Privacy Policy

Last updated: 12 October 2026 · Version P-2.0

This policy explains what personal data Eilpah collects, why, who receives it, how long we keep it and the rights you have. It follows the Data Protection and Privacy Act, 2019 of Uganda and the Data Protection and Privacy Regulations, 2021. If you are under 18, please also read our Children's Privacy Policy, written for you and your parent or guardian.

1. Who we are

Eilpah is operated by in Kampala, Uganda, who is the data controller. Contact for all privacy matters: eilpah369@gmail.com. Eilpah will publish its Personal Data Protection Office registration number here when it is issued.

2. What we collect

Who

Data

Why we need it

Every user

Name, email address, password (stored only as a one-way hash), date of birth, country, phone number with country code (adults only), role, account settings

To create and secure your account, check your age and keep you signed in

Learners

Class/level, school (optional for adults), subjects followed, teachers followed, progress, quiz results, saved posts, downloads, study-aid questions

To run your learning: show the right feed and lessons, track progress, answer questions

Learners under 18

As above, but no phone number; plus the parent or guardian's name, relationship, email and phone, and the consent record (version, date and time)

To get and record parental consent and send the guardian reports and safety notices

Teachers

Subjects, district, education, institution, short bio, profile photo; verification documents (National ID or passport, professional registration certificate, passport photo, police certificate of good conduct); bank or mobile-money details once you qualify for earnings

To verify that teachers are who they say they are, to keep learners safe, and to pay earnings

Reviewers

Name, email, qualification, photo, actions taken

To appoint reviewers and keep an audit trail

Payers

Plan, amount, date, payment reference and status. We do not receive your full card number or mobile-money PIN

To provide the plan you bought, issue receipts and meet tax rules

Live classes

Who hosted and joined, start and end times, moderation actions (mute, camera requests, removals); audio, video and screen share while the class is live; recordings if the teacher records

To run the class, keep it safe and let learners watch recordings

Content

Posts, comments, replies, adverts, uploaded files, reports you make

To provide the service and moderate it

Device and usage

IP address, device and browser type, app version, crash reports, security logs; analytics only if you opt in

To keep the service secure and working, and (with consent) to improve it

National ID numbers, passport details and police certificates are special personal data under the Act. We collect them only from teachers, only to verify them, and protect them as described in section 6.

3. Why we use your data (legal basis)

• To provide the service you asked for (your account, lessons, live classes, payments): necessary to perform our agreement with you.
• Your consent (or your parent or guardian's consent if you are under 18): for creating a learner account under 18, optional analytics cookies, optional notifications and guardian reports.
• Legal obligations: tax records, responding to lawful requests, reporting child-safety incidents.
• Legitimate and lawful purposes such as security, preventing fraud and abuse, and improving the service, balanced against your rights.

We do not sell personal data. We do not use personal data for advertising to learners under 18. We make no decision that has legal or similarly significant effects on you based solely on automated processing; suspensions and approvals are decided by a person.

4. Who receives your data

Other users see only what the service needs: a teacher's public profile; a learner's name and comments on posts they comment on; who is in a live class. Learners under 18 are never listed in any public learner registry.

Guardians see their own child's activity reports. Reviewers and the administrator see what they need to approve accounts and handle reports, and every opening of a verification document is logged.

We use these service providers, who process data on our instructions:

Provider

What they do for us

Where data may be processed

Vercel

Hosting of the website and server functions

United States and other regions

Managed PostgreSQL database provider (connected through

Vercel)

Storing account and app data

United States or European Union, as configured

Google Firebase / Google

Cloud

File storage, push notifications and crash reports (where used)

Global, including the United States

Agora

Live-class audio, video and screen share

Global

Cloudflare (Stream)

Storing and playing recorded lessons

Global

Resend

Sending account emails (verification codes, receipts, guardian reports)

United States

Flutterwave

Website payments by MTN Mobile Money, Airtel Money and card

Uganda, Nigeria and other countries

Google Play

In-app subscriptions and purchases in the Android app

Global

Grok app builder (xAI)

The app is built with Grok's app-building tools. Some pages may load a script from grok.com, which means your browser shares technical data such as IP address and browser type with xAI. We do not send your account data to it. We are removing it from the published app

United States

Some of these providers process data outside Uganda. We use them only where the Act's conditions for transfers outside Uganda are met, for example where the provider is bound by contract to protect the data to a standard at least equal to the Act. We may also disclose data where the law requires it, to protect someone from serious harm, or to a buyer of the service, who must keep this policy's promises.

5. How long we keep data

Data

How long

Teacher verification documents

Deleted 30 days after submission. We keep only the outcome, document type, date and a one-way fingerprint (hash) that cannot rebuild the file

Account data

While your account is open. After you delete your account: removed within 30 days, and from backups within a further 35 days

Learner under 18 waiting for consent

Deleted if consent is not given within 14 days

Posts, comments, recordings

Until the author deletes them or the account is deleted; removed earlier if they break the rules Safeguarding recordings of live classes that include learners under 18 (if not posted)

90 days, unless needed for an open safety report

Live-class attendance and moderation logs

12 months

Payment and tax records

As long as Ugandan tax law requires

Safety reports and related records

2 years after the report is closed, or longer if needed for a legal case

Security logs (sign-ins, admin actions)

12 months

Cookie choice

12 months, then we ask again

6. How we protect data

• Data is encrypted in transit (HTTPS) and at rest by our providers.
• Passwords are stored only as salted one-way hashes. Staff cannot see them.
• Access is role-based and enforced on our servers. Verification documents are stored privately, opened only through short-lived links by reviewers or the administrator, and every opening is logged.
• Administrator and reviewer sign-ins are rate-limited, locked after repeated failures and logged.
• If a data breach is likely to harm you, we will notify the Personal Data Protection Office as the Act requires and tell affected users, with advice on what to do.

7. Your rights

Under the Data Protection and Privacy Act you can:

• ask for a copy of the personal data we hold about you and how it is used;
• ask us to correct data that is wrong or incomplete (most profile details can be edited in Settings);
• ask us to delete your data or stop using it, where we have no lawful reason to keep it;
• object to direct marketing at any time, and withdraw consent you gave (this does not affect what was done before);
• ask for a decision that affects you to be reviewed by a person;
• complain to the Personal Data Protection Office (pdpo.go.ug) if you are unhappy with how we handle your data.

Write to eilpah369@gmail.com. We will reply within 30 days and may need to confirm your identity. A parent or guardian can exercise these rights for a learner under 18.

8. Deleting your account

Use Settings › Account › Delete account in the app, or the account deletion page on our website (no app needed).

We confirm by email, close the account at once and delete the data as described in section 5. A Google Play subscription must be cancelled in Google Play.

9. Notifications and email

We send emails that are needed to run your account (verification codes, receipts, security and safety messages).

Push notifications, news and guardian weekly reports can be turned on or off in Settings.

10. Changes

We will post any change here and update the date at the top. If the change is important, we will tell you in the app or by email before it applies.

11. Contact

Eilpah, operated by , Kampala, Uganda. Email: eilpah369@gmail.com. Phone:

+256 756 897 981.