Privacy Policy

EduBridge Learn operates the EduBridge Learn website and applications. For the personal data described here we are the data controller: we decide why and how it is processed. This policy took effect on 11 August 2026.

It applies to everyone who uses the Platform — students, guardians, tutors, contributors and visitors — and sits alongside our Terms of Service.

Privacy questions, requests and complaints go to privacy@edubridgelearn.co.ke. We answer within 30 days.

Information you give us

• Account: name, email, password (stored hashed, never in readable form), phone, country, timezone, role, and your avatar if you upload one.
• Profile: for learners — education level, curriculum, subjects and learning goals; for tutors and contributors — bio, qualifications, subjects, rates, availability and any verification documents you submit for approval.
• Content: resources, lessons, blog posts, community messages, reviews, support messages, and anything you type into the AI tutor.
• Transactions: bookings, purchases, subscriptions, LearnCoin top-ups and spends, earnings and withdrawal details. Card and mobile-money credentials go directly to our payment providers — we never see or store them; we keep only a reference, the amount, the status and the last digits where the provider returns them.
• Guardian links: where parental controls are used, the connection between a guardian account and a learner account.

Information we collect automatically

• Security and audit logs: IP address, device and browser (user agent), and the time of sign-in, sign-out, registration, password reset and failed login attempts. We need these to detect account takeover and fraud.
• Usage: pages viewed, features used, lesson and session progress, downloads, search terms, and the referring page.
• Cookies and similar technologies — see cookies.

Information from others

• Payment providers: confirmation that a payment succeeded or failed, and chargeback notices.
• Reports from other users or from rights holders about your Content or conduct.

Under the Kenya Data Protection Act 2019 and the GDPR we must have a lawful basis for each purpose. Ours are:

Where we rely on legitimate interests, we have weighed them against your rights and concluded they do not override yours. You can ask us to explain that assessment, and you can object — see your rights.

The Platform is not for under-13s, and we do not knowingly create accounts for them. Users aged 13 to 17 need a parent or guardian's consent, and we rely on that consent as the lawful basis for processing their data where consent is required.

• Guardians can review a linked learner's bookings, session records, spending and progress through the parental-control tools, and can request deletion of the account.
• We collect the minimum from young learners — enough to match them to the right level and deliver sessions. We do not profile them for advertising or serve them targeted ads.
• Sessions with minors stay on the Platform so there is a record a guardian and, where needed, we can review.

If you believe a child under 13 has given us personal data, email privacy@edubridgelearn.co.ke and we will delete the account and its data promptly.

We share personal data only where there is a reason to, and only as much as that reason needs:

• Other users, by design: a tutor sees the booking details and first name of a student who books them; a student sees a tutor's public profile and reviews; a creator sees aggregate sales, not buyer identities; community posts are visible to that community. Your email address is not shown to other users.
• Payment processors to take payments and send payouts (including M-Pesa via our payment partner).
• Infrastructure and tooling providers acting as our processors under contract: cloud hosting and databases, media storage and delivery, transactional email, video calling for live sessions, error monitoring and analytics.
• AI providers that power the AI tutor, which receive the text of your prompts to generate a response. They act as processors and are contractually barred from using that content to train their models.
• Rights holders where they have filed a valid infringement notice, and only the details required to handle the claim.
• Authorities, regulators and legal advisers where the law requires it or to establish or defend legal claims — and, without waiting for a request, where a child is at risk.
• A successor if the business is merged, acquired or restructured. We will tell you beforehand, and this policy continues to apply until you are told otherwise.

Processors may only act on our documented instructions, must keep the data secure, and must delete or return it when their work for us ends.

We are based in Kenya, and some of our providers are outside it — a transfer under both the Data Protection Act 2019 and, where it applies, the GDPR. We only make such transfers where the destination has an adequacy decision, or where the contract includes Standard Contractual Clauses or equivalent safeguards, together with the technical measures needed to make them effective. Ask privacy@edubridgelearn.co.ke for a copy of the safeguards used for a specific transfer.

We keep personal data only as long as the purpose needs, then delete or irreversibly anonymise it.

• Account and profile: while your account is open, then deleted or anonymised within 90 days of closure.
• Financial records (payments, payouts, invoices, coin ledger entries): 7 years, because tax and accounting law requires it. These survive account closure.
• Security and audit logs: up to 12 months, longer for an entry that is part of an open investigation.
• Content you published: removed when you delete it, except copies buyers lawfully received and copies we must retain for an infringement or safeguarding record.
• Support and dispute correspondence: 3 years after the matter closes.
• Backups: deletion propagates to backups on their normal rotation, within 35 days.

Subject to the usual legal limits, you can ask us to:

• Access the personal data we hold about you, and get a copy.
• Correct anything inaccurate or incomplete — most of it you can edit yourself in settings.
• Delete your data ("right to be forgotten"), where we have no overriding obligation to keep it.
• Restrict or object to processing, including processing based on legitimate interests, and to direct marketing at any time.
• Port your data — receive it in a structured, machine-readable format, or have it sent to another provider.
• Withdraw consent at any time, without affecting processing already carried out.
• Not be subject to a decision with legal or similarly significant effect based solely on automated processing. We do not make such decisions; approval and enforcement decisions involve a person, and you can appeal them.

Email privacy@edubridgelearn.co.ke to exercise any of these. We respond within 30 days and may ask you to verify your identity first — it stops someone else obtaining your data. Exercising a right costs nothing and will not affect your account.

If you are unhappy with our response you can complain to the Office of the Data Protection Commissioner (Kenya), or to your local supervisory authority if you are in the EU or UK. We would rather hear from you first.

Cookies and browser storage let the Platform remember who you are and how it is performing. We use four kinds:

• Strictly necessary — sign-in and session tokens, security and anti-fraud checks, and load balancing. These cannot be switched off; without them you cannot log in.
• Preferences — theme, language, and the choices you made in onboarding.
• Analytics — how features are used, so we can fix what is confusing. Aggregated wherever it can be.
• Marketing — measuring whether a campaign brought someone to us. Only ever with consent.

Non-essential cookies are set only after you consent, and you can change or withdraw that consent at any time from your cookie settings. Browsers can also block or clear cookies, though blocking necessary ones will break sign-in. We honour Global Privacy Control signals where your browser sends one.

We use encryption in transit (HTTPS) and at rest for sensitive fields, hash passwords with a modern algorithm, offer two-factor authentication, scope access to staff who need it, rate-limit and lock accounts after repeated failed logins, and keep audit trails of authentication events.

No system is perfectly secure. If a breach is likely to result in a risk to your rights, we will notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of it, and tell you without undue delay where the risk to you is high.

You help by using a strong, unique password, turning on two-factor authentication, and telling us at support@edubridgelearn.co.ke if something looks wrong.

We update this policy when our processing or the law changes. The version and effective date at the top of the page always reflect the current text. For material changes we give at least 30 days' notice by email or in-product, and where a change relies on your consent we will ask for it rather than assume it.

Data protection questions, access and deletion requests, and complaints: privacy@edubridgelearn.co.ke.

General support: support@edubridgelearn.co.ke. Legal notices: legal@edubridgelearn.co.ke. Copyright and infringement: copyright@edubridgelearn.co.ke.