Privacy Policy
Last updated: 13 September 2026
This Privacy Policy explains what personal data Elimu254 collects, why, and what rights you have over it. Elimu254 is a marketplace and content platform for Kenyan CBC (Competency-Based Curriculum) teaching materials, an AI-assisted drafting tool for teachers, and a School Portal for teachers and students at participating schools.
1. WHO WE ARE
Elimu254 is the data controller for the personal data described in this policy. You can reach us using the contact details listed in the footer of this site.
2. WHAT WE COLLECT
Marketplace accounts: your name, email address, and a hashed password. We never store your password in plain text.
Payments: when you pay by M-Pesa, Safaricom's Daraja platform processes your phone number and transaction details on our behalf; we store the M-Pesa receipt number, amount, and payment status against your order, not your PIN or any other M-Pesa credential.
Teacher accounts: teacher accounts on the School Portal are created by your school's administrator, not by self-registration, and include your name, employment number, and the school you are linked to.
Student accounts: students join a class using a join code their teacher provides, and register with their name, an admission number issued by their school, and a password. Because most students using this feature are minors, the school and teacher issuing the join code are responsible for ensuring any parental or guardian consent required under Kenyan law has been obtained before a join code is shared with a student. We do not independently verify a student's age or collect a parent's contact details at registration.
School Portal content: once enrolled, a class's teacher may share class materials, assignments, and announcements, and record short written feedback and CBC competency-level progress notes (Exceeding / Meeting / Approaching / Below Expectation) for their own students. This is a private classroom record between a teacher and their class, not the official government KNEC record, and it is never used for automated grading — every assessment is written by the teacher personally.
Usage data: like most websites, our servers log standard technical data (IP address, browser type, pages requested) for security and troubleshooting.
Cookies: we use strictly necessary cookies to keep you logged in and to protect forms against forgery (CSRF protection) — these cannot be switched off, since the site cannot function without them. If enabled, we also use Google Analytics to understand how the site is used; this cookie is optional and only loads after you accept it in the cookie banner shown on your first visit.
3. HOW WE USE YOUR DATA
To create and manage your account, process purchases and deliver the documents or licenses you've paid for, operate the School Portal for enrolled teachers and students, respond to support requests, and where enabled, understand site usage through analytics.
When a teacher uses the AI Content Studio to draft an exam, scheme of work, or lesson plan, the curriculum topic and instructions they enter (grade, subject, topic, and similar curriculum-level detail) are sent to our AI provider (Anthropic) to generate a draft. We do not send student names, admission numbers, or any other personal student data as part of these requests — the drafting process only ever concerns curriculum content, not individual learners.
4. WHERE YOUR DATA IS PROCESSED
Our AI Content Studio calls Anthropic's API, which may process the curriculum-topic text you submit outside Kenya. M-Pesa payments are processed by Safaricom within Kenya. We take reasonable steps to use providers with appropriate safeguards for any data that leaves Kenya, consistent with the Kenya Data Protection Act, 2019.
5. HOW LONG WE KEEP YOUR DATA
We keep account and order data for as long as your account is active, and for a reasonable period afterward to meet accounting and legal obligations. School Portal records (materials, assignments, progress notes) are kept for as long as the school's account with us is active, since they form part of a class's ongoing record.
6. YOUR RIGHTS
Under the Kenya Data Protection Act, 2019, you have the right to: know what personal data we hold about you; request a copy of it; ask us to correct inaccurate data; ask us to delete data we no longer have a lawful reason to keep; object to or restrict certain processing; request that your data be transferred to you in a portable format; and lodge a complaint with the Office of the Data Protection Commissioner (ODPC) if you believe we have mishandled your data. To exercise any of these rights, contact us using the details in the site footer.
7. SECURITY
We use industry-standard practices to protect your data, including password hashing, access controls limiting who at Elimu254 can view personal data, and encrypted connections (HTTPS) in production. No system is completely immune to risk, and we will notify affected users and the ODPC without undue delay if we become aware of a breach affecting your personal data, as required by law.
8. CHANGES TO THIS POLICY
We may update this policy from time to time; the "Last updated" date above will change when we do. Material changes affecting how School Portal data is handled will be communicated to enrolled schools directly.
9. CONTACT US
For any question about this policy or your data, use the contact details shown in the site footer.
