Privacy Policy

1. Who we are

Digikids (“Digikids”, “we”, “us”) runs STEM courses, classes, and bootcamps for children from Nairobi, Kenya. We are the data controller for the personal data described in this policy, and we handle it in line with Kenya’s Data Protection Act, 2019 and its regulations. This policy also forms part of our Terms and Conditions.

For any privacy question or request, email info@digikids.co.ke.

2. What we collect

Parents and guardians: your name, email address, phone number, password (stored only in a scrambled form we can’t read back), time zone, profile photo if you add one, the family members you invite, and your bookings. If you sign in with Google, we receive your Google account’s name, email address, and account ID.

Children: the name, username, age, and grade you give us when you create your child’s account, and an email address only if you choose to add one. As your child learns, we keep their course progress, attendance, class feedback and reports from their teacher, projects, certificates, and awards.

Free sessions: when you book a free session, we ask for more detail so we can place your child in the right class. This can include your relationship to the child and a second contact, your county and area, your child’s date of birth, school, curriculum, and languages, the devices and internet you have at home, any accounts your child already has on learning platforms such as Scratch or Roblox, and what you hope your child gets from classes. The teacher also notes how the session went. We keep the consent form you sign, including a scan of a paper form.

Teachers: your profile (name, photo, headline, about, subjects, languages, teaching experience, credentials, and intro video link), the ages you teach, your availability, and, if you connect a calendar, the Google account email for that calendar.

Payments: the amount due and paid, the M-Pesa reference, and when your payment was confirmed. We don’t collect your M-Pesa PIN or bank details.

Live classes and messages: who joined each class, recordings and transcripts where a parent has agreed (section 5), and messages and attachments sent between teachers, children, and parents.

Technical information: the pages you visit and actions such as signing up or opening a course, linked to your account ID when you’re signed in, and error reports when something goes wrong. We use your IP address briefly to stop abuse, such as too many sign-in attempts, but we don’t store it with your account.

3. How we use it

• To provide our classes (our contract with you): create and run accounts, place children in classes, run live classes, track progress, issue certificates, and support you.
• To take and confirm payments (our contract with you, and our legal duty to keep financial records).
• To keep children safe (our legitimate interest and legal duties): check teachers, moderate messages, investigate reports, and keep a record of staff access.
• To send emails about your account and bookings, and marketing emails as set out in section 7.
• To improve Digikids (our legitimate interest): understand which pages and courses are used and fix errors.
• With your consent: recordings and transcripts of classes, public awards profiles, and using your child’s work or image in our marketing. You can withdraw consent at any time.

4. Children’s information

We take extra care with children’s information:

• A child’s account can only be created by their parent or guardian, or by our team at a parent’s request.
• We never send marketing emails to a child or to a child’s email address.
• In our online classroom, the video service sees each child only as an anonymous label such as “Learner 3”, never their name.
• Children can only message a teacher who teaches them, never other children.
• We only make a child’s name or work public, for example on an awards page or social media, when their parent or guardian has agreed.

5. Class recordings and transcripts

Some classes are recorded or transcribed so children can catch up. For each child, a parent or guardian decides separately whether we may transcribe what the child says, include their audio in recordings, and include their screen in recordings. In recorded classes, children’s cameras stay off. Transcripts show speakers by label, not by name.

Recordings and transcripts can only be viewed by our team, the class teacher, the children who attended, and their parents or guardians. They are never published on a public link. We delete recordings after 14 days and transcripts after 90 days, and keep only a note that they existed and were deleted.

6. What other people can see

• Certificate check: anyone with a certificate’s serial number can see the course, the child’s name, and the issue date.
• Awards profiles: private by default. If the family makes one public, it shows the child’s name and their awards (course, month and year, and serial number), but not their teacher, grade, or username. The family can hide awards or take the profile down at any time.
• Teacher pages: approved teachers have a public page with their profile and courses, but no contact details or schedule.
• Families: every guardian in a family can see the family’s children, bookings, and progress.

