Privacy Policy

Default version · not yet published by the academy

Effective 16 October 2026 (version 2026-10-16)

Dennis Kimanzi George, trading as Luvaro AI Academy ("Luvaro AI Academy", "we", "us", "our") respects your privacy and handles personal data in line with the Data Protection Act, 2019 of Kenya. This policy explains what we collect, why, who sees it, how long we keep it and what rights you have.

1. Who is responsible for your data

The data controller is Dennis Kimanzi George, trading as Luvaro AI Academy. Email: kimanzidennis939@gmail.com · Phone: 0796 158 796 · Address: [Add your postal or physical address], Kenya

If you have a question or want to use a right described below, email us at the address above.

2. Personal data we collect

Account data: your name and email address, and your login details handled by the sign-in service.

Contact data: your phone number when you pay or book a class.

Payment data: the module, amount, M-Pesa confirmation code, the phone number you paid from, and the time. We never see your M-Pesa PIN or any card details.

Learning data: modules unlocked, lessons ticked, assessment answers and scores, attempts, completions, final exams and certificates.

Class data: your class requests, preferred times, the topic you wrote and the confirmed time.

Work data: annotations and other work you save in the practice tools.

Messages: emails we send you and any messages you send us.

Technical data: browser and device type, pages opened and basic ****** needed to keep the service safe. We also store small files (cookies or local storage) on your device, see section 10.

3. Why we use it, and our legal basis

To create and run your account and give you the training you chose. Basis: performing our contract with you.

To check payments, unlock modules, keep payment records and prevent fraud. Basis: contract, our legitimate interest in preventing fraud, and legal duties such as tax record-keeping.

To mark assessments, track progress, issue and verify certificates, and show you your results. Basis: contract and legitimate interest.

To schedule and hold live classes and to reply to you. Basis: contract and your request.

To send emails about your account, payments, unlocks, classes and certificates. Basis: contract. We send marketing messages only if you agree, and you can say stop at any time.

To keep the Academy secure, fix problems and improve the training using summary results. Basis: legitimate interest.

To connect qualified students to work opportunities. Basis: your consent, which we ask for separately and which you can withdraw.

4. Who we share it with

We do not sell your personal data. We share it only with people who help us run the Academy and only as much as they need:

Our app platform and database provider (Base44), which hosts the app, stores data and files, handles sign-in and sends our emails.

Google, if you join a live class on Google Meet or we use Google services for email or documents.

Safaricom M-Pesa, where payments happen on its network. We receive the confirmation details you enter, not your PIN.

Professional advisers, auditors or authorities when the law requires it.

Possible work partners or clients, but only your name, certificates and skills, and only with your consent.

5. Sending data outside Kenya

Our providers may store or process data on servers outside Kenya. When that happens we rely on providers that apply appropriate security and data-protection safeguards and on the conditions for transfers in the Data Protection Act, 2019. You can ask us for more information.

6. How long we keep it

Account, learning and class data: while your account is active and for up to two years after you stop using it, then deleted or anonymised.

Certificate records: for as long as we need to confirm that a certificate is genuine.

Payment records: at least five years, as needed for accounting and tax record-keeping.

Email and support messages: up to two years after the issue is closed.

Where the law requires longer, or a dispute is open, we keep data for as long as needed.

7. How we protect it

We use access controls, admin-only areas, secure hosting and encrypted connections. We limit who can see payment and learning data. No system is perfectly secure, so please also protect your own login and tell us at once if you suspect misuse.

8. Your rights

Under the Data Protection Act, 2019 you have the right to:

be told how your data is used (this policy);

ask for a copy of the data we hold about you;

ask us to correct data that is wrong or out of date;

ask us to delete data we no longer need or have no right to keep;

object to, or ask us to restrict, some uses of your data, including direct marketing;

receive your data in a usable format, or have it sent to another provider where this applies;

withdraw consent at any time, without affecting what was done before.

Email us to use these rights. We may need to confirm who you are first. We will answer as quickly as we can and within the time the law sets.

9. Children

The Academy is for adults. A person under 18 may use it only with the consent of a parent or guardian, who must agree to this policy for the child. A parent or guardian can ask us to see, correct or delete a child's data.

10. Cookies and local storage

We use small files on your device to keep you signed in, remember settings such as tool preferences and run the app. These are needed for the Academy to work. We do not use advertising cookies. You can clear them in your browser, but you may then be signed out.

11. Personal data in the practice tools

The tools are for learning. Please do not enter other people's personal data, client data or confidential material. Anything you save may be seen by the trainer for marking and quality checks.

12. If something goes wrong

If a personal data breach is likely to harm you, we will tell the Office of the Data Protection Commissioner and the people affected as the law requires, including within 72 hours of becoming aware where required.

13. Complaints

Please talk to us first. You also have the right to complain to the Office of the Data Protection Commissioner of Kenya (www.odpc.go.ke).

14. Changes

We may update this policy. The date at the top shows the latest version. For important changes we will tell you by email or in the app.

15. Contact

Email: kimanzidennis939@gmail.com · Phone: 0796 158 796 · Address: [Add your postal or physical address], Kenya