Privacy Policy

1. Who we are

Koleeza is a practice service for primary-school children, run by [LAWYER: legal entity name, registration number and registered address] in Uganda ("we", "us"). We are the data controller for the personal data described here. You can reach us at [email protected].

We process personal data under Uganda's Data Protection and Privacy Act, 2019 and its Regulations. [LAWYER: confirm registration with the Personal Data Protection Office and insert the registration number.]

2. Accounts are created by parents

A parent or guardian ("parent") creates the account and adds each child as a learner. A child never signs up alone, never enters an email address or phone number, and has no public profile. The parent decides which children use the service, can see everything a child does on it, and can delete a child's profile at any time.

3. What we collect

About the parent

• Email address and a password (stored only as a one-way hash).
• Display name.
• Mobile-money phone number, when you pay, so we can send the payment prompt.
• Sign-in records: time, browser or device type and IP address, and the devices you choose to trust.
• That you accepted these terms and the Terms of Service at sign-up: the time, which edition you accepted, and that you scrolled through the Terms to the end.

About each child

• First name, last name, class or stage, and an avatar the child picks from a fixed set.
• A learner code and a PIN (stored only as a one-way hash).
• What the child practises: the quizzes started and finished, each answer given, whether it was right, the time taken, and any tasks or programmes the parent set.
• Sign-in records: time, browser or device type and IP address, and the devices the parent has approved.

About payments

• The amount, currency, date, our reference, the phone number that paid and the transaction number MTN gives us.
• We never see or store your Mobile Money PIN. You enter it on your own phone, with MTN.

What we deliberately do not collect

• No photographs, face scans, voice recordings or other biometrics — of anyone.
• No location beyond the country-level information in an IP address.
• No advertising identifiers, and no third-party advertising or analytics trackers.

4. Why we use it

• To run the service: sign you and your child in, serve practice, mark answers, show progress.
• To report to you: the parent dashboard and the weekly progress email (you can turn the email off in your account settings or from the link in any report).
• To keep children safe: we tell you when a child's code is used from a new device, and we look for signs that a learner code is being shared. We never act on those signs automatically — we show them to you.
• To take payment and send you a receipt.
• To answer you when you contact us.
• To improve the questions. We use answers in aggregate — how many children got a question right, which wrong answers are common — to find questions that are unclear or too hard. This never identifies a child.

[LAWYER: state the lawful basis for each purpose under the Act — performance of the contract with the parent, the parent's consent for the child's data, and our legitimate interest in the safety and quality items.]

5. Who we share it with

We share personal data only with the providers we need to run the service, and only what each one needs:

• DigitalOcean hosts the service and its database (data centre: United States). [LAWYER: cross-border transfer wording required by the Act and its Regulations.]
• MTN Uganda processes payments and receives the phone number and amount.
• Our email provider receives the parent's email address and the content of the emails we send.
• The AI services we use to write practice questions receive no personal data at all — no names, no answers, nothing about a child.

We never sell personal data and never share it for advertising.

6. How long we keep it

• Account and learner data: for as long as the account exists. When you delete a child's profile or your account, we delete or anonymise it within [LAWYER: 30] days, except where the law requires longer.
• Payment records: [LAWYER: seven] years, as required for tax and accounting.
• Sign-in and device records: [LAWYER: 12] months.

7. Your rights

Under the Act you may ask us to:

• show you the personal data we hold about you or your child;
• correct it;
• delete it (some records may be kept where the law requires, as above);
• stop a particular use, such as the weekly report email.

Write to [email protected] from the email address on the account. We answer within [LAWYER: 30] days. You may also complain to the Personal Data Protection Office (pdpo.go.ug).

8. Security

Data travels over encrypted connections and is stored on encrypted disks. Passwords and PINs are stored only as one-way hashes. Access to production systems is limited to the people who run the service and is protected with two-factor authentication. A learner code works on one active session at a time, and a parent can reset a child's PIN at any moment.

9. Cookies

We use only the cookies the service needs: one to keep a parent signed in, one to keep a child signed in, one to remember a trusted device, and one to protect forms from forgery. There are no advertising or tracking cookies.

10. Changes

If we change this policy in a way that matters, we will email the parent on the account before the change takes effect. The date at the top is the date of the current version.

11. Contact

[email protected] · [LAWYER: postal address]