Privacy Policy

1. Who we are

EDU AI Research Ltd ("EDU AI", "we", "our" or "us") is a company established in Kenya that builds AI-powered assessment and insight tools for education systems, schools, and teachers (the "Services").

This Privacy Policy explains how we collect, use, store, and share information when you:

• Visit our website (the "Website"),
• Use our assessment and insights platform and related apps (together, the "Platform"), or
• Interact with us in ways that reference this Privacy Policy (for example, by email or through social media pages we control).

We take privacy seriously and aim to comply with applicable laws, including the Kenya Data Protection Act, 2019 and its regulations, and, where relevant, other data protection laws such as the EU/UK GDPR.

2. When this Privacy Policy applies

This Privacy Policy applies to:

• Visitors to our Website,
• Users of our Platform (for example, teachers, school administrators, and officials), and
• Individuals whose data is processed through the Platform (for example, learners whose assessments are captured).

It does not cover:

• Our employees and job applicants (who are covered by separate notices), or
• Services, products, or websites that have their own privacy policies or that do not link to this one.

By using the Website or Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, you should not use our Website or Platform.

3. Information we collect

3.1 Information you provide directly

We collect information that you choose to share with us, for example when you:

• Fill in forms on the Website (e.g. "contact us", "request a demo", "sign up for updates"),
• Create or manage an account on the Platform,
• Communicate with us by email, phone, or messaging apps,
• Respond to surveys, pilots, or research activities,
• Provide feedback or participate in user testing.

Depending on how you interact with us, this may include:

• Identifiers and contact details: Name, email address, phone number, organization/school name, job title, county/country.
• Account details: Login identifier, hashed password (we do not store plain-text passwords).
• Professional information: Role (e.g. teacher, principal, policymaker), subjects taught, grades handled.
• Communications: Messages you send us, your feedback, support queries, or other content you choose to share.

Learner and assessment data (through institutions)

When we work with schools, ministries, or other education partners, they may upload or capture:

• Learner identifiers: Name, student number, class, grade level, school, region, or similar.
• Assessment data: Scripts, answers, scores, feedback, and other information generated during exams or classroom assessments.
• Context data (optional, as configured by the institution): For example, responses to "bonus questions" about learning environment or aspirations, where allowed.

In most cases, the school or education authority is the data controller for learner data, and EDU AI acts as a data processor on their instructions.

3.2 Information collected automatically

When you visit the Website or use the Platform, we automatically collect some technical information, including:

• Log and usage data: IP address, browser type and version, device type, pages visited, date and time of request, referring/exit pages, and general interaction with the Website or Platform.
• Device data: Operating system, language settings, and crash or performance data.
• Approximate location: Derived from your IP address (e.g. country or city level), where allowed by law.

This information helps us operate, secure, and improve our Services.

3.3 Cookies and similar technologies

We use cookies and similar technologies on the Website and Platform to:

• Keep you logged in and enable core features (strictly necessary cookies),
• Understand how visitors use our Website (analytics cookies),
• Remember your preferences (such as language),
• In some cases, support outreach or awareness about our work (for example, via analytics or limited marketing tools).

Some of these cookies may be provided by third parties (such as analytics providers). You can control cookies through your browser settings and, where available, through our cookie banner or settings page.

4. How we use your information

We use the information we collect for the following purposes:

1. To provide and operate our Website and Platform
   • Creating and managing user accounts,
   • Processing assessments, generating feedback, dashboards, and analytical reports,
   • Ensuring the Services function as intended.
2. To support educators, institutions, and partners
   • Responding to requests and support queries,
   • Providing training, documentation, and onboarding support,
   • Communicating about updates, features, and improvements.
3. To improve and develop our Services
   • Analysing how the Website and Platform are used,
   • Training and testing our AI models and systems,
   • Conducting research and development, with a strong focus on privacy and data minimisation.

   When possible, we anonymise or aggregate data so that individuals cannot be identified.

4. To communicate with you
   • Sending administrative messages (e.g. account notices, security alerts),
   • Sharing newsletters, event invitations, and product updates (where permitted).

   You can opt out of non-essential communications at any time by following the unsubscribe instructions in our emails.

5. To ensure security and prevent misuse
   • Detecting and preventing fraud, abuse, or security incidents,
   • Protecting the rights, property, and safety of EDU AI, our users, and others.
6. To comply with legal and regulatory obligations
   • Complying with the Kenya Data Protection Act, 2019 and other applicable laws,
   • Responding to lawful requests from public authorities or regulators, where required.

5. Legal bases for processing

Where the Kenya Data Protection Act, GDPR, or similar laws apply, we rely on one or more of the following legal bases to process personal data:

• Consent – for example, when you sign up for our newsletter or accept certain cookies.
• Performance of a contract – for example, where processing is necessary to provide our Platform to a school or institution.
• Legitimate interests – for example, to improve our Services, secure our systems, or communicate with users about our work, where these interests are not overridden by your rights and freedoms.
• Compliance with legal obligations – for example, to meet regulatory requirements or respond to lawful requests from authorities.

