Mkufunzi Academy ("we," "us," or "our") is a Kenyan online tutoring platform serving students in Grades 4–12 (ages 9–16). We are committed to protecting the privacy and personal data of our users, especially minors, in compliance with the Kenya Data Protection Act, 2019.
1. Information We Collect
We collect the following categories of personal data:
- Account information: name, phone number, email address, grade level, and school name.
- Academic data: weak areas, learning goals, progress scores, and curriculum preferences.
- Payment information: M-Pesa phone number and transaction references, or card payment details (processed by third-party providers; see Section 10).
- Usage data: pages visited, session duration, device type, IP address, and interaction logs.
- Camera and microphone data: accessed solely during live video classes (see Section 9).
2. How We Use Your Information
Your information is used to:
- Provide and deliver tutoring services, including matching students with appropriate content and tutors.
- Power AI-driven personalized tutoring sessions (see Section 4).
- Process payments for classes and subscriptions.
- Send notifications about upcoming classes, schedule changes, and account activity via SMS and email.
- Analyze platform usage to improve our services, content quality, and user experience.
3. Children's Data & Parental Consent
Mkufunzi Academy serves students aged 9–16 (Grades 4–12). Because our users are minors, the following safeguards apply:
- Parental consent is required for all students under 18 years of age before any personal data is collected or processed, in accordance with the Kenya Data Protection Act, 2019.
- Parents or legal guardians may review, modify, or request deletionof their child's personal data at any time by contacting us at privacy@mkufunzidigital.com.
- We collect only the minimum data necessary to provide our tutoring services and do not sell children's data to third parties.
- Parents may withdraw consent at any time, which may result in the suspension of the student's account and related services.
4. AI-Powered Tutoring
Mkufunzi Academy uses AI-powered tutoring provided by Anthropic (Claude AI) to deliver personalized learning experiences. To enable this service, we share the following student data with Anthropic:
- Student's first name
- Grade level
- Curriculum (e.g., CBC, 8-4-4)
- Academic weak areas and learning goals
This data is processed on Anthropic's servers located in the United States. Anthropic processes this data solely to generate tutoring responses and does not use student data to train its models. AI conversation logs are retained for 90 days for quality assurance purposes and then permanently deleted.
5. Third-Party Data Sharing
We share personal data with the following third-party service providers only as necessary to deliver our services:
- Safaricom (M-Pesa)— processes mobile money payments for classes and subscriptions.
- Paystack— processes card payments.
- Anthropic (Claude AI)— provides AI-powered personalized tutoring (see Section 4).
- Africa's Talking— delivers SMS notifications for class reminders and account alerts.
- LiveKit— powers live video classes between students and tutors.
- Resend— delivers transactional and notification emails.
We do not sell, rent, or trade your personal data. Data is shared with third parties only as necessary to provide the services described above.
6. International Data Transfers
Some of our third-party service providers operate outside Kenya. Your personal data may be transferred to and processed in the United States (Anthropic, Paystack) and other jurisdictions where our service providers maintain infrastructure.
Where data is transferred internationally, we ensure appropriate safeguards are in place, including contractual data protection clauses, to protect your data in accordance with the Kenya Data Protection Act, 2019.
7. Data Retention
- Account data is retained for as long as your account remains active. Upon account deletion, personal data is removed within 30 days, except where retention is required by law.
- Payment records are retained for 7 years in compliance with Kenya Revenue Authority (KRA) tax record-keeping requirements.
- AI conversation logs are retained for 90 days for quality assurance and then permanently deleted.
8. Your Rights
Under the Kenya Data Protection Act, 2019, you have the following rights:
- Right to access: request a copy of the personal data we hold about you.
- Right to correction: request that we correct any inaccurate or incomplete personal data.
- Right to deletion: request that we delete your personal data, subject to legal retention obligations.
- Right to withdraw consent: withdraw your consent to data processing at any time, which may affect your ability to use our services.
- Right to lodge a complaint: file a complaint with the Office of the Data Protection Commissioner (ODPC) if you believe your data protection rights have been violated.
To exercise any of these rights, contact us at privacy@mkufunzidigital.com. We will respond to your request within 30 days.
9. Camera & Microphone
Mkufunzi Academy requests access to your device's camera and microphone solely for the purpose of participating in live video classes powered by LiveKit. Your camera and microphone are not activated outside of live class sessions.
Live classes are not recorded without the explicit consent of all participants. You may disable your camera or microphone at any time during a class.
10. Payment Information
We do not store your M-Pesa PIN, card number, CVV, or any other sensitive payment credentials. All payment processing is handled securely by our third-party payment providers:
- Safaricomprocesses M-Pesa payments. Your M-Pesa PIN is entered directly on Safaricom's secure prompt and is never transmitted to or stored by Mkufunzi Academy.
- Paystackprocesses card payments. Card details are entered on Paystack's PCI-DSS compliant payment page and are never stored on our servers.
11. Data Security
We implement appropriate technical and organizational measures to protect your personal data, including:
- Encryption in transit: all data transmitted between your device and our servers is encrypted using TLS (Transport Layer Security).
- Secure credential storage: passwords and sensitive credentials are hashed and stored securely; they are never stored in plain text.
- Role-based access control: access to personal data is restricted to authorized personnel on a need-to-know basis.
12. AI-Generated Marketing Imagery
Certain images on the Mkufunzi Academy website and marketing materials are generated using artificial intelligence. These images are illustrative and do not represent real individuals. Testimonials displayed on our website use AI-generated photos and representative names to protect user privacy; they are illustrative of the kinds of experiences students and families may have.
13. Contact
For any privacy-related inquiries, requests, or complaints, please contact our Data Protection Officer:
If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya.