Privacy Policy

Last Updated: January 2025

1. Introduction

G-elimishe ("we," "our," or "us") is an AI-powered educational platform that delivers curriculum-aligned lessons via WhatsApp. This Privacy Policy applies to all users of our services, including teachers, students, school administrators, and website visitors.

2. Data Controller Information

Data Controller: G-elimishe
Physical Address: Nairobi, Kenya
Email: privacy@g-elimishe..com
Data Protection Officer: dpo@g-elimishe.com

3. Information We Collect

3.1 Information You Provide

• Account Information: Name, email address, phone number (WhatsApp), school name, role (teacher/student), county
• Educational Data: Subject preferences, grade level, curriculum type, class assignments, quiz responses
• Communication Data: Messages sent via WhatsApp, support inquiries, feedback
• Payment Information: For paid plans - M-Pesa number, transaction IDs (we do not store credit card details)

3.2 Information Collected Automatically

• Usage Data: Pages visited, features used, time spent on platform, device type, browser type
• Technical Data: IP address, device identifiers, operating system, network information
• Performance Data: Lesson completion rates, quiz scores, engagement metrics

3.3 Student Data

For users under 18 years of age:

• We collect only the minimum data necessary for educational purposes
• We require parental or guardian consent before collecting student data
• Student data is used solely for educational purposes
• We never sell or share student data with third parties for marketing

4. How We Use Your Information

4.1 Primary Uses

• Deliver educational content via WhatsApp
• Generate AI-powered lessons and assessments
• Provide automated marking and feedback
• Track learning progress and provide analytics
• Facilitate communication between teachers and students
• Process payments and manage subscriptions
• Provide customer support
• Improve our services through analysis and research

4.2 Legal Basis for Processing (Kenya Data Protection Act)

• Consent: When you agree to use our services
• Contract: To fulfill our service agreement with you
• Legitimate Interest: To improve our platform and prevent fraud
• Legal Obligation: To comply with Kenyan laws and regulations

5. Data Sharing and Disclosure

5.1 We Share Data With:

• Service Providers: WhatsApp Business API, cloud hosting (AWS/Google Cloud), AI processing services, payment processors (M-Pesa)
• School Administrators: Teachers within your school can access class performance data
• Parents/Guardians: Progress reports for their children (with appropriate consent)
• Legal Authorities: When required by Kenyan law or court order

5.2 We Do NOT:

• Sell your personal data to third parties
• Share student data for advertising or marketing purposes
• Use your data for purposes other than education delivery

6. Data Storage and Security

6.1 Where We Store Your Data

Your data is stored on secure servers located in:

• Primary: Kenya (compliance with data localization requirements)
• Backup: European Union (GDPR-compliant data centers)

6.2 Security Measures

• End-to-end encryption for WhatsApp communications
• SSL/TLS encryption for website data transmission
• Encrypted storage of all personal data
• Regular security audits and penetration testing
• Access controls and authentication (teacher/admin only access)
• Regular backups and disaster recovery procedures
• Staff training on data protection practices

6.3 Data Retention

• Active accounts: Data retained while account is active
• Inactive accounts: Deleted after 2 years of inactivity
• Student records: Retained for 5 years for educational purposes, then archived or deleted
• Financial records: Retained for 7 years as required by Kenyan tax law
• Marketing data: Deleted upon opt-out request

7. Your Rights Under Kenya Data Protection Act

You have the following rights regarding your personal data:

7.1 Right to Access

Request a copy of all personal data we hold about you

7.2 Right to Correction

Request correction of inaccurate or incomplete data

7.3 Right to Deletion

Request deletion of your personal data (subject to legal retention requirements)

7.4 Right to Object

Object to processing of your data for certain purposes

7.5 Right to Data Portability

Request transfer of your data to another service provider

7.6 Right to Withdraw Consent

Withdraw consent at any time where processing is based on consent

7.7 Right to Lodge a Complaint

File a complaint with the Office of the Data Protection Commissioner of Kenya

8. Children's Privacy

G-elimishe is designed for use in educational settings with appropriate adult supervision. For users under 18:

• We require parental or school consent before collecting data
• We collect minimal data necessary for education
• Parents/guardians can request access to, correction of, or deletion of their child's data
• We never use student data for marketing purposes
• We comply with all provisions of the Kenya Data Protection Act regarding children

9. Cookies and Tracking

Our website uses cookies to:

• Remember your preferences
• Analyze website traffic (Google Analytics)
• Improve user experience

You can control cookies through your browser settings. Disabling cookies may affect website functionality.

10. Third-Party Services

We use the following third-party services:

• WhatsApp Business API: For lesson delivery (subject to WhatsApp Privacy Policy)
• Google Cloud/AWS: For hosting and storage
• OpenAI: For AI content generation (no personal data shared)
• M-Pesa: For payment processing (Safaricom privacy policy applies)

11. International Data Transfers

When we transfer data outside Kenya, we ensure:

• Adequate level of protection as required by Kenya Data Protection Act
• Use of Standard Contractual Clauses
• Compliance with destination country's data protection laws

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Email notification to registered users
• WhatsApp message to active users
• Notice on our website

Continued use of our services after changes indicates acceptance of the updated policy.

13. Data Breach Notification

In the event of a data breach affecting your personal data, we will:

• Notify the Office of the Data Protection Commissioner within 72 hours
• Notify affected users within 72 hours
• Take immediate steps to mitigate harm
• Provide information on steps you can take to protect yourself

14. Contact Information

15. Consent

By using G-elimishe's services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and disclosure of your personal data as described herein.

Effective Date: January 1, 2025
Version: 1.0