MCC VaultPrivacy policy
Last updated 4 November 2026
This policy explains what personal data MCC Vault collects, why we collect it, who we share it with and the rights you have. Ailopin Digital, the business that makes MCC Vault, is responsible for your data ("we" and "us"). We follow the Nigeria Data Protection Act 2023, and we treat your data with the same care wherever you live, including in Canada.
What we collect
- Your account: your email address, and your name and profile picture if you sign in with Google. Passwords are handled by Google's Firebase Authentication. We never see them.
- Your study: the cards and questions you have done and how you did, checkpoint and mock scores, lessons read, your study streak, your exam date and the hours you plan to study.
- Mindset: your answers to "How are you today?". These are private to you.
- Reminders: the time you chose, your time zone, and a notification key for each device where you allow notifications.
- Payments: your plan, payment dates and amounts, the payment reference, and the type and last four digits of your card. Full card numbers and bank details are handled by Paystack. We never receive them.
- Interest from our website: if you leave your email address on our website, for example to get the study timetable or to start Week 1, we keep it with your choices about messages and the link that brought you to us, such as an advert or a partner's link. The readiness check on our website does not save your answers.
- Reports and messages: what you send us through Report an issue or by email.
- Devices: basic technical details, such as the type of browser and when each device last signed in. We use these to keep your account secure and to apply the two-device limit.
Why we use it
- To run your account and save your progress, which is the service you signed up for.
- To take payments and manage your plan, and to keep the records tax law requires.
- To send account emails, such as password resets and receipts.
- To send study reminders, only if you switch them on. You can switch them off at any time.
- To send updates and offers by email, only if you ticked the box to receive them. Every message lets you unsubscribe in one tap.
- To measure our advertising, only if you accept marketing cookies.
- To fix mistakes and improve the course.
Cookies and tracking
Our website and app load advertising and analytics tools, such as the Meta Pixel and Google Analytics, only if you accept them in the cookie banner. They show us which adverts bring people to MCC Vault, and let us show MCC Vault again to people who have visited. If you decline, they are not loaded at all. You can change your choice at any time with the Cookie settings link at the bottom of our web pages, or in the app under Settings.
If you accepted marketing cookies, our server may also tell Meta when you sign up or pay, using a scrambled (hashed) copy of your email address rather than the address itself.
The app also keeps your progress and settings in your browser so it works without a connection. This is part of the service and is not used to track you.
Who we share it with
We never sell personal data. We use these services to run MCC Vault, each under its own data protection terms:
- Google (Firebase and Google Cloud): sign-in, the database, server code, notifications and AI features. Your study data is stored in Google's London data centre.
- Cloudflare: hosting for the website and app.
- Paystack: payments.
- Resend: account emails.
- Brevo: updates and follow-up emails, if you agreed to receive them.
- Meta and Google: advertising measurement, if you accepted marketing cookies.
AI features send the lesson, card or question you are studying, and the answer you chose, to Google's Gemini model in our own Google Cloud project. We do not send your name or email address.
Some of these services handle data outside Nigeria, including in the United Kingdom, the European Union, the United States and Canada. We rely on their contractual safeguards for this. We share data with others only if the law requires it.
How long we keep it
- Your account and progress: until you delete your account.
- "How are you today?" answers: 30 days, and deleted at once if you delete your account.
- Payment records: as long as tax and accounting law requires, normally six years.
- Interest left on our website: until you unsubscribe, or two years after we last heard from you, whichever comes first.
- Reports: up to two years.
Your rights
You can ask to see, correct, download or delete your data, to limit or object to how we use it, and to withdraw your consent at any time. You can do most of this yourself:
- Download your progress: in the app, Settings, then Download a copy.
- Delete everything: in the app, Settings, then Delete my account and data.
- Stop marketing: use the unsubscribe link in any email, or turn emails off in the app under Settings.
- Change cookie choices: Cookie settings, at the bottom of our web pages or in the app under Settings.
For anything else, email [email protected] and we will reply within 30 days. If you are not happy with our answer, you can complain to the Nigeria Data Protection Commission at ndpc.gov.ng, or to the data protection authority where you live, such as the Office of the Privacy Commissioner of Canada.
Keeping it safe
Your data is protected by strict security rules, so no other user can read it, even with a modified app. Payments are checked by our server directly with Paystack. We look at an individual's data only when we need to help them or fix a problem.
Age
MCC Vault is for adults preparing for a medical licensing exam. It is not meant for anyone under 18.
Changes to this policy
If we change this policy in a way that matters, we will tell you in the app or by email before the change applies.
Contact
MCC Vault, Ailopin Digital. Email [email protected].