Effective date: 29 September 2026 Document status: Default draft. The Master Super Admin must complete every bracketed field and verify that this notice matches the live service before publication.
1. Who is responsible for your information
The Platform is operated by [FULL LEGAL NAME OF DATA CONTROLLER / INSTITUTION], of [REGISTERED OR PRINCIPAL ADDRESS] (“Operatorâ€, “weâ€, “usâ€). The Operator determines why and how personal data is processed for the Platform, except where a service provider independently determines its own purposes and obligations. The Operator must confirm whether it or another institution is the data controller, whether joint-controller arrangements exist, and whether registration or appointment of a data protection officer is required.
Privacy contact: [DATA PROTECTION CONTACT NAME / EMAIL / POSTAL ADDRESS]. General support: [SUPPORT EMAIL]. This notice applies to the website, account system, community contributions, content search, AI assistant, and related features. It should be read with the Terms and Conditions, especially sections on contributions, public access, and AI.
2. Information we collect
Depending on your use, we may process: (a) account information such as name, email, authentication-provider identifiers, password hashes, date of birth or age, selected language, role, account status, and profile image; (b) content you provide, including words, translations, stories, cultural information, comments, images, audio, video, transcripts, source notes, permissions, and metadata; (c) moderation records, reports, administrator actions, review decisions, and audit entries; (d) chatbot questions, conversation history, generated answers, citations, and media returned; (e) consent records, including the date and a cryptographic fingerprint of the Terms and Privacy version accepted during email registration; and (f) technical and security information such as session identifiers, request metadata, error logs, and anti-abuse signals.
The exact information depends on enabled features. Do not put passwords, payment-card details, private keys, highly sensitive personal data, confidential research, or information about another person into public Contributions or chatbot prompts unless necessary, lawful, and appropriately protected. For children and sensitive information, see Section 11.
We collect information directly from you when you register, sign in, contribute, contact support, make a report, or use chat and search. An authentication provider may send us the account details needed to authenticate you. Administrators and moderators may create review or safety records. Technical information may be generated by your use of the Platform or by hosting, security, storage, analytics, and AI providers acting for the Operator.
Where information about an identifiable person is supplied by someone else—for example, a story, image, voice recording, or oral-history transcript—the contributor is responsible for having a lawful basis and any required permission. The Operator may request clarification, restrict publication, or remove material when permission is unclear. See Terms: Contribution permissions.
4. Why we use information
The Operator may use information to: create and authenticate accounts; assign language-specific roles; provide dictionaries, learning materials, search, media, and conversation features; receive and review contributions; translate, index, and preserve approved cultural materials; respond to support, rights, and safety reports; protect accounts and systems; investigate abuse and resolve disputes; maintain backups and audit trails; improve reliability and accessibility; communicate important service or policy changes; and meet legal obligations or establish, exercise, or defend legal claims.
The Operator must document an appropriate lawful basis for each processing purpose and provide any additional notice required by law. Depending on the specific purpose and context, the basis may include consent, performance of a requested service, compliance with a legal obligation, protection of vital interests, public interest or official authority where applicable, or a properly assessed legitimate interest. This list does not decide the basis for the Operator; complete that assessment before launch.
5. Public contributions and cultural materials
Contributions approved for public display may be viewed by visitors, indexed by search engines, downloaded, quoted, copied, or shared by other people. A public record may contain a title, description, media, language, source attribution, and other contribution details. Do not include personal contact details or identify a speaker who requested anonymity. Do not contribute information whose publication would violate privacy, safety, confidentiality, copyright, consent, or cultural restrictions.
The Operator may preserve published material for cultural and linguistic purposes, but public display is not a promise of unrestricted reuse or proof of complete community authorization. The Terms and Conditions explain user responsibilities and licence scope. If information presents a privacy or safety risk, contact [PRIVACY / SAFEGUARDING CONTACT] with the record link and requested action.
6. AI, search, and third-party providers
To answer a chatbot request, relevant question text, recent conversation turns, selected answer language, and retrieved Platform content may be processed by the configured AI provider. Search may compare a question with indexed content. Depending on the request, the Platform may retrieve relevant images, audio, video, or documents. Do not submit sensitive information that is unnecessary for your question.
The Operator currently uses or may configure providers for application hosting, database, authentication, image and media storage, email, AI generation, and analytics. Before publication, the Operator must replace this sentence with the actual provider names, purposes, relevant locations, retention settings, and links to their notices: [LIST PROVIDERS AND LINKS]. Providers may process information under contract or their own terms depending on the service. The Operator must assess provider safeguards, data-processing terms, and any transfers outside Kenya before enabling them.
Chat conversations are associated with your account so you can view conversation history. The Platform does not intentionally publish private prompts as Contributions. Administrators with appropriate system access may be able to access records for support, safety, security, or legal purposes. Explain any model-training or provider retention settings here: [DESCRIBE ACTUAL AI RETENTION / TRAINING SETTINGS].
7. When information is shared
Information may be shared with: authorized staff, moderators, super administrators, and support personnel who need it for assigned duties; contracted hosting, database, authentication, media, email, AI, security, or analytics providers; the public, for Contributions intentionally approved for public display; a person you ask us to involve in a support or contribution process; a successor organization that lawfully assumes operation of the Platform; or a court, regulator, law-enforcement body, or other recipient where required or permitted by law.
The Operator should disclose information only for documented purposes, use appropriate contractual and security safeguards, limit access, and keep a record of relevant disclosures where required. We do not sell personal information as a business practice. We will not disclose private information merely because someone asks; legal process and applicable rights must be considered. For public-material removal limitations, see Terms: moderation and removal.
