This Privacy Policy explains how Darasa Live ("we", "us", "the Service") collects, uses, and protects your personal information. It is written in plain language so that students and parents can understand it.
By using Darasa Live on WhatsApp or our website, you accept this Privacy Policy.
1. Who We Are (Data Controller)
Darasa Live is an AI-powered tutor for the Kenyan CBC (Competency-Based Curriculum).
- Data Controller: Darasa Live
- Country of operation: Kenya
- Contact for privacy questions:
[YOUR EMAIL] - WhatsApp: +254 107 303 239
We are the Data Controller as defined in the Kenya Data Protection Act, 2019.
2. What Information We Collect
When you use Darasa Live, we may collect:
| Category | Examples | Why |
|---|---|---|
| Identity | Your name, grade level, county, school (optional) | To personalise lessons |
| Contact | Your WhatsApp phone number, parent's phone (optional) | To deliver tutoring + parent reports |
| Learning data | Quiz scores, subjects studied, study streak, XP | To track progress |
| Conversation | Messages you send to the bot, photos of homework | To answer your questions |
| Payment | M-Pesa transaction reference (no PIN, no card) | To unlock paid tiers |
We do NOT collect: ID numbers, passport numbers, bank account numbers, biometric data, or location data beyond county-level.
3. How We Use Your Information
- Provide CBC tutoring tailored to your grade
- Track your learning progress and send you encouragement
- Send weekly progress reports to your parent (only if registered)
- Process M-Pesa payments for premium tiers
- Improve the Service in aggregate (anonymised)
We will never sell your data, send unsolicited marketing, or train external AI models without your consent.
4. How We Share Your Information
We do not sell your data to third parties. We share only with:
| Party | What we share | Why |
|---|---|---|
| LLM providers (OpenRouter, Groq, Google AI) | Your messages | To generate tutor responses |
| FAL.ai | Image-generation prompts | To create lesson visuals |
| Safaricom (M-Pesa Daraja) | Phone + payment amount | To process payments |
| Your registered parent | Weekly progress summary | If you've added a parent number |
5. How Long We Keep Your Data
| Data | Retention period |
|---|---|
| Active student profile | While you keep using the Service |
| Conversation history | 12 months from last message |
| Quiz scores and progress | 24 months from last activity |
| Payment records | 7 years (Kenyan tax law) |
| Inactive accounts | Deleted after 24 months of no use |
6. How We Protect Your Data
- In transit: HTTPS / WhatsApp end-to-end encryption
- At rest: Encrypted databases on secured servers
- Access: Limited to authorised staff who need it
- Auth: Phone-number OTP verification for the dashboard
If a data breach affects you, we will notify you and the Office of the Data Protection Commissioner (ODPC) within 72 hours, as required by law.
7. Children's Privacy
Darasa Live is designed for students aged 5 to 16 on the CBC.
- Students under 18 should have parent/guardian permission.
- We follow CBC's child safety guidelines.
- We do not knowingly collect more data than necessary.
- For safeguarding concerns, students can call Childline Kenya: 116 (free 24/7).
8. Your Rights Under the Kenya Data Protection Act 2019
- Access — Ask what data we hold
- Correction — Fix anything wrong
- Deletion — Right to be forgotten
- Objection — Stop a particular use
- Portability — Get a copy of your data
- Withdraw consent — Stop using the Service anytime
To exercise any right, send STOP on WhatsApp or email [YOUR EMAIL]. We respond within 14 days.
Lodge a complaint with the ODPC: odpc.go.ke | info@odpc.go.ke
9. Cookies & Analytics
The website uses minimal cookies for authentication and anonymous traffic analytics. We do not use advertising or tracking cookies.
10. Changes to This Policy
If we make a significant change, we will notify users via WhatsApp and update the "Last updated" date above.
11. Compliance Statement
Darasa Live complies with the Kenya Data Protection Act, 2019 and follows guidance from the Office of the Data Protection Commissioner.
Contact: [YOUR EMAIL]