Privacy notice

This notice explains what personal data AI Learner collects, why, who else handles it, how long we keep it and what you can ask us to do with it. We are the data controller for your data under Kenya's Data Protection Act, 2019.

What we collect

• Your account: your name, email address, the name you want on your certificate, and your password (stored only as a one-way hash). If you sign in with Google, we receive your name and email address from Google.
• Your learning: which lessons you have opened, your answers to exercises, quizzes and checks, and your results.
• What you send to the AI: the text you type into AI exercises, and the replies and feedback the AI gives you.
• Payments: the M-Pesa phone number you pay from, the amount, the date and the M-Pesa receipt number.
• Technical records: sign-in records needed to keep you signed in on one device, error logs, and a scrambled (hashed) form of your IP address stored with your consent choices as evidence of when you gave them.

Your phone number is for payment only

We ask for a phone number only so M-Pesa can send you a payment prompt. We store it with the payment record, show it masked (for example 2547••••1234) on screens and in our logs, and never use it for marketing, calls or SMS.

Why we use it

• To provide the course you signed up for: your account, progress, feedback and certificate (performing our contract with you).
• To take payment and keep records the law requires (contract and legal obligation).
• To keep the service secure, prevent abuse and keep AI costs within limits (our legitimate interests).
• To email you about new courses, only if you ticked the box for it (your consent, which you can withdraw at any time).

AI processing outside Kenya

When you run an AI exercise, the text you type is sent to Anthropic, an AI company whose systems are outside Kenya (mainly in the United States), together with the exercise instructions. Anthropic processes it on our behalf to produce a reply. Under its terms for business customers, Anthropic does not use this content to train its models. We send only what the exercise needs, never your email address or phone number.

AI feedback on your answers is automated and always labelled as AI output. It is there to help you learn; it does not on its own decide whether you pass the course or get a certificate. If you think an automated result about you is wrong, contact us and a person will look at it.

Please do not type other people's personal information, or anything confidential, into an exercise.

Who handles your data

We use a small number of service providers who process data only on our instructions:

• Supabase: our database and sign-in service.
• Vercel: hosts the website.
• Anthropic: runs the AI model in the exercises.
• Safaricom (M-Pesa): processes your payment.
• Our email provider: delivers account and receipt emails.
• Google: only if you choose to sign in with Google.

Some of these providers store data outside Kenya. We only use providers that protect personal data to a standard comparable to Kenyan law. We never sell your data, and we share it with authorities only when the law requires us to.

How long we keep it

• What you send to the AI and its replies: deleted 12 months after you send them.
• Your account and learning records: for as long as your account is open.
• Payment records: for as long as Kenyan tax and accounting law requires, even if you close your account.
• Consent records: kept as evidence of what you agreed to, for as long as we hold your data.
• Certificates: the public verification page stays live unless you ask us to remove it.

Your rights

Under the Data Protection Act you can ask us to:

• tell you what data we hold about you and give you a copy, including in a machine-readable form (data export);
• correct data that is wrong (you can change your name yourself on your account page);
• delete your data (we anonymise your profile, delete your AI exercise history and keep only what the law requires, such as payment records);
• stop using your data for a purpose you object to, including marketing;
• withdraw consent you have given, at any time.

To make a request, email us from the address on your account. We will reply within 7 days and complete the request as soon as we can. If you are not happy with how we handle your data, you can complain to the Office of the Data Protection Commissioner (odpc.go.ke).

Keeping it safe

Data travels encrypted between your device and our services. Passwords are hashed, access to data is restricted to what each part of the system needs, and your account can be signed in on only one device at a time. If a breach puts your data at risk, we will tell you and the Data Protection Commissioner as the law requires.

Cookies

We use only the cookies the site needs to work, such as the one that keeps you signed in. We do not use advertising or cross-site tracking cookies.

Children

The course is for adults. We do not knowingly collect data from anyone under 18.

Changes to this notice

The version and date at the top tell you which notice you are reading. If we make a change that matters, we will ask you to read the new version the next time you sign in.