Privacy Policy

Kenya Mobi Academy ("KMA", "we", "us", or "our") is an educational platform providing digital learning resources, live classes, virtual labs, and assignment management for students, teachers, and schools across Kenya.

This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our mobile application and web platform (collectively, the "Service").

By creating an account or using the Service, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.

We collect the following types of information to provide and improve our Service:

• Account Information: Your name, phone number, email address, school name, class level, and a username/password you choose during registration.

• Device Information: A browser-generated device ID used to manage sessions and prevent unauthorized account sharing.

• Payment Information: Phone numbers used for M-Pesa STK Push transactions, transaction receipts, and payment status. We do not store your M-Pesa PIN or full bank details.

• Educational Data: Assignment submissions (including photos of student work), AI-generated marks and feedback, test results, and program performance data.

• Usage Data: Feature usage counts (e.g., AI questions asked per day) to enforce fair usage limits on subscription plans.

• Communications: Feedback and messages you submit through the in-app feedback tool.

We use your personal data to:

• Create and manage your account, including authentication and session management.

• Process subscription payments via M-Pesa and activate or deactivate access based on payment status.

• Deliver live classes, generate Google Meet links, and send class reminders and notifications.

• Mark assignments using AI and provide feedback to students and report cards to parents via email.

• Allow teachers and school administrators to manage classes, assignments, and student performance.

• Communicate important updates, announcements, and subscription expiry reminders.

• Monitor and improve the Service, including troubleshooting and preventing abuse.

Under the Kenya Data Protection Act, 2019, we process your personal data based on:

• Your consent when you register and use the Service.

• The performance of a contract (your subscription agreement with us).

• Our legitimate interests in operating, securing, and improving the Service.

• Compliance with legal and regulatory obligations.

We do not sell your personal data. We may share your data with the following categories of recipients, only to the extent necessary:

• Safaricom (M-Pesa Daraja API): To process subscription payments. Governed by Safaricom's privacy and security standards.

• Google (Google Calendar API): To generate and manage Google Meet links for live classes. Your calendar data is accessed only for creating class events.

• AI Service Providers (Google Gemini / OpenAI): To power AI exam marking, smart lab, and question-answering features. Only assignment content and questions are sent — not your full personal profile.

• School Administrators: If you are a student using a school-issued device, your school's admin may view your name, device label, and subscription status.

• Parents/Guardians: Report cards and AI feedback may be sent to parent email addresses provided by the student.

• Law Enforcement: If required by law or to protect the rights, safety, or property of KMA, our users, or the public.

We retain your personal data for as long as your account is active or as needed to provide the Service.

• Payment records are retained for a minimum of 7 years for accounting and audit purposes.

• Assignment submissions and results are retained for the duration of the academic program and may be archived thereafter.

• If you request account deletion, we will delete your personal data within 30 days, except where retention is required by law.

We implement appropriate technical and organizational measures to protect your data, including:

• Server-side SHA-256 password hashing — we never store passwords in plain text.

• Role-based access control — only authorized administrators can access sensitive data.

• Encrypted communications (HTTPS/TLS) between your device and our servers.

• Session tokens that expire and are bound to specific devices.

Despite these measures, no system is 100% secure. We will notify affected users and the Office of the Data Protection Commissioner (ODPC) of any data breach within 72 hours of becoming aware of it, as required by Kenyan law.

Under the Kenya Data Protection Act, 2019, you have the right to:

• Access: Request a copy of the personal data we hold about you.

• Rectification: Request correction of inaccurate or incomplete data.

• Erasure (Right to be Forgotten): Request deletion of your personal data.

• Data Portability: Receive your data in a structured, machine-readable format.

• Objection: Object to the processing of your data for specific purposes.

• Withdraw Consent: Withdraw your consent at any time (this does not affect processing done before withdrawal).

To exercise any of these rights, contact us at the details in Section 10 below. We will respond within 7 working days.

Our Service is designed for students of all grade levels, including children under 18.

For users under 18, registration is done with the involvement of a parent, guardian, or school administrator who provides consent on the child's behalf.

We do not knowingly collect personal data from children without parental or school consent. If you believe a child has registered without consent, please contact us and we will delete the account.

Student work (assignment photos) is processed solely for educational marking purposes and is only visible to the student, their teachers, and authorized administrators.

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact our Data Protection Officer:

Email: joabdalmas9@gmail.com

We are committed to resolving your concerns promptly and in accordance with Kenyan data protection law.

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke if you believe your data protection rights have been violated.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements.

We will notify users of material changes via in-app announcement or email at least 14 days before the changes take effect.

The "Last Updated" date at the top of this page indicates when the policy was last revised.