Privacy Policy

This Privacy Policy explains how Kijano (“we”, “us”) collects, uses, and protects your information when you use our study platform (the “Service”). We aim to collect only what we need to run the Service well.

Kijano is operated from Kenya and this policy is written around the Data Protection Act, 2019 (the “DPA”). For the purposes of that Act we are the data controller for your personal data. If you are in a country with its own data protection law, that law may give you additional rights.

1. Information we collect

Information you provide

• Account details — your name and email address when you sign up (and, if you use Google sign-in, the basic profile your provider shares).
• Study content — the documents, text, links, and other material you upload, and the flashcards, quizzes, notes, and answers generated from or entered against them.
• Payment information — when you upgrade, payments are handled by our provider (IntaSend). We receive confirmation and limited transaction details; we do not store full card or M-Pesa credentials.

Information collected automatically

• Learning activity — study sessions, card ratings, review schedules, quiz results, and progress, so we can personalize your experience and show your mastery.
• Approximate location — the country you connect from, worked out by our hosting provider from your network connection. We store the country only (for example “Kenya”), so we can see which countries Kijano is used in. We do not store your IP address and we cannot tell your city, address, or precise location.
• Basic technical data — information needed to keep your session secure and the Service reliable.

We do not ask for, and you should not upload, sensitive personal data as the DPA defines it — information revealing health, race, ethnicity, religious or political beliefs, marital or family details, or genetic and biometric data. If your study material happens to contain such information, it is processed only as part of the document you uploaded and for no other purpose.

2. Why we use it, and our lawful basis

Section 30 of the DPA requires a lawful basis for every use of your data. Ours are:

• To provide the Service — generating and organizing your study material, spaced repetition, topic mastery, exam readiness, and recommendations. Basis: performance of our contract with you.
• To process payments and manage your plan. Basis: performance of our contract with you, and legal obligation for tax records.
• To send essential account and service emails such as your welcome email and password resets. Basis: performance of our contract with you.
• To keep the Service secure, reliable, and improving, including understanding which countries Kijano is used in. Basis: our legitimate interests in running and protecting the Service, balanced against your rights.

We do not sell your personal information, we do not use your uploaded study content to train our own models, and we do not use your data for advertising or automated decisions that produce legal effects for you.

3. Service providers we share data with

We use a small number of trusted providers to run the Service. They act as our data processors and process data only on our instructions:

• Supabase — authentication, database, and file storage for your account and content.
• Vercel — application hosting and content delivery.
• Anthropic (Claude) — AI generation, marking, and tutoring. Content you submit is sent to generate study material; per Anthropic’s terms it is not used to train their models.
• Mistral AI — optional text recognition for scanned documents, only where enabled. Used to read the pages of a scanned upload into text.
• IntaSend — payment processing for Pro upgrades, including M-Pesa and card payments.
• Resend — sending transactional emails (only if email is enabled).
• Voyage AI — optional text embeddings for search and retrieval features, only if enabled.

We may also disclose personal data where we are required to by law, a court order, or a lawful request from a public authority.

4. Processing outside Kenya

Some of the providers listed above process and store data outside Kenya, including in the United States and the European Union. Sections 48 and 49 of the DPA allow such transfers where they are necessary and appropriately safeguarded.

Our basis for transferring your data outside Kenya is that it is necessary for the performance of our contract with you — the Service cannot generate study material without sending your content to an AI provider, or keep your account without hosting a database. We rely on the contractual data-protection terms offered by each provider as the appropriate safeguard, and we limit what is sent to what each provider needs.

If you would rather your study material were not sent to an AI provider outside Kenya, the Service is not able to work for you, and you should not upload material.

5. How long we keep it

• Account and study content — for as long as your account is active. You can delete individual study sets, courses, and uploads at any time.
• After you delete your account — deleting it from Account settings removes your personal data and content immediately, except as noted below. You can also email us and we will do it for you within 30 days.
• Payment and tax records — retained for as long as Kenyan tax and accounting law requires, currently seven years, then deleted.
• Cached AI generations — automatically deleted after 30 days.

6. Security

We use industry-standard measures to protect your data, including encryption in transit, access controls, per-user data isolation enforced at the database level, and time-limited sessions. No system is perfectly secure, but we work to keep your information safe and to respond promptly to any issues.

If a personal data breach occurs, we will notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of it, as section 43 of the DPA requires. Where a breach is likely to result in a real risk of harm to you, we will also tell you, without undue delay and in plain language.

7. Your rights

Under the DPA you have the right to:

• be informed of how your personal data is being used (this policy);
• access the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• have your data deleted;
• object to or restrict processing, including processing based on legitimate interests;
• receive your data in a portable format, or have it transferred to another provider.

You can update your profile, delete individual content, and delete your whole account directly in the app, under Account settings. For anything else, email us at hello@kijano.app and we will respond within 30 days. Exercising these rights is free; we will tell you in advance in the rare case a request is repetitive enough to carry a reasonable fee.

8. Children and students under 18

Kijano is built for exam preparation, so we expect many of our users to be school students under the age of 18. Section 33 of the DPA requires the consent of a parent or guardian before a child’s personal data is processed, and requires that the processing protect and advance the best interests of the child.

If you are under 18, you must have your parent or guardian’s permission to use Kijano, and by creating an account you confirm that you have it. We do not currently verify age at sign-up; we rely on that confirmation, and on the routes below for a parent or guardian to intervene.

A parent or guardian can contact us at hello@kijano.app at any time to see what data we hold about their child, correct it, withdraw consent, or have the account and its content deleted. We will act on such a request without requiring the child’s agreement.

We do not knowingly market to children, profile them for advertising, or share their data with anyone beyond the providers listed in section 3.

9. Complaints

If you think we have handled your data wrongly, please tell us first at hello@kijano.app — we would rather fix it. You also have the right to lodge a complaint with Kenya’s Office of the Data Protection Commissioner (ODPC), the regulator responsible for the DPA, at odpc.go.ke. You do not have to come to us first.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will update the “Last updated” date above and, for material changes, take reasonable steps to notify you.

11. Contact

Questions or requests about your data? Email us at hello@kijano.app.