Privacy Policy

Pitulo operates an academic project supervision service for tertiary institutions in Ghana. Students submit thesis chapters, supervisors review and annotate them, and departmental coordinators keep oversight of the work in their department.

For the purposes of Ghana's Data Protection Act, 2012 (Act 843), Pitulo is the data controller for the personal data described in this policy. Your institution is not the controller of your Pitulo account, although the Services are designed so that your supervisor and your department can see the work that supervision requires.

This policy covers pitulo.io and app.pitulo.io. It does not cover any site we link to; those have their own policies and we do not control them.

During onboarding you select your institution, faculty, department, campus or learning centre, programme, specialisation and academic level from a directory of Ghanaian institutions that we maintain ourselves. That directory is public information, published by the institutions.

We do not receive any record from your institution about you. Your placement in that hierarchy comes from your own answers, and from the domain of the email address you verified.

When a supervisor reviews work, we create a mathematical representation of the patterns in their feedback — what they consistently ask for, and what they consistently object to. This lets the Services apply a supervisor's own standards to later submissions instead of a generic one. It is derived from feedback text already stored in your account and is not shared outside your institution's supervision relationships.

Our servers record ordinary request information — IP address, browser type, and the time of the request — for security, rate limiting and diagnosing faults. We also record that an automated language task ran, and against which submission, so that a wrong or missing result can be investigated.

This is the part of the policy most worth reading, because the Services exist to show some of your work to other people. Access is enforced in the database itself, on every query, not only in the interface.

The supervisor assigned to your project can see the work you submit to them, the feedback written on it, and your name and academic placement. That is the point of the relationship.

A coordinator has oversight scoped to a single department at a single campus. Within that scope they can see the projects and the supervision taking place. They cannot see projects in another department, at another campus, or at another institution.

If you work in a group, the active members of that group can see the shared project, its submissions and the feedback on them.

The comments, replies, reactions and voice notes group members exchange with each other are never visible to the assigned supervisor, to a coordinator, or to your institution. This is not a setting that can be turned on for a particular project or a particular supervisor. It is enforced in the database rules and in the service layer, and it has no administrative override.

We say it plainly because it is a deliberate design decision rather than an accident of implementation: students talking to each other about their own work are entitled to do so without being observed by the person marking it.

A small number of people at Pitulo can reach production data in order to operate the Services, investigate a fault you have reported, or comply with a legal obligation. We do not read your work for any other reason, and we do not use it to advertise to you or to anyone else.

If you choose to sign in with Google, Google tells us your email address, your name, your profile picture if you have one, and a stable identifier for your Google account. We use these to create or recognise your Pitulo account and for nothing else.

We request only the basic sign-in scopes — your email address and your basic profile. We do not request, and Google does not give us, access to your Gmail, your Drive, your contacts, your calendar, or anything else in your Google account.

We do not sell this information, transfer it to anyone for advertising, use it for any form of profiling, or allow anyone to use it to train an artificial intelligence model. It is used to sign you in and to identify your account.

You can disconnect Pitulo from your Google account at any time in your Google account's security settings. Doing so stops you signing in that way; it does not delete your Pitulo account, which you can delete separately as described in Section 10.

Parts of the Services send text to language and embedding models operated by Anthropic and OpenAI — for example to draft feedback, to check grammar, to summarise what changed between two versions of a chapter, or to build the representation described in Section 2.

What is sent is the text needed for that task: the passage under review, and where relevant the supervisor's earlier feedback. Your name, your email address and your phone number are not part of what is sent.

We use these providers through their commercial interfaces, under terms that do not permit them to train their models on what we send.

AI output is a draft for a person to review. A supervisor decides what feedback you receive; the Services do not grade your work, and no decision about you is made by a model alone.

We use the following providers to deliver the Services. Each acts on our instructions and only for the purpose listed.

We do not sell personal data, and we have never done so. We do not share it with advertisers, data brokers, or anyone for marketing purposes.

Your account and your work are stored in Frankfurt, Germany. The application programming interface runs in Amsterdam, the Netherlands, and the web application's server-side code runs in Frankfurt. Pages and images are served from whichever of our hosting providers' locations is nearest to you, which for most of our users is in Africa or Europe.

This means personal data described in this policy is transferred outside Ghana and processed in the European Union, where it has the protection of European data protection law in addition to Act 843. The providers listed in Section 7 may process limited data in other countries in order to operate their own services.

By using the Services you consent to that transfer. If you would prefer your data not to leave Ghana, we are not currently able to offer that, and you should not create an account.

Under Act 843 you may ask us for a copy of the personal data we hold about you, ask us to correct it if it is wrong, ask us to delete it, object to processing, or withdraw a consent you have given. Write to support@pitulo.io from the address on your account and we will respond.

Deleting your account removes your profile, your submissions and uploaded documents, the feedback attached to them, the derived representation described in Section 2, and your peer collaboration messages. It cannot be undone.

Your content becomes inaccessible to you immediately and is removed from our active systems within 30 days. It may persist in encrypted backups for a further period until those backups age out on their normal rotation.

Feedback a supervisor wrote is the supervisor's own record of their work, and a project a group worked on jointly belongs to more than one person. Deleting your account removes you and your own content from it; it does not delete another person's account or the record of supervision they carried out.

You may complain to us first, and we would prefer that you did. You also have the right to complain to Ghana's Data Protection Commission.

Access to every table holding personal data is restricted at the database level, per row, according to who is asking. The key that bypasses those restrictions exists only on our server and is never sent to a browser.

Traffic between you, us and our providers is encrypted in transit. Passwords are hashed by our authentication provider and are not readable by us. We never hold card numbers or mobile money credentials.

No system is perfectly secure, and we will not claim otherwise. If a breach affects your personal data, we will notify you and the Data Protection Commission as Act 843 requires.

We use a small number of cookies and similar storage, all of which are necessary for the Services to work:

We do not run a product analytics service, session recording, heatmaps, or any third-party tracking script. We do not show advertisements, we do not embed advertising cookies, and there is no advertising network with any presence on our pages.

We are stating this as a fact about the software rather than as a promise about our intentions. If that ever changes, this section changes with it, and the date at the top of this page changes too.

The Services are intended for people enrolled at, or employed by, a tertiary institution. They are not directed at children, and we do not knowingly collect personal data from a child. If you believe a child has created an account, write to support@pitulo.io and we will remove it.

We may change this policy as the Services change or as the law requires. The date at the top of this page is the date of the version you are reading. Where a change materially affects how we process your personal data, we will tell you through the Services or by email rather than relying on you to notice.

Questions about this policy, or any request about your personal data, can be sent to support@pitulo.io. Please write from the email address on your account, or tell us enough for us to be sure the request is yours — we will not act on a request to release or delete somebody's data to a person we cannot identify.