PRIVACY & COOKIE POLICY

Effective Date: 22 October 2026

Last Updated: 22 October 2026

Operated by: Reepeet Nigeria Limited

Website: https://reepeet.ai

1. INTRODUCTION

Reepeet Nigeria Limited (“Reepeet”, “we”, “us”, or “our”) is committed to protecting the privacy, security, and personal information of individuals who access or use our services.

Reepeet operates an AI-powered music learning, performance assessment, and skill-based competition platform through which users can develop musical abilities, complete call-and-response exercises, receive automated performance feedback, access learning resources, and participate in eligible musical competitions.

This Privacy & Cookie Policy (“Policy”) explains how we collect, use, store, disclose, protect, and otherwise process personal information when you use our websites, applications, and related services (collectively, the “Platform”).

It also explains your privacy rights and the choices available to you regarding your personal information.

We process personal data in accordance with applicable data protection laws, including the Nigeria Data Protection Act 2023 and the Nigeria Data Protection Act General Application and Implementation Directive 2025, where applicable.

By using Reepeet, you acknowledge that you have been provided with this Policy. Where processing requires consent, Reepeet will seek that consent separately and appropriately.

2. DATA CONTROLLER

For personal data processed in connection with the operation of the Reepeet Platform, the responsible data controller is:

Reepeet Nigeria Limited

Reepeet determines the purposes and means of processing personal information in connection with its services, except where another party acts as an independent controller under applicable law.

Privacy-related requests may be submitted through the contact details provided at the end of this Policy.

3. SCOPE OF THIS POLICY

This Policy applies to personal information collected through:

• a. Reepeet's official website.
• b. The Reepeet web application and any related mobile applications.
• c. User account registration and authentication.
• d. Music learning and practice activities.
• e. AI-powered performance assessment.
• f. Musical competitions and challenges.
• g. Teacher and student services, where available.
• h. Subscription and payment activities.
• i. Customer support and communications.
• j. Other Reepeet services that expressly refer to this Policy.

This Policy does not automatically govern independent third-party websites or services that Reepeet does not control.

4. PERSONAL INFORMATION WE COLLECT

The categories of information collected depend on how you interact with Reepeet and which services you use.

4.1 Account and Registration Information

We may collect:

• Full name or display name.
• Email address.
• Phone number, where provided or required.
• Date of birth or age information.
• Account credentials and authentication records.
• User profile information.
• Country or general location information.
• Account preferences and settings.

4.2 Music Learning and Performance Information

When you use Reepeet's music learning and assessment features, we may process:

• Audio recordings of musical performances.
• Video recordings, where a feature requires or permits video.
• Vocal performances.
• Instrumental performances.
• Call-and-response submissions.
• Musical assessment scores.
• Performance accuracy measurements.
• Practice history and learning progress.
• Competition participation and ranking information.
• Technical information relating to submitted performances.

4.3 Subscription and Transaction Information

When you purchase a subscription or paid service, we may process:

• Subscription plan and status.
• Transaction references.
• Payment dates and amounts.
• Billing currency.
• Renewal and cancellation information.
• Refund records.
• Limited payment-related information received from payment providers.

Payments may be processed by authorised third-party payment service providers.

Reepeet does not require users to provide payment card PINs, one-time passwords, or online banking passwords.

4.4 Competition and Identity Verification Information

Where required for eligibility, fraud prevention, or prize administration, we may collect:

• Age verification information.
• Identity verification details.
• Competition entry records.
• Submitted performances.
• Scores and rankings.
• Winner verification information.
• Prize payment details.
• Competition complaints and appeal records.

Identity documents and other verification information shall be collected only where reasonably necessary and processed with appropriate safeguards.

4.5 Device and Technical Information

We may automatically collect certain technical information, including:

• IP address.
• Device type and operating system.
• Browser type.
• Device identifiers, where applicable.
• Login and session information.
• Error and diagnostic logs.
• Application performance information.
• Security and fraud-prevention signals.
• Cookie and similar technology identifiers.

4.6 Communications and Support Information

When you contact Reepeet, we may process your contact details, messages, attachments, complaint information, and records of our responses.

4.7 Teacher and Organisational Information

Where teacher or organisational services are available, we may process information necessary to administer those services, including professional profile details, lesson information, organisation membership, and related account permissions.

5. HOW WE COLLECT PERSONAL INFORMATION

We collect personal information through several methods.

