Security & Data Compliance
LearnWay is engineered to meet global and regional data protection standards (GDPR, NDPR, POPIA, LGPD, and Apple/Google App Store privacy guidelines) while balancing the immutability of blockchain technology with user privacy rights.Data Privacy & Compliance Topology
1. Regulatory Frameworks & Compliance Controls
A. GDPR (General Data Protection Regulation)
- Right to Erasure (“Right to be Forgotten”):
- Implemented via self-serve
DELETE /api/v2/user/profileand administrativeDELETE /api/v2/user/:userId. - Cascades deletions across user records, battle participation logs, badge progress entries, and purges uploaded avatar files from the ImageKit CDN.
- Implemented via self-serve
- Right of Access & Data Portability:
- Users can export or inspect all profile data, learning history, quiz results, and wallet balances via
GET /api/v2/user/profile,GET /api/v2/user/me, and thetransactions_apiv2/ledger API.
- Users can export or inspect all profile data, learning history, quiz results, and wallet balances via
- Right to Rectification:
- Users maintain complete control over their display name, country code, preferred UI language, and wallet address linkages via
PATCH /api/v2/user/profile.
- Users maintain complete control over their display name, country code, preferred UI language, and wallet address linkages via
- Data Minimization:
- LearnWay collects strictly minimal personal data: email or social OAuth identifier, optional username, country code, and preferred language. Biometric data and government IDs are never requested or stored on backend servers.
B. Regional Data Protection (NDPR, POPIA, LGPD)
- LearnWay operates across high-growth emerging markets supported by localized mobile money and airtime rails (NGN, KES, GHS, UGX, ZAR, BRL via Fonbnk):
- Nigeria Data Protection Regulation (NDPR): Explicit user consent obtained during account creation; strict purpose limitation for payment processing.
- South Africa POPIA: Lawful processing of user activity metrics and notification preferences.
- Brazil LGPD: Rigorous handling and cryptographic separation of payment order identifiers from general student learning data.
C. Apple App Store & Google Play Privacy Guidelines
- Mandatory In-App Account Deletion (Apple Guideline 5.1.1(v)):
- Apps that offer account registration must provide an accessible, instant in-app account deletion flow. LearnWay exposes this directly via mobile settings calling
DELETE /api/v2/user/profile.
- Apps that offer account registration must provide an accessible, instant in-app account deletion flow. LearnWay exposes this directly via mobile settings calling
- Client-Side Biometric & Key Isolation:
- Private keys, wallet recovery seeds, and biometric authentication data remain exclusively within native mobile device hardware (
iOS Keychain/Android Keystore) and are never transmitted to backend servers.
- Private keys, wallet recovery seeds, and biometric authentication data remain exclusively within native mobile device hardware (
D. KYC & AML Compliance via DIDit (Decentralized Identity)
- Zero PII Identity Absorption:
- LearnWay delegates all Know-Your-Customer (KYC), Anti-Money Laundering (AML), and proof-of-humanity verification directly to DIDit.
- DIDit handles biometric scanning, official government document validation, and AML watchlist screening entirely within its regulated infrastructure.
- Cryptographic Attestations:
- LearnWay’s backend and databases never store or process raw identity documents, passport scans, or facial biometric templates.
- LearnWay only receives a cryptographically signed verification attestation (e.g.
verificationStatus: VERIFIED,kycLevel: 1,attestationHash).
- Compliance Liability Isolation:
- By outsourcing identity verification to DIDit, all regulatory data protection, document retention, and cross-border privacy compliance concerns surrounding sensitive KYC identity documents are fully absorbed by DIDit.
2. Web3 On-Chain Data Privacy & Immutability Reconciliation
A core architectural challenge in decentralized applications is reconciling GDPR’s Right to Erasure with the immutable nature of blockchain ledgers.Architectural Safeguards:
- Zero Personally Identifiable Information (PII) On-Chain:
- No names, emails, phone numbers, passwords, PINs, or private keys are ever submitted to the Lisk L2 blockchain.
- Pseudonymous Identifiers:
- On-chain smart contracts (
LearnWayManager,XPContract,GemContract,BadgesNFT,LearnWayCertificate) only store pseudonymous cryptographic addresses (0x...), token IDs, numeric XP/Gem values, and decentralized IPFS metadata hashes.
- On-chain smart contracts (
- Irreversible Anonymization Upon Deletion:
- When a user triggers account deletion, all off-chain PII linking their real identity to their public wallet address is permanently deleted from PostgreSQL and caches. Past on-chain transactions remain mathematically pseudonymous with zero linkage to real-world identity.