court order, lawful request, or to protect the rights, property, or safety of Solux, our users, or the public.
• Successors — if Novus Technologies is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction; we will notify you and provide choices where the law requires.

5. Sub-processors and Third Parties

We rely on the following sub-processors to operate the Service. Each provider is bound by their own terms and privacy policies, and we choose providers that offer appropriate safeguards.

We may update this list as our infrastructure evolves and will reflect changes in this Policy.

5.1 Google API Services and Limited Use

Workspace managers (users with the Admin or Teacher role) may connect their Google account to Solux so that live sessions scheduled inside Solux are automatically added to their Google Calendar. Students never see or initiate this flow, and connecting Google is entirely optional.

Solux requests the https://www.googleapis.com/auth/calendar.app.created scope. This is a non-sensitive scope that restricts Solux to a secondary calendar Google creates and grants to our application. Solux cannotread, write, list, or otherwise access the manager’s primary calendar or any other calendar in their Google account.

We use this scope only to:

• create a calendar event on the Solux-owned secondary calendar for each live session the manager schedules in Solux, including (for free sessions) an auto-generated Google Meet conference link; and
• delete that event when the corresponding session is cancelled or removed in Solux, so the manager’s calendar stays in sync with Solux.

From Google, Solux stores only the OAuth access and refresh tokens issued to our application (encrypted at rest, scoped per individual manager) and the Google event identifier returned when the event was created. We do not store the content of events, attendee lists, free/busy information, calendar metadata, or any other data returned by Google APIs.

Managers can disconnect Google at any time from their Solux account settings. Disconnecting revokes the token with Google’s revocation endpoint and deletes the stored credentials and event references from Solux. Deleting your Solux account triggers the same revocation and deletion.

Solux’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, Solux:

• uses data obtained through Google APIs only to provide the user-facing scheduling feature described above, which is prominent in the Solux interface;
• does not transfer this data to third parties except as necessary to provide that feature, to comply with applicable law, or as part of a merger, acquisition, or sale of assets, in which case we will obtain your explicit consent;
• does not use Google user data for serving advertisements, including retargeted, personalised, or interest-based advertising; and
• does not allow humans to read Google user data unless we have your affirmative agreement to view specific data, it is necessary for security purposes (such as investigating abuse), to comply with applicable law, or where the data has been aggregated and anonymised for internal operations.

6. International Data Transfers

Some of our sub-processors are based outside Cameroon, including in the European Union and the United States. Where personal data is transferred internationally, we rely on the safeguards offered by those providers (such as Standard Contractual Clauses or equivalent mechanisms) and on the contractual obligations between us and our sub-processors.

7. Security

• Encryption in transit (HTTPS/TLS) for all client–server communication.
• Encryption at rest, as provided by our database and storage sub-processors.
• Role-based access control, password hashing, and per-organization data isolation.
• Centralized authentication via Clerk, including session management and account recovery.
• Routine logging, monitoring, and incident response procedures.

No system is perfectly secure. If we become aware of a personal data breach affecting your data, we will notify you without undue delay in accordance with applicable law (within 72 hours of becoming aware, where the GDPR applies and the breach is likely to result in a risk to your rights and freedoms).

8. Data retention

We keep personal information only for as long as we need it for the purposes described in this Policy, unless a longer period is required by law.

• Account data: kept for the lifetime of your account and deleted within 30 days after account deletion (subject to legal holds).
• Order, invoice, and tax records: retained for up to 10 years after the transaction to satisfy accounting and tax obligations.
• Chat messages and AI conversations: retained until you (or another participant, where applicable) delete them, or until your account is deleted.
• Push-notification subscriptions: deleted when you revoke them, when they expire, or when your account is deleted.
• Server logs and security events: typically retained for up to 12 months for security and troubleshooting.
• Marketing-consent records: retained for as long as you remain subscribed plus the period required to evidence consent.

9. Cookies and similar technologies

We use cookies and equivalent storage for the following purposes:

• Strictly necessary: session, authentication (Clerk), CSRF protection, load balancing.
• Functional:remember your theme, language, draft messages, and shopping cart (stored in your browser’s local storage).
• Analytics & performance: understand aggregate usage to improve the Service.

Where required (notably in the EEA and the UK), we will request your consent before placing non-essential cookies through a cookie banner, and you can change your preferences at any time. You can also block or delete cookies through your browser settings; doing so may affect the functionality of the Service.

10. Your rights

10.1 If you are in the EEA, the UK, or Switzerland (GDPR)

You have the right to:

• Access the personal data we hold about you and obtain a copy;
• Rectify inaccurate or incomplete data;
• Eraseyour data (the “right to be forgotten”), subject to legal exceptions;
• Restrict or object to certain processing, including processing based on legitimate interests and direct marketing;
• Receive your data in a structured, commonly used, machine-readable format (data portability) and have it transmitted to another controller where technically feasible;
• Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal;
• Lodge a complaintwith your national supervisory authority. A list of EEA authorities is available on the European Data Protection Board’s website. UK residents may complain to the Information Commissioner’s Office (ICO).

10.2 If you are in Canada (PIPEDA)

You have the right to:

• Access the personal information we hold about you and be informed of how it has been used and to whom it has been disclosed;
• Challenge the accuracy of your information and request correction;
• Withdraw consent, subject to legal or contractual restrictions and reasonable notice;
• File a complaint with the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca if you are unsatisfied with how we have handled your information, or with the relevant provincial privacy commissioner where applicable.

Our internal Privacy Officer for PIPEDA purposes can be reached at novustechnologies7@gmail.com.

10.3 How to exercise your rights

Send your request to novustechnologies7@gmail.com from the email address associated with your account. We may need to verify your identity before responding. We will respond within 30 days (extendable by 60 days for complex requests under the GDPR; within statutory deadlines under PIPEDA). Exercising these rights is free of charge unless requests are manifestly unfounded or excessive.

11. Children

The Service is intended for users aged 13 and over. Users in the European Union who are under 16 (or the higher age set by their member state) must obtain verifiable consent from a parent or legal guardian before creating an account or providing personal information. If we learn that we have collected personal data from a child without the required consent, we will delete it as soon as practicable. Parents and guardians may contact us at novustechnologies7@gmail.com to review or delete a child’s information.

12. Automated decision-making

We do not make decisions producing legal or similarly significant effects about you based solely on automated processing. Recommendation and ranking features (such as “frequently bought together,” suggested courses, or feed ordering) may use automated processing but are not used to make such significant decisions.

13. Third-party links

The Service may contain links to websites, plugins, or applications operated by third parties. Clicking on those links may allow third parties to collect or share data about you. We do not control these third-party sites and are not responsible for their privacy statements; we encourage you to read them.

14. Changes to this Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. If the changes are material, we will provide a more prominent notice (for example, by email or an in-app notification) before they take effect. Continued use of the Service after a change becomes effective constitutes acceptance of the revised Policy.

15. Contact us

For any question, request, or complaint about this Policy or the way we handle your personal information:

• Novus Technologies — operator of Solux E-Learning
• Email: novustechnologies7@gmail.com
• Country: Cameroon