Directly from you: When you register, complete your profile, submit performances, purchase subscriptions, contact support, or participate in competitions.

Automatically: When you access the Platform and certain technical information is generated through your device, browser, or use of our services.

Through service providers: When authorised payment processors, authentication providers, or other service providers return information necessary to operate the Platform.

Through authorised third parties: Where you choose to connect an external service or where information is lawfully provided to us for a disclosed purpose.

We aim to collect only information that is relevant and reasonably necessary for the purposes described in this Policy.

6. HOW WE USE PERSONAL INFORMATION

Reepeet may process personal information for the following purposes:

6.1 Platform Operations

To create and manage accounts, authenticate users, provide requested features, maintain subscriptions, and deliver Reepeet's services.

6.2 Music Learning and AI Assessment

To receive and process musical performances, evaluate relevant musical characteristics, generate scores, provide feedback, and maintain learning progress records.

6.3 Competition Administration

To manage competition entries, verify eligibility, evaluate performances, calculate rankings, identify winners, investigate suspected cheating, resolve appeals, and administer prizes.

6.4 Payments and Subscriptions

To process subscription transactions, maintain billing records, administer renewals, handle cancellations, and investigate payment or refund issues.

6.5 Security and Fraud Prevention

To protect accounts, detect unauthorised access, investigate suspicious activity, prevent competition manipulation, and maintain Platform security.

6.6 Customer Support

To respond to enquiries, investigate complaints, provide technical assistance, and communicate service-related information.

6.7 Service Improvement

To analyse Platform performance, identify technical problems, improve usability, and evaluate the effectiveness of learning and assessment features.

6.8 Legal and Regulatory Compliance

To comply with applicable laws, regulatory requirements, lawful requests, tax obligations, and legitimate recordkeeping requirements.

6.9 Marketing Communications

To send product announcements, promotional communications, or marketing materials where permitted by law.

Users may opt out of direct marketing communications using the available unsubscribe mechanism or by contacting Reepeet.

7. LAWFUL BASES FOR PROCESSING

Reepeet processes personal information only where an appropriate lawful basis exists.

Depending on the purpose and circumstances, this may include:

Performance of a Contract: Where processing is necessary to provide services requested by a user, such as account access, subscriptions, learning activities, or competition administration.

Consent: Where a user has provided valid consent for a particular activity, such as optional marketing, certain cookies, or processing that otherwise requires consent.

Legal Obligation: Where processing is necessary to comply with applicable laws or lawful regulatory requirements.

Legitimate Interests: Where processing is reasonably necessary for lawful interests such as Platform security, fraud prevention, and service improvement, provided the required balancing assessment supports that processing.

Other Lawful Bases: Where another basis is expressly permitted by applicable data protection law.

We will not rely on consent where another lawful basis is the actual basis for processing, nor will we treat acceptance of this Policy as blanket consent for unrelated processing activities.

8. AUDIO RECORDINGS, VIDEO RECORDINGS AND AI PROCESSING

Audio processing is central to Reepeet's music learning and performance assessment services.

8.1 Collection of Performance Recordings

When you activate a recording feature, Reepeet may access your device's microphone or camera, subject to the permissions required by your device or browser.

Recording permissions are used to enable relevant learning, assessment, or competition features.

Reepeet does not intend to activate microphones or cameras secretly or record users outside the relevant authorised functionality.

8.2 Processing of Recordings

Submitted recordings may be processed to:

• a. Analyse musical pitch and timing.
• b. Assess rhythm and performance accuracy.
• c. Generate performance feedback.
• d. Calculate competition scores.
• e. Verify compliance with competition requirements.
• f. Investigate technical errors or suspected manipulation.
• g. Maintain learning progress and relevant competition records.

8.3 AI Service Providers

Reepeet may use authorised third-party AI or cloud technology providers to support performance processing.

Where personal data is shared with such providers, Reepeet shall implement appropriate contractual, technical, and organisational safeguards.

Providers acting as processors shall be subject to appropriate restrictions concerning their use of personal data.

8.4 AI Model Training

Reepeet will not treat the submission of a musical performance as unrestricted permission to use that recording for unrelated AI model training.

Any use of identifiable user recordings to train or improve general-purpose or proprietary AI models beyond processing necessary to deliver the requested service shall require an appropriate lawful basis, clear disclosure, and consent where required.

