Privacy Policy

ElimuAI is an AI-powered personalised learning platform operated by Venus Unzag Limited, a company incorporated under the laws of Kenya (“we”, “us”, “our”). We are committed to protecting the privacy and personal data of all users of the ElimuAI platform, website, and mobile application (collectively, “the Platform”).

This Privacy Policy explains how we collect, use, store, share, and protect your personal data. It applies to all users across Kenya, Uganda, and Tanzania, and has been prepared in compliance with:

• The Data Protection Act, 2019 (Kenya) and the Data Protection (General) Regulations, 2021
• The Data Protection and Privacy Act, 2019 (Uganda)
• The Personal Data Protection Act, 2022 (Tanzania)

3.1 Data We Collect from Parents and Guardians

• Full name and email address
• Phone number and M-Pesa or card payment details (payment data is processed by M-Pesa Daraja and Stripe — we do not store card numbers)
• Country and county of residence
• Subscription plan and billing history
• Referral code used at sign-up (if applicable)

3.2 Data We Collect from Students / Learners

• First name and year of study / grade level (provided by parent or guardian)
• Learning activity data — subjects accessed, questions asked, quiz scores, time spent on platform
• AI interaction logs — questions submitted to the AI tutor and responses received
• Progress data — areas of strength and areas requiring improvement

3.3 Data We Collect from Teachers and School Administrators

• Full name, email address, phone number
• School name, county, and TSC number (for teachers)
• Class and student roster data (for class management features)
• Assignment and assessment data created on the platform
• Student progress reports accessed through the teacher dashboard

3.4 Data We Collect Automatically

• Device type, operating system, and browser
• IP address and approximate location (country/county level only)
• Session data — pages visited, features used, time on platform
• Referral and affiliate tracking data (cookie-based, 30-day window for affiliates)
• Offline usage logs when the app is used without internet connectivity

5.1 ElimuAI is designed to be used by learners from Pre-Primary 1 (PP1) to Grade 9. All learners on the platform are under 18 years of age and are therefore classified as children under applicable data protection laws.

5.2 We require a parent or legal guardian to create and manage a child’s account. By creating a child account, the parent or guardian provides explicit, verifiable consent for the collection and processing of that child’s data as described in this Policy.

5.3 We apply the following additional protections to children’s data:

• We collect only the minimum data necessary for the child to use the platform effectively
• We never use children’s data for targeted advertising or profiling for commercial purposes
• We never share children’s personal data with third parties for their own marketing
• We never sell children’s data under any circumstances
• AI interactions by children are monitored for safety and are not used to build individual commercial profiles
• Children’s data is stored with enhanced access controls and encryption

5.4 For school accounts, the school acts as a co-data controller for student data within its roster. Schools must ensure they have obtained appropriate parental consent. Parents and guardians may at any time request access to, correction of, or deletion of their child’s data by contacting us at support@elimuai.africa. We will respond within 21 days.

We share data only in the following limited circumstances:

7.1 Some of our service providers are located outside Kenya, Uganda, and Tanzania. Where we transfer personal data outside the originating country, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by relevant data protection authorities
• Adequacy decisions where applicable
• Data processing agreements with all third-party processors

7.2 We ensure that any cross-border transfer of children’s data is subject to the same or higher level of protection as required under the law of the originating country.

Depending on your country of residence, you have the following rights regarding your personal data:

To exercise any of these rights, submit a request through the ElimuAI app (Settings → Privacy → Data Rights) or email support@elimuai.africa. We will respond within 21 days in Kenya and Uganda, and within 30 days in Tanzania.

If you are not satisfied with how we have handled your data, you may lodge a complaint with the relevant authority:

11.1 We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These measures include:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• Role-based access controls — staff can only access data necessary for their role
• Regular security audits and vulnerability assessments
• Secure coding practices and penetration testing
• Children’s data stored in isolated, access-controlled environments

11.2 In the event of a data breach affecting your personal data, we will notify you and the relevant Data Protection Authority within 72 hours of becoming aware of the breach, in accordance with applicable law.

Please refer to our separate Cookie and Tracking Notice for detailed information on the cookies and tracking technologies used on the ElimuAI Platform. You can manage your cookie preferences at any time through the cookie consent banner in the app.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email and an in-app notice at least 14 days before the changes take effect. The updated Policy will always be available at elimuai.africa/privacy. Continued use of the Platform after the effective date constitutes acceptance of the updated Policy.