Trust, Security & Privacy

Sign-in is handled through our managed identity provider with email/password and Google OAuth. Passwords are never stored in our own database — they are managed by the auth provider.

Sessions are scoped to the signed-in user. Administrative areas (/admin/*) require an explicit admin role assignment that lives in a dedicated role table separate from user profiles.

Every user-owned table in our database enforces row-level security so users can only read and modify their own records. Privileged operations (refunds, role grants, webhook ingestion) run through server-side code paths and are authorized before execution.

Staff access to operational fields is limited to the admin dashboard and recorded in audit tables (payment_logs, webhook_events).

Payments are processed securely by Paystack. We never see or store full card numbers, CVVs or bank credentials — those go directly to the processor.

Webhooks from the processor are verified with HMAC signatures against a server-only secret, deduplicated by event id, and only then trigger order fulfilment.

Account basics (name, email, optional phone), learning activity (courses, lessons, exam attempts, AI chats you initiate), application materials you upload (CVs, profile photos), and payment metadata required to deliver what you bought. We do not sell personal data.

You can request export or deletion of your account data by contacting us at the address below.

We rely on a small set of trusted providers to operate the service: our hosting and database provider, the email/SMS sender for transactional messages, the payment processor (Paystack), and the AI model providers that power chat and content generation. Each provider is used only for the function described.

We use essential cookies needed for sign-in and to remember your preferences, plus first-party usage analytics so we can improve the product. We do not use cross-site advertising trackers.

If you believe you have found a security issue, please email humanitytechlimited@gmail.com with a description and steps to reproduce. Please do not publicly disclose the issue until we have had a chance to investigate and remediate.

For account or billing issues, reach us on WhatsApp or via the FAQ & Support page.

HumanityAi runs on the Lovable platform, which provides hosting, the managed database with row-level security, secret storage, and TLS in transit. Configuring those controls correctly for this app — RLS policies, role checks, server-only secrets, webhook verification — is our responsibility as the app owner. Keeping your own password safe and not sharing your account is yours.

Last reviewed: August 2026.