The actual practices of Reepeet's AI providers must be consistent with this Policy and the applicable provider agreements.

8.5 Biometric Information

Musical recordings, including vocal performances, are not automatically treated as biometric identification data merely because they contain a person's voice.

However, where voice or other characteristics are specifically processed for unique identification or authentication, Reepeet shall assess and comply with any additional requirements applicable to biometric or sensitive personal data.

9. AUTOMATED DECISION-MAKING AND AI SCORING

Reepeet uses automated technologies to assess musical performances and generate scores or feedback.

For some competitions, these scores may materially influence rankings and prize eligibility.

We aim to provide meaningful information about the principal assessment criteria used in relevant competitions.

Where a decision is subject to applicable legal protections concerning automated decision-making, users may exercise their rights to request appropriate human intervention, express their position, or challenge the decision, as provided by law.

Reepeet shall maintain procedures for reviewing credible claims of technical error, incorrect scoring, or unfair disqualification.

Further details are provided in the Competition Rules and Prize Policy.

10. CHILDREN'S PRIVACY AND PARENTAL CONSENT

Reepeet supports music learning for users of different ages, including children, subject to appropriate safeguards.

10.1 Learning Access for Minors

Users under 18 years of age may access age-appropriate learning and practice features where permitted by applicable law.

Reepeet shall obtain verifiable parental or guardian consent where required and apply appropriate protections to children's personal information.

10.2 Cash-Prize Competition Restrictions

Users under 18 years of age are strictly prohibited from participating in cash-prize competitions.

Age verification measures may be used to enforce this restriction.

10.3 Data Minimisation

Reepeet shall seek to minimise the personal information collected from children and avoid unnecessary collection of sensitive information.

10.4 Children's Recordings and Publicity

Children's recordings and identifiable information shall not be used for unrelated advertising or public promotional campaigns without the necessary lawful permissions and safeguards.

10.5 Parental Rights

Parents and legal guardians may contact Reepeet to request information about a child's account, exercise applicable privacy rights on the child's behalf, or raise concerns regarding the child's personal information.

Reepeet may require reasonable verification of parental or guardian authority before responding.

10.6 Protective Measures

Reepeet may restrict public profiles, direct communications, competition access, or other features for minors where necessary to protect their privacy and safety.

11. SHARING OF PERSONAL INFORMATION

Reepeet does not sell users' personal information to data brokers.

We may disclose personal information to the following categories of recipients where lawful and necessary:

11.1 Service Providers

Providers supporting hosting, storage, authentication, AI processing, communications, analytics, payment processing, and security.

11.2 Payment Providers

Authorised financial and payment service providers processing subscription charges, refunds, or prize payments.

11.3 Competition Administration

Authorised personnel and service providers involved in eligibility verification, scoring review, fraud investigation, and prize administration.

11.4 Teachers and Organisations

Where a user participates in teacher-managed or organisational learning services, relevant information may be shared with authorised teachers or administrators to the extent necessary for the requested service and subject to appropriate permissions.

11.5 Legal and Regulatory Authorities

Where disclosure is required by law, a valid legal process, or an applicable regulatory obligation.

11.6 Corporate Transactions

Where necessary in connection with a lawful merger, acquisition, restructuring, or transfer of business assets, subject to appropriate confidentiality and data protection safeguards.

We require processors acting on our behalf to process personal information only for authorised purposes and in accordance with applicable obligations.

12. INTERNATIONAL DATA TRANSFERS

Reepeet may use technology providers whose infrastructure or personnel are located outside Nigeria.

Where personal information is transferred internationally, Reepeet shall assess the applicable legal requirements and implement an appropriate transfer mechanism or safeguard under Nigerian data protection law.

Such measures may include recognised adequacy arrangements, approved contractual or other transfer instruments, or another legally permitted basis.

Reepeet shall not assume that using a foreign cloud or AI provider automatically makes an international transfer lawful.

Users may request further information about applicable transfer safeguards through Reepeet Support.

13. DATA STORAGE AND RETENTION

Reepeet retains personal information only for as long as reasonably necessary for the purposes for which it was collected, including applicable legal, contractual, security, and regulatory requirements.

Retention periods may differ depending on the information involved.

For example:

Account Information: Retained while an account is active and for any additional period justified by applicable obligations.

Learning and Performance Records: Retained as necessary to provide learning history, assessment functionality, and related services.