7. The emails we send

Emails about your account and bookings. We send emails you need to use Digikids: confirming your email address, resetting your password, confirming registrations and payments, sending receipts, and reminding you about classes or changes to them. These are part of the service, so they keep coming for as long as you have an account.

Marketing and promotional emails. When you create a parent account and agree to this Privacy Policy, or tick the newsletter box on a free-session form, you agree that Digikids may use your name and email address to send you marketing and promotional emails. These tell you about:

• upcoming bootcamps, classes, and their registration dates
• new courses and learning programmes
• offers, discounts, and events from Digikids

We follow these rules for marketing emails:

• We send them only to parents and guardians aged 18 or over, never to a child’s account or a child’s email address.
• We send them about Digikids only. We don’t sell your details or give them to other companies for their own marketing.
• We use an email service provider, Brevo, to send them. Brevo handles your name and email address on our behalf and only as we instruct.
• We keep a record of when you unsubscribe, so we don’t email you again by mistake.

How to stop marketing emails. You can stop them at any time, free of charge. Select Unsubscribe at the bottom of any marketing email, or email info@digikids.co.ke and ask us to stop. Once you unsubscribe, we won’t send you marketing emails again unless you ask us to. Unsubscribing doesn’t close your account or stop the emails about your account and bookings.

8. Who we share it with

We don’t sell personal data. We share it only with service providers who help us run Digikids, who may use it only on our instructions:

• Cloudflare: runs our servers, stores files such as photos, recordings, and message attachments, and provides our online classroom
• Neon: hosts our database
• Vercel: hosts our website
• Brevo: sends our emails and manages our mailing lists
• Google: sign in with Google, and Google Meet for classes that use a Meet link
• Sentry: error reports, with passwords and links removed
• Lens, by Castynet: website usage statistics

If a teacher’s profile links to an intro video on YouTube or Vimeo, that service may collect information when you watch it. We may also share information when the law requires it, or to protect a child’s safety.

9. Where it’s stored

Some of our service providers store or process data on servers outside Kenya. When this happens, we make sure the provider protects it to a standard that meets the Data Protection Act, 2019, for example through their data protection terms with us.

10. Cookies and browser storage

• Sign-in cookie (dk_session): keeps you signed in for up to 30 days. Digikids doesn’t work without it.
• Browser storage: remembers your theme, banners you’ve closed, where to return after signing in, and an unsaved copy of a free-session form so it isn’t lost if the page closes. This stays on your device.
• Usage statistics: the Lens script records the pages you visit and actions you take, as described in section 2.

We don’t use advertising cookies.

11. How long we keep it

• Account, learning, and booking records: while the account is open.
• Payment records: as long as Kenyan tax and accounting law requires, normally 7 years.
• Class recordings: 14 days. Transcripts: 90 days.
• Unsent message attachments: 1 day.
• Consent records and our safety records, such as staff access to conversations: kept after an account is closed, so we can show what was agreed and how a concern was handled.

12. How we protect it

We store passwords only in a scrambled form, keep sign-in tokens hashed, send all data over encrypted connections, and keep recordings and attachments in private storage that is only reached through a signed-in account. Our team can only open a family’s conversations for a recorded reason, and every access is logged. You can turn on two-step sign-in and sign out other devices from your account.

13. Your rights

Under the Data Protection Act, 2019, you have the right to:

• be told how your data is used, which this policy does
• see the personal data we hold about you or your child
• correct data that is wrong or incomplete
• ask us to delete data, or close an account
• object to how we use data, including for marketing
• withdraw a consent you gave, such as for recordings or marketing
• ask for your data in a format you can take elsewhere

To use any of these rights, email info@digikids.co.ke. We may ask you to confirm who you are, and we’ll reply within 7 days. If you’re unhappy with how we handle your data, you can complain to the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke.

14. Changes to this policy

We may update this policy as Digikids changes. We’ll show the date of the latest version at the top of this page and email you about important changes before they apply.