Privacy Policy

• Data Controller: Intern Router Services, a Nigerian entity operating internrouter.com.ng.
• Data Protection Officer (DPO): dpo@internrouter.com.ng
• Postal address for data requests: Lagos, Nigeria (available on request).
• NDPC registration: Pending / Registered (to be updated upon completion).

• This Policy applies to all visitors, Students, Firms, and Administrators interacting with the Platform.
• It does not cover third-party sites or services linked from the Platform — those are governed by their own privacy policies.

3.1 Account Information

• Email address, password (hashed), full name, phone number, role (student / firm / admin).
• For Google OAuth sign-up: name, email, and profile picture URL from Google.

3.2 Profile & Application Information

• Students: age, city, state, institution name and type, year of study, matriculation number, Microsoft Office skills, soft skills, areas of interest, internship duration and start month preferences, firm choices.
• Firms: firm name, NIESV registration number, address, location, specialisations, description, logo, intern slot count, deadline, contact details.

3.3 Documents & Payments

• CVs (PDF, optional, stored on Cloudinary).
• Application letters (PDF, optional, stored on Cloudinary).
• Payment proofs (image or PDF, stored on Cloudinary).
• Payer's full name as entered during Application.
• We DO NOT store card details, bank credentials, or any banking information. Payments are made via direct bank transfer outside our system.

3.4 Technical & Usage Data

• IP address, browser type and version, device type, operating system.
• Pages visited, time on page, referring URL, session duration.
• Cookie identifiers (see section 10).
• Logs of API requests and errors for security and debugging purposes.

Under NDPA 2023 s.25, we rely on the following lawful bases:

• To create and manage your account.
• To route your Application to your selected Firms (Students) or to deliver Applications to you (Firms).
• To verify payment proofs and process the Application Routing.
• To send transactional emails (verification, payment confirmation, application status updates, acceptance/rejection notifications).
• To respond to support requests.
• To detect, prevent, and investigate fraud, abuse, or security incidents.
• To improve the Platform through aggregated, de-identified analytics.
• To comply with legal obligations.

• With Firms you have selected: We share your full Application package (profile, CV, application letter, payment confirmation status) with your chosen Firms only in routing order. Your data is NEVER sent to a Firm you did not select.
• With Service Providers (sub-processors, see section 7): Strictly to enable Platform operation.
• With Regulatory Authorities: Where lawfully required by NDPC, court order, or other valid legal process.
• With Successor Entities: In the event of a merger, acquisition, or asset sale, your data may be transferred to the successor entity under equivalent privacy protections, with prior notice to you.
• We DO NOT sell your personal data. We DO NOT share your data with marketers or unrelated third parties for their own purposes.

• Some of our sub-processors operate servers outside Nigeria. Under section 41 of the NDPA 2023, we transfer personal data internationally only where: (a) the recipient country provides adequate protection; or (b) standard contractual clauses or equivalent appropriate safeguards are in place; or (c) you have given explicit consent after being informed of the risks.
• We assess each sub-processor's data protection posture before onboarding and require contractual data-protection commitments.
• You may request a copy of the safeguards by emailing dpo@internrouter.com.ng.

• Account data: retained while your account is active and for 24 months after closure, then deleted or fully anonymised.
• Application data and uploaded documents: retained for 18 months after the Application's final outcome, then deleted.
• Payment proofs: retained for 5 years for financial-record purposes as required by Nigerian financial regulation.
• Technical logs: retained for 90 days, except where required longer for incident investigation.
• Anonymised, aggregated statistics may be retained indefinitely for product analytics.

We use the minimum cookies necessary to operate the Platform:

• Strictly necessary cookies (authentication session, CSRF protection) — always on; cannot be disabled.
• Preference cookies (theme: dark / light) — remember your UI preference; non-essential.
• Analytics cookies (aggregated, privacy-preserving) — opt-in.

We do NOT use third-party advertising cookies or cross-site trackers. You can manage your preferences via the cookie banner on your first visit or in your dashboard settings under "Privacy".

• The Platform is not directed at persons under 16. We do not knowingly collect personal data from anyone under 16 without verifiable parental or guardian consent.
• If we learn that we have collected such data without proper consent, we delete it promptly.
• If you believe we hold data about a minor without consent, contact dpo@internrouter.com.ng.

• Transport: All traffic is encrypted in transit using TLS 1.3.
• At rest: Passwords are hashed using industry-standard algorithms (Supabase Auth defaults). Sensitive uploads are stored under signed, access-controlled URLs.
• Access controls: Internal access to personal data is restricted to authorised personnel on a need-to-know basis and logged.
• Monitoring: We log security-relevant events and review them regularly.
• No system can be guaranteed 100% secure. While we take reasonable precautions, you also bear responsibility for safeguarding your account credentials.

• In the event of a personal-data breach likely to result in risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission within seventy-two (72) hours of becoming aware, as required by NDPA s.40.
• Affected individuals will be notified without undue delay where the breach poses a high risk.

• We may update this Policy from time to time. Material changes will be notified by email to registered users at least 14 days before they take effect.
• The "Last updated" date at the top reflects the latest revision. Prior versions are archived and available on request.