Competition Records: Retained for competition administration, verification, appeals, fraud prevention, and applicable legal or regulatory requirements.

Payment Records: Retained as necessary for accounting, taxation, payment disputes, and other legal obligations.

Support Records: Retained as reasonably necessary to resolve enquiries, document outcomes, and manage disputes.

Technical Logs: Retained for appropriate operational, diagnostic, and security purposes.

When personal information is no longer required, Reepeet shall delete, anonymise, or otherwise securely dispose of it in accordance with applicable law.

A more detailed retention schedule shall be maintained internally and reflected in operational systems.

14. DATA SECURITY

Reepeet is committed to implementing reasonable technical and organisational measures to protect personal information.

Depending on the systems involved, these measures may include:

• a. Access controls and authentication.
• b. Encryption in transit and, where appropriate, at rest.
• c. Secure hosting and storage configurations.
• d. Restricted administrative access.
• e. Security monitoring and logging.
• f. Backup and recovery procedures.
• g. Vulnerability management.
• h. Confidentiality obligations for authorised personnel.
• i. Appropriate security requirements for service providers.

No internet-based service can guarantee absolute security.

However, Reepeet shall take appropriate steps to prevent unauthorised access, unlawful processing, loss, or disclosure of personal information.

15. PERSONAL DATA BREACHES

Where Reepeet becomes aware of a personal data breach, it shall investigate the incident and take appropriate containment, mitigation, and remediation measures.

Where required by applicable law, Reepeet shall notify the Nigeria Data Protection Commission and affected individuals within the applicable statutory timelines.

Notifications shall include the information required by law, taking into account the nature of the incident and the risks to affected individuals.

16. YOUR DATA PROTECTION RIGHTS

Subject to applicable law and relevant exceptions, users may have the right to:

• a. Be Informed: Receive information about how their personal data is processed.
• b. Access: Request access to personal information held about them.
• c. Rectification: Request correction of inaccurate or incomplete information.
• d. Erasure: Request deletion of personal information where legally applicable.
• e. Restriction: Request restriction of certain processing activities.
• f. Objection: Object to processing in circumstances recognised by law, including applicable direct marketing activities.
• g. Data Portability: Request relevant personal information in an appropriate format where the legal conditions are satisfied.
• h. Withdraw Consent: Withdraw consent where consent is the lawful basis for processing.
• i. Challenge Certain Automated Decisions: Exercise applicable rights concerning qualifying automated decisions.
• j. Lodge a Complaint: Submit a complaint to the Nigeria Data Protection Commission.

Reepeet shall not discriminate unlawfully against users for exercising their data protection rights.

17. HOW TO EXERCISE YOUR PRIVACY RIGHTS

Users may submit privacy requests to:

support@reepeet.ai

Requests should describe the relevant issue or right being exercised.

Reepeet may request information reasonably necessary to verify the identity of the requester and protect personal information from unauthorised disclosure.

Requests shall be handled within applicable legal timelines.

Where Reepeet cannot fully comply with a request because of a lawful exception, the user shall receive an appropriate explanation.

Parents or legal guardians may submit eligible requests concerning children's personal information, subject to verification and applicable law.

18. ACCOUNT DELETION

Users may request deletion of their Reepeet account and associated eligible personal information.

Following a valid deletion request, Reepeet shall take reasonable steps to delete or anonymise personal information that is no longer required.

Certain information may be retained where necessary to comply with legal obligations, resolve disputes, prevent fraud, enforce lawful claims, or preserve valid competition and financial records.

Where technically available, account deletion may be initiated through the Platform's account settings.

Otherwise, users may contact Reepeet Support.

Account deletion may result in loss of access to subscriptions, learning history, stored performances, and other account-related features.

Any outstanding consumer rights, valid prize entitlements, or legal obligations shall be handled in accordance with applicable law.

19. MARKETING AND COMMUNICATION PREFERENCES

Reepeet may send users transactional or service-related communications, including:

• Account verification messages.
• Security notifications.
• Subscription and billing updates.
• Competition information.
• Prize-related notifications.
• Important changes to Platform services.

These communications may be necessary for the operation of the service.

Promotional communications shall be sent in accordance with applicable marketing and data protection requirements.

Where required, users shall be able to provide or withdraw marketing consent.

Users may unsubscribe from optional marketing communications without losing access to unrelated Platform services.