You can withdraw your consent at any time where processing is based on consent, without affecting prior lawful processing.

6. How we share information

We do not sell personal data.

We may share information in the following limited situations:

1. Service providers (data processors)

   We work with carefully selected providers who support us with:

   • Cloud hosting and storage,
   • Analytics, error monitoring, and security,
   • Email delivery and communication tools,
   • Customer support and project management.

   These providers may process personal data only on our instructions and are required to implement appropriate security measures.

2. Education partners and institutions

   When a school, ministry, or other authorised institution uses our Platform:

   • We may share relevant dashboards, results, and insight reports with authorised staff within that institution,
   • We will process learner data according to our agreement with the institution and applicable law.
3. Professional advisers and auditors

   Where necessary, we may share limited data with lawyers, auditors, or other professional advisers bound by confidentiality obligations.

4. Legal and regulatory reasons

   We may disclose information if we believe it is reasonably necessary to:

   • Comply with applicable laws, regulations, or legal processes,
   • Respond to lawful requests from authorities,
   • Protect the safety, rights, or property of EDU AI, our users, or others.
5. Business changes

   If we undergo a merger, acquisition, or other restructuring, personal data may be transferred to the relevant successor entity, subject to this Privacy Policy or a policy that offers similar protection.

6. Aggregated or de-identified data

   We may use or share data that has been aggregated or anonymised so it no longer identifies any individual, for research, reporting, or policy purposes.

7. International transfers

Our main operations are in Kenya, but some of our service providers or partners may be based in other countries.

Where personal data is transferred outside Kenya, we will:

• Take steps to ensure that the receiving country or organisation provides adequate protection, or
• Put in place appropriate safeguards (for example, contractual commitments) or rely on your consent, as required under the Data Protection Act, 2019 and its regulations.

For users in the EEA/UK (where applicable), we may also use mechanisms such as Standard Contractual Clauses to protect your data.

8. Data retention

We keep personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy, including:

• The duration of our contract or relationship with your institution,
• Any periods required by law (for example, record-keeping obligations), or
• The time needed to resolve disputes, enforce our agreements, or protect our rights.

After these periods, we will delete, anonymise, or securely archive the data in line with our data retention policies and legal requirements.

9. Security

We implement appropriate technical and organisational measures to safeguard personal data, including:

• Access controls and authentication,
• Encryption in transit (e.g. HTTPS) and, where appropriate, at rest,
• Regular monitoring and testing of systems,
• Policies and training for staff on data protection and security.

No system is completely secure, and we cannot guarantee absolute security. If you believe your interaction with us is no longer secure, please contact us immediately using the details in Section 13.

10. Your rights

Your privacy rights depend on where you live. We aim to respect and support these rights wherever possible.

10.1 Rights under Kenyan law

Under the Kenya Data Protection Act, 2019, and related regulations, individuals (data subjects) generally have the right to:

• Be informed of the use to which their personal data is to be put,
• Access their personal data in the custody of a data controller or data processor,
• Object to the processing of all or part of their personal data,
• Request correction of false or misleading data,
• Request deletion of false or misleading data about them,
• In certain cases, request erasure,
• In certain cases, request data portability,
• In certain cases, request review of decisions based solely on automated processing that significantly affect them.

To exercise any of these rights in relation to EDU AI, please contact us using the details in Section 13. We may need to verify your identity before responding.

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) if you believe your data protection rights have been violated.

10.2 Additional rights in other regions

If you are located in the EEA, UK, or other jurisdictions with specific data protection laws, you may have additional rights (such as the right to restrict processing or to lodge a complaint with your local supervisory authority). Where applicable, we will respect these rights in accordance with local law.

11. Children and learners' data

Our Website is mainly aimed at adults (e.g. teachers, school leaders, policymakers and partners) and not at children directly.

However, our Platform is designed to support education systems, and we may process learner data, including data about minors, on behalf of schools, ministries, or education partners.

In such cases:

• The institution is responsible for ensuring that it has a valid legal basis for sharing learner data with us, including any required parental or guardian consent.
• EDU AI acts as a data processor, processing learner data strictly under the institution's instructions and in line with our agreement and applicable law.

If you are a learner or parent/guardian and have concerns about how your data is processed, you can:

• Contact your school or education institution first, and
• Contact us directly using the details below if your concern relates specifically to EDU AI.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example to reflect changes in law, technology, or our Services. When we make material changes, we will:

• Update the "Last updated" date at the top, and
• Take reasonable steps to notify users where required (for example, via the Website or Platform).

Your continued use of the Website or Platform after changes take effect will mean you accept the updated policy.

13. Contact us

If you have any questions, requests, or complaints about this Privacy Policy or how we handle personal data, you can contact us at:

If you are in Kenya and are not satisfied with our response, you may contact the Office of the Data Protection Commissioner (ODPC) for further assistance.