8. International transfers and storage locations
The Platform’s database, media, AI, email, authentication, or hosting providers may store or process data in countries outside Kenya. The Operator must identify actual locations and transfer mechanisms here before launch: [COUNTRIES, PROVIDERS, AND APPLICABLE SAFEGUARDS]. A transfer must be assessed and handled using a valid legal basis and safeguards required by applicable data-protection law. Do not assume that a provider’s global service keeps every item in Kenya.
If a provider or storage location changes materially, the Operator should reassess the transfer, update this notice, and give any required notice. Contact [DATA PROTECTION CONTACT] with questions about a particular transfer.
9. Retention and deletion
We keep information only for as long as reasonably needed for the purposes described in this notice, the Operator’s approved retention schedule, preservation commitments, security, disputes, and legal obligations. The Operator must establish specific retention periods for account data, unpublished submissions, chat history, audit logs, consent records, media, and backups: [INSERT RETENTION PERIODS OR CRITERIA BY CATEGORY].
When information is no longer required, it should be securely deleted, anonymized, or otherwise disposed of, subject to lawful preservation duties and valid archival purposes. Removing an account or a Contribution from public display may not immediately erase backups, legal holds, audit trails, citations, lawful copies already downloaded, search caches, or copies controlled by third parties. The Operator should explain the applicable exceptions when responding to a request.
10. Your rights and how to exercise them
Subject to applicable law and its conditions, a data subject may have rights to be informed, access personal data, object to some processing, correct false or misleading data, request deletion of false or misleading data, withdraw consent where processing relies on consent, and exercise other rights provided by law. The available right and response depend on the request, the purpose, the legal basis, the rights of other people, and any lawful exception.
Send a request to [DATA PROTECTION CONTACT EMAIL / POSTAL ADDRESS] with “Data rights request†in the subject, the account email or record link, a clear description of what you seek, and reasonable information to verify your authority. Do not send passwords or unnecessary sensitive information. A parent, guardian, or authorized representative should identify their authority when acting for another person. The Operator may ask for proportionate verification, explain a permitted refusal, or request clarification. We aim to respond within the time required by applicable law.
The Operator must determine which age groups may use each feature and implement age-appropriate safeguards before collecting children’s personal information. Where a child’s consent or guardian authorization is legally required, the Operator must obtain and verify it using an appropriate process. Do not upload a child’s face, voice, full name, school, location, contact details, or personal story unless you have authority, a lawful basis, and safeguards appropriate to the child’s best interests.
Some cultural, health, biometric, genetic, religious, family, or other information may be sensitive or subject to special protection. The Operator should avoid collecting it unless there is a defined need, lawful basis, safeguards, and any required impact assessment or authorization. A user should not infer that a public upload is appropriate simply because the upload form accepts a file.
12. Security and incident response
The Operator uses reasonable technical and organizational measures appropriate to the risks and the nature of the data. Measures should include least-privilege access, protected credentials, secure configuration, backups, patching, monitoring, incident handling, and staff confidentiality where appropriate. No website, provider, device, or network can be guaranteed completely secure, and the Operator cannot promise that unauthorized access will never occur.
If you suspect an account compromise, data exposure, unsafe publication, or security weakness, promptly contact [SECURITY / DATA PROTECTION INCIDENT EMAIL]. Do not publicly exploit, download, alter, or disclose the affected data. The Operator will assess incidents, take appropriate steps, and notify affected people or authorities where required by law.
13. Cookies, sessions, and device information
The Platform uses session and authentication storage needed to sign in, maintain account security, and deliver requested features. It may use preference or measurement technologies if configured. Before publication, the Operator must list actual cookies and comparable technologies, purposes, lifetimes, providers, and available controls: [COOKIE INVENTORY AND PREFERENCES LINK]. Browser controls may affect some features but do not necessarily remove server-side account records.
14. Automated processing and profiling
The chatbot produces a response to a prompt; it is not intended to make decisions about your eligibility, legal rights, employment, education, health care, credit, safety, or access to essential services. The Platform may use automated matching to retrieve content or media. The Operator should disclose any additional profiling or automated decisions here and must complete any assessment, explanation, human-review process, or safeguards required by law before deploying them.
Do not rely on a generated response as a decision about an identifiable person. If an automated result appears to expose personal data or cause a significant issue, contact [DATA PROTECTION CONTACT] and identify the interaction.
15. Changes to this notice
We may update this Privacy Policy when the Platform or its data practices change. The current text, effective date, and any applicable version record will be published on this page. For material changes, the Operator will provide notice through an appropriate channel and obtain fresh consent where consent is the legal basis or where law requires it. A change to this notice does not retroactively make an unlawful prior use lawful.
The Terms editor and Privacy editor are controlled by the Master Super Admin. The Operator should keep a record of material versions and avoid changing a notice without assessing its effect on existing users and data. See Terms: changes to the Platform and Terms.
16. Contact, complaints, and regulator
Data controller / Operator: [FULL LEGAL NAME] Postal / physical address: [ADDRESS] Privacy and data-rights requests: [DATA PROTECTION EMAIL] Security and incident reports: [SECURITY EMAIL] General support: [SUPPORT EMAIL]
If you are not satisfied with our response, you may contact the Office of the Data Protection Commissioner of Kenya through its official website. You may also exercise any complaint or remedy available under applicable law. This notice is a comprehensive starting draft, not a certification of compliance or a substitute for legal and data-protection review of the actual Platform, providers, and institutional responsibilities.