This Privacy Policy explains what personal data Elimu254 collects, why, and what rights you have over it. Elimu254 is a marketplace and content platform for Kenyan CBC (Competency-Based Curriculum) teaching materials, an AI-assisted drafting tool for teachers, and a School Portal for teachers and students at participating schools.
1. WHO WE ARE
Elimu254 is the data controller for the personal data described in this policy. You can reach us using the contact details listed in the footer of this site.
2. WHAT WE COLLECT
Marketplace accounts: your name, email address, and a hashed password. We never store your password in plain text.
Payments: when you pay by M-Pesa, Safaricom's Daraja platform processes your phone number and transaction details on our behalf; we store the M-Pesa receipt number, amount, and payment status against your order, not your PIN or any other M-Pesa credential.
Teacher accounts: teacher accounts on the School Portal are created by your school's administrator, not by self-registration, and include your name, employment number, and the school you are linked to.
Student accounts: students join a class using a join code their teacher provides, and register with their name, an admission number issued by their school, and a password. Because most students using this feature are minors, the school and teacher issuing the join code are responsible for ensuring any parental or guardian consent required under Kenyan law has been obtained before a join code is shared with a student. We do not independently verify a student's age or collect a parent's contact details at registration.
School Portal content: once enrolled, a class's teacher may share class materials, assignments, and announcements, and record short written feedback and CBC competency-level progress notes (Exceeding / Meeting / Approaching / Below Expectation) for their own students. This is a private classroom record between a teacher and their class, not the official government KNEC record, and it is never used for automated grading — every assessment is written by the teacher personally.
Usage data: like most websites, our servers log standard technical data (IP address, browser type, pages requested) for security and troubleshooting.
Cookies: we use strictly necessary cookies to keep you logged in and to protect forms against forgery (CSRF protection) — these cannot be switched off, since the site cannot function without them. If enabled, we also use Google Analytics to understand how the site is used; this cookie is optional and only loads after you accept it in the cookie banner shown on your first visit.
3. HOW WE USE YOUR DATA
To create and manage your account, process purchases and deliver the documents or licenses you've paid for, operate the School Portal for enrolled teachers and students, respond to support requests, and where enabled, understand site usage through analytics.
When a teacher uses the AI Content Studio to draft an exam, scheme of work, or lesson plan, the curriculum topic and instructions they enter (grade, subject, topic, and similar curriculum-level detail) are sent to our AI provider (Anthropic) to generate a draft. We do not send student names, admission numbers, or any other personal student data as part of these requests — the drafting process only ever concerns curriculum content, not individual learners.
4. WHERE YOUR DATA IS PROCESSED
Our AI Content Studio calls Anthropic's API, which may process the curriculum-topic text you submit outside Kenya. M-Pesa payments are processed by Safaricom within Kenya. We take reasonable steps to use providers with appropriate safeguards for any data that leaves Kenya, consistent with the Kenya Data Protection Act, 2019.
5. HOW LONG WE KEEP YOUR DATA
We keep account and order data for as long as your account is active, and for a reasonable period afterward to meet accounting and legal obligations. School Portal records (materials, assignments, progress notes) are kept for as long as the school's account with us is active, since they form part of a class's ongoing record.
6. YOUR RIGHTS
Under the Kenya Data Protection Act, 2019, you have the right to: know what personal data we hold about you; request a copy of it; ask us to correct inaccurate data; ask us to delete data we no longer have a lawful reason to keep; object to or restrict certain processing; request that your data be transferred to you in a portable format; and lodge a complaint with the Office of the Data Protection Commissioner (ODPC) if you believe we have mishandled your data. To exercise any of these rights, contact us using the details in the site footer.
7. SECURITY
We use industry-standard practices to protect your data, including password hashing, access controls limiting who at Elimu254 can view personal data, and encrypted connections (HTTPS) in production. No system is completely immune to risk, and we will notify affected users and the ODPC without undue delay if we become aware of a breach affecting your personal data, as required by law.
8. CHANGES TO THIS POLICY
We may update this policy from time to time; the "Last updated" date above will change when we do. Material changes affecting how School Portal data is handled will be communicated to enrolled schools directly.
9. CONTACT US
For any question about this policy or your data, use the contact details shown in the site footer.