20. COOKIE POLICY

20.1 What Are Cookies?

Cookies are small text files or similar technologies placed on a device when a user visits a website or uses certain online services.

They help websites remember preferences, maintain sessions, understand usage, and provide selected functionality.

Reepeet may also use similar technologies, such as local storage or software development kit identifiers, where applicable.

20.2 Categories of Cookies

Strictly Necessary Cookies

These support essential website and Platform functions, including authentication, session management, security, and basic service operation.

Preference Cookies

These may remember selected settings, such as language, interface preferences, or other user choices.

Analytics Cookies

These may help Reepeet understand how visitors use the website, identify technical issues, and improve Platform performance.

Marketing Cookies

Where implemented, these may support advertising measurement, campaign attribution, or other promotional activities.

Reepeet shall disclose the categories actually used and shall not describe optional cookies as strictly necessary merely to avoid consent requirements.

20.3 Cookie Consent

Where required by applicable law, Reepeet shall request appropriate consent before placing or accessing non-essential cookies or similar technologies.

Users shall be provided with meaningful choices concerning optional cookie categories.

Declining optional cookies shall not prevent access to services that do not depend on them.

20.4 Managing Cookies

Users may manage cookies through available Reepeet cookie controls and their browser settings.

Disabling strictly necessary technologies may affect authentication or other essential Platform functions.

20.5 Third-Party Cookies

Where Reepeet integrates third-party analytics, advertising, or other technologies, those providers may process relevant information in accordance with their applicable roles and privacy notices.

Reepeet shall assess and disclose relevant third-party cookie practices as required by law.

21. LINKS TO THIRD-PARTY WEBSITES

Reepeet may contain links to external websites, services, or resources.

These services may operate under their own privacy policies and terms.

Users should review the privacy practices of third-party services before providing personal information.

Reepeet is not responsible for independent processing activities conducted by third parties outside its control, except to the extent required by law.

22. DATA PROTECTION GOVERNANCE

Reepeet shall maintain appropriate data protection governance measures proportionate to the nature, scale, and risks of its processing activities.

These may include:

• a. Internal data protection procedures.
• b. Appropriate staff confidentiality and access controls.
• c. Vendor due diligence and processing agreements.
• d. Personal data retention procedures.
• e. Security incident response procedures.
• f. Data protection impact assessments where required.
• g. Appropriate oversight of children's data and AI processing.
• h. Regulatory registration, reporting, or appointment of a data protection officer where legally required.

Reepeet shall review its obligations as the Platform grows and its processing activities change.

23. CHANGES TO THIS POLICY

Reepeet may update this Privacy & Cookie Policy to reflect changes in technology, Platform features, data processing practices, legal requirements, or business operations.

Where changes materially affect users' privacy rights or the purposes of processing, Reepeet shall provide appropriate notice and obtain additional consent where legally required.

The latest version shall be published on the Reepeet website and Platform.

24. COMPLAINTS AND REGULATORY RIGHTS

Users who believe their personal information has been processed unlawfully or that their privacy rights have been infringed may contact Reepeet Support.

Reepeet shall investigate complaints in good faith and respond in accordance with applicable legal requirements.

Users also have the right to lodge complaints with the Nigeria Data Protection Commission (NDPC).

Information about the Commission is available at:

https://ndpc.gov.ng

Nothing in this Policy restricts a user's right to seek lawful regulatory or judicial remedies.

25. GOVERNING LAW

This Policy shall be governed by the applicable laws of the Federal Republic of Nigeria, including relevant data protection legislation.

Where another jurisdiction's mandatory privacy laws apply to particular processing activities, Reepeet shall comply with those requirements to the extent applicable.

26. CONTACT INFORMATION

For questions, complaints, legal notices, or other enquiries concerning this Policy, users may contact:

REEPEET

Legal Entity: Reepeet Nigeria Limited

General Support: support@reepeet.ai

Website: https://reepeet.ai

27. ACKNOWLEDGEMENT

By using Reepeet, you acknowledge that this Privacy & Cookie Policy explains how your personal information may be processed in connection with the Platform.

Where consent is legally required for particular processing activities, Reepeet shall obtain that consent through an appropriate mechanism.

Users under 18 years of age may access eligible learning features subject to applicable parental consent and child protection requirements, but are not permitted to participate in cash-prize competitions.

© 2026 Reepeet Nigeria Limited. All rights reserved.