Privacy Policy

Mtihani Space (mtihanispace.com) is a revision service for learners following Kenya's Competency Based Curriculum. Parents and guardians create the account; children use it to practise and get their answers marked. This policy explains what we collect, why, and the choices you have. It is written to comply with the Kenya Data Protection Act, 2019.

Who is responsible

Mtihani Space, Nairobi, Kenya is the data controller. Contact: [email protected]. WhatsApp: the Mtihani Space business number you were messaged from.

What we collect

• Parent account: name, email address, phone number, password (stored hashed). The phone number is required for M-Pesa payments and account messages.
• Learner profile: the child's first name (or nickname), grade, and an avatar. We do not ask for a child's surname, date of birth, school, photo or contact details.
• Learning activity: the questions a learner opens, the answers they type or photograph, the marking and feedback produced, streaks, and progress by subject and topic.
• Payments: M-Pesa transaction references, amounts and the paying phone number, as returned to us by Safaricom. We never see or store M-Pesa PINs.
• Messages: emails and WhatsApp messages we send you, whether they were delivered or read, and any replies you send us.
• Technical: device and browser type, the page you landed on and where you came from (for example an advert or a teacher's referral link), and standard server logs.

Children

Learners are children. The account always belongs to a parent or guardian, who creates each learner profile and is responsible for it. We collect the minimum about a child needed to mark their work and show progress. We do not show advertising to learners, do not sell or share children's data for marketing, and do not allow learners to message each other. Streak Buddies and Study Squads show only a first name, avatar and streak to the other children a parent has chosen to pair with.

Photographed answers

When a learner photographs handwritten working, the image is sent to our marking model to be read and marked, and a copy is kept in private storage so that our team can review a marking if a parent or learner disputes it. Photos are never public, never shown to other learners, and are not used to train AI models.

How we use information

• To mark answers and give feedback (our marking uses Anthropic Claude models run on Amazon Web Services; the question, rubric and the learner's answer are sent for marking, never the parent's identity).
• To show parents a report of what their child practised and where they are strong or slipping.
• To process payments and send receipts.
• To send account messages (verification, trial status, caps) and, with your consent, reminders and progress updates by email or WhatsApp.
• To measure whether our advertising works. Signup and first-marking events are shared with Meta and TikTok using hashed email and phone values, so they can attribute them to an advert; no learning data is shared.
• To keep the service safe, prevent abuse and fix problems.

WhatsApp messages

If you give a phone number, we may message you on WhatsApp about your account and, with your consent, with reminders and progress updates. Reply STOP at any time to opt out of reminders; receipts and account messages will still arrive. Reply START to opt back in. Messages are sent through the WhatsApp Business Platform operated by Meta.

Who we share with

We share data only with service providers who process it for us under contract: Amazon Web Services (hosting, storage and AI marking), Cloudflare (website delivery and email), Safaricom (M-Pesa), Meta (WhatsApp Business Platform and advertising measurement) and TikTok (advertising measurement). We do not sell personal data. We may disclose information if required by Kenyan law.

Where data is stored

Our servers and backups are in Amazon Web Services data centres in the United States, protected by encryption in transit and at rest. By using the service you agree to this transfer, which we make under the safeguards required by the Data Protection Act.

How long we keep it

We keep your account and learning history while the account is active, so progress is never lost. If you ask us to delete the account, we delete it and all learner profiles, answers and photos within 30 days, except payment records we must keep for tax and audit purposes (up to 7 years). Accounts unused for 24 months may be deleted after we email you.

Your rights

You can see, correct, download or delete your family's data, withdraw consent to marketing messages, and object to processing. Email [email protected] from the account's email address and we will respond within 14 days. You may also complain to the Office of the Data Protection Commissioner of Kenya (odpc.go.ke).

Cookies

We use local storage to keep you signed in and remember which learner is active, and the Meta Pixel and TikTok Pixel on our public pages to measure advertising. We do not use third-party advertising cookies inside the learning experience.

Changes

If we change this policy in a way that matters, we will email account holders and update the date above.