Privacy Policy

ZoeziZone mobile app and website. Last updated 18 August 2026.

Draft for legal review. This describes what the software actually does, checked against CYBERVANT LTD's ODPC registration. It has not been reviewed by an advocate. Do not rely on it as legal advice.

Who we are

Data controller: CYBERVANT LTD, a private company registered in Kenya
Postal address: P.O. Box 0722136702 – 00400, Nairobi, Kenya
Contact: info@cybervant.co.ke

Our registration as a data controller with the Office of the Data Protection Commissioner (ODPC) is being renewed: renewal filed with the ODPC on 29 October 2026, and we are waiting for the new certificate. We process personal data under the Data Protection Act, 2019.

ZoeziZone is used by children

Most learners are under 18, and many are under 13. The Act treats a child's data as requiring particular care, and we design to that: a learner's practice history stays on their own device unless a guardian consents to share it.

What we collect

Only what the app needs to work:

Learner — the name or nickname you enter, grade, class, school, and the answers and progress produced by using the app.
Parent or guardian — name, mobile number, and email address where you create an account.
School and teacher — school name, and the name and contact details of the school administrator or class teacher, where a school uses ZoeziZone.
Device — an identifier generated on first run, so your device can sync its own records and nobody else's.
Payments — the mobile number used to pay, the amount, and the M-Pesa receipt number. We never see or store your M-Pesa PIN, and we do not store card details.

We do not collect a learner's location, contacts, photos, or microphone or camera data.

Website visits. We count visits to our website on our own servers. There is no tracker, no cookie for this, and nothing is sent to any other company. We record the page visited, the website you arrived from if any, and a short code that lets us tell one visitor from another on the same day only. That code is scrambled with a key that changes every night, so visits on different days cannot be joined up, and it cannot be turned back into your address. We do not store your IP address. Web addresses are stripped of names, sign-in links and identifiers before anything is written down.

App use. We also count how many devices connect to us each day, so we know how many families the app is reaching. This uses the device identifier listed above, which the app already sends when it fetches questions, syncs or collects homework — nothing extra is collected from a child. It is scrambled with the same key that changes every night, so we keep no record of which device did what, and one day cannot be joined to another. We record only that some device connected on a given day: not which subject, not which questions, not which learner. A child practising without a connection is not counted at all, and what they practise still stays on the phone until a guardian allows it to move.

Practice data stays on the device until you allow it to move

A learner's answers and progress are stored on the phone. They are sent to our servers only after a guardian gives consent, which we record with a timestamp, and which you can withdraw at any time in the app under Parent Corner. Where consent has not been given, a school or teacher sees “not reported” rather than a score — never a zero.

Why we process it

To run the app: showing the right curriculum, marking answers, tracking progress, and choosing what to practise next.
To let you, your child's teacher (if you link a school) and anyone you invite follow a learner's progress.
To take payment for a subscription, and to give you what you paid for.
To keep accounts secure — for example, emailing a sign-in code.

We do not sell personal data. We do not use it for advertising, and we do not show advertising to children.

Who else sees it

A child's progress can be seen by these people, and only once a parent or guardian has allowed it:

You, the parent or guardian who created the child's account.
A second guardian you invite — view only; they cannot change or erase anything.
A tutor you link — they see the child's answers and can set work. You can remove a tutor at any time.
A school you link — only the learners a guardian has chosen to share, only what that guardian ticked, and only with that school.

We also share data with these companies, only for the purpose given:

Safaricom (M-Pesa) — to process a payment you initiate.
Our hosting and email providers — to run the service and deliver account emails.
DeepSeek, an AI company based in China — only if a grown-up switches on AI lessons in Grown-up Settings (they are off unless you do). The app then sends the text of the question being explained and its topic, so the explanation can be written. No name, account or device detail is sent.

Where your data is kept

Our servers, and the data on them, are in the United States, run by Railway. Account emails are sent through a provider in Ireland. So data that leaves the phone is stored outside Kenya. It is encrypted on its way to us and where it is stored. Ask us at the address above if you want to know more.

Your rights

Under the Data Protection Act, 2019 you may ask us to give you a copy of your data, correct it, delete it, or stop processing it, and you may withdraw consent at any time. Write to info@cybervant.co.ke and we will respond within the statutory period. If you are not satisfied you may complain to the Office of the Data Protection Commissioner.

How long we keep it

Practice records are kept while the account is in use. Deleting a learner in the app removes that phone's copy only. Practice already shared with us stays on our server until a parent or guardian erases it with “Delete this child's data” on the child's page of the website, which removes it for good. If you reported a tutor, we keep only an anonymous note that a report was made about that tutor and what we decided, with nothing about your child or family, to help keep other children safe. Payment records are kept as long as tax and accounting law requires.

Changes

If we change this policy we will update the date above and, for a significant change, tell you in the app.