This policy explains what personal information Researchor collects, why, and what you can do about it. Researchor is used by clients and experts in many countries, so the rights described here apply to every user, wherever you live. Where a local law gives you something more, the regional notes below say so.
Researchor is operated by Lumio Africa, which is the data controller for the information described here.
What we collect
You give us directly
- Name, email address, phone number and password.
- Profile information: photo, short bio, country, city and time zone.
- For experts: qualifications, institution, field of expertise, methodologies, skills, years of experience, publications, and supporting documents such as a CV or certificate.
- Project information: briefs, scope, budgets, deadlines, milestones.
- Files you upload: deliverables, datasets, attachments in messages.
- Messages you send to other users and to support.
- Payment and payout details, collected and held by our payment providers rather than by us.
We collect automatically
- Device and browser information, IP address, and approximate location derived from it.
- Usage information: pages viewed, actions taken, timestamps.
- Cookies and similar technologies, described in the Cookie Policy.
We may collect from others
- Confirmation of payment or payout status from our payment providers.
- Verification information, where a verification step is in use and you have consented to it.
Why we use it
- To run your account: authenticate you, keep you signed in, show you your projects.
- To match projects to experts: comparing a brief against expert profiles. Matching is a ranking aid. It does not make a decision with a legal or similarly significant effect, and a human always chooses.
- To deliver projects: messaging, file exchange, milestone tracking.
- To move money: funding escrow, releasing milestone payments, paying out, and keeping transaction records.
- For safety: detecting fraud, abuse, and breaches of the Academic Integrity Policy.
- To support you: answering the questions you send us.
- To improve the platform: understanding which flows work and which fail.
- To meet legal obligations: including tax and financial record-keeping.
The lawful bases we rely on
We process personal data only where:
- it is necessary to perform a contract with you (running your account, delivering projects, processing payments);
- it is necessary for compliance with a legal obligation (financial records, lawful requests);
- it is in our legitimate interests and not overridden by your rights (platform security, fraud prevention, product improvement);
- you have given consent (optional cookies, marketing email). You can withdraw consent at any time.
Who we share it with
- Other users, to the extent the engagement requires. A client sees the profile, proposal and deliverables of an expert they engage. An expert sees the brief and files a client shares. Your email address is not shown to other users.
- Service providers who process data on our instructions: hosting, database and storage, email delivery, payment processing, and error monitoring.
- Authorities, where we are legally required to disclose, or where disclosure is necessary to establish or defend a legal claim.
We do not sell personal data, and we do not share it with advertisers.
Where data is held, and transfers
Researchor runs on cloud infrastructure, so your personal data may be stored and processed in countries other than the one you live in. When data moves between countries we rely on the contractual safeguards we hold with each provider, such as standard contractual clauses where they are required, and on your instruction to use the service.
We will list the categories of processors and their locations on this page as those arrangements are finalised. We are not going to name providers we have not yet contracted.
Regional information
European Union, European Economic Area and United Kingdom. You have the rights set out below, and you may complain to the data protection authority in the country where you live or work. We have not been assessed against the EU or UK GDPR by any authority, and we do not claim a certification we do not hold.
United States. We do not sell or share personal information for cross-context behavioural advertising. Residents of states with privacy laws, such as California, may use the rights below, including the right to know and the right to delete.
Nigeria. Our operating company is established in Nigeria, and the Nigeria Data Protection Act 2023 applies to our processing. You may complain to the Nigeria Data Protection Commission.
Everywhere else. The rights below apply to you in full. If your local law gives you a further right, write to us and we will honour it.
How long we keep it
- Account and profile data: while your account is open, then up to 12 months after closure so the account can be restored and disputes resolved.
- Project, message and file data: for the life of the project and then up to 24 months, since disputes and IP questions surface after delivery.
- Transaction records: for the period tax and financial record-keeping law requires, which is longer than the periods above.
- Support correspondence: up to 24 months.
When a retention period ends we delete the data or irreversibly anonymise it.
Your rights
Wherever you live, you may ask us to:
- access the personal data we hold about you;
- correct data that is inaccurate or incomplete;
- delete your data, where we are not required to keep it;
- restrict or object to certain processing;
- receive a portable copy of data you gave us;
- withdraw consent where consent is the basis we rely on.
Most of these are available directly in Settings. For anything else, write to support@researchor.org.ng and we will respond within 30 days. If you are not satisfied, you may complain to the data protection authority where you live (see Regional information).
Security
We protect data in transit using HTTPS, set security headers including a Content-Security-Policy on every response, and restrict administrative access to the people who need it.
We are not going to claim an encryption standard, an audit, or a certification we do not hold. As the platform's payment and storage layers are built out, the specific measures in place will be described on the Data & Security page rather than summarised in marketing language.
No system is perfectly secure. If a breach occurs that is likely to affect your rights, we will notify you and the data protection authorities concerned within the time the law requires.
Children
Researchor is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, write to support@researchor.org.ng and we will delete it.
Changes
We will post changes here with a new version number and effective date, and give notice through the platform where a change is material.
Questions about this document go to support@researchor.org.ng, or through the contact form.