Privacy Policy

1. Who we are

Elimufy ("we", "us") is an AI learning platform provided by iibsofy Oy, Messipojantie 20 B, 90520 Oulu, Finland (Business ID 3427417-3, VAT FI34274173). We are the data controller for the personal data described here. In Kenya, Elimufy is operated by KenZobe Technologies (Nairobi). Questions or requests: info@elimufy.com · +358 45 239 0322.

2. The data we collect

• Account & profile — name, email, phone number, and optional gender/grade; and, if you join a league, a public display name, school, and region.
• Material you upload — the notes, photos, PDFs, and topics you provide for us to build practice, lessons, and tutoring from.
• Learning activity — your answers, concept mastery, tutor progress, credits, and study-time/engagement.
• Payments — records of credit purchases (such as an in-app purchase receipt or a payment confirmation code). We do not store full card details.
• Technical — IP address and device/usage signals used for security, rate-limiting, and abuse prevention; essential sign-in cookies; and, on our website, anonymised analytics (see §10).

3. How we use it

• To provide the service — generate and independently verify practice, run the tutor and grading, track your progress, and run leagues.
• To process payments and manage your credits.
• To keep the platform safe — content moderation, fraud/abuse prevention, and verifying league winners.
• To support you and improve the service.

Our legal bases include your consent, performing our contract with you, and our legitimate interests in a safe, working service. As a Finland-based controller we process personal data under the EU General Data Protection Regulation (GDPR), and, for users in Kenya, consistent with the Kenya Data Protection Act, 2019.

4. AI processing of your material

To generate and verify content, power the study-assistant chat, and read handwriting/photos, the material you provide is processed by third-party AI providers acting on our behalf as our processors. We share only what is needed to perform the task, under terms that restrict how providers may use it. We do not sell your data or your material, and we do not permit it to be used to train third-party models beyond producing your result.

International transfers. Some of these providers, and our hosting, operate on servers outside the European Economic Area and outside Kenya (for example in the United States). Where personal data is transferred internationally, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. A current list of our sub-processors is available on request at info@elimufy.com.

Abuse-prevention logging. To keep the service safe, prevent misuse of the AI, and meet our obligations to the AI providers we rely on, we keep a security log of AI requests — your account or identifier, the time, your IP address, the device/browser, and the type of request (chat, image, and so on). This is metadata: we do not retain the content of your messages, except where our automated safety checks flag a request, in which case we keep that content as evidence. Our legal basis is our legitimate interest in security and abuse prevention. These logs are accessible only to platform administrators, are deleted automatically on a rolling schedule (flagged records may be kept longer where needed), and may be disclosed to authorities or providers where required to investigate misuse.

5. Children & students

Elimufy is used by students. Individuals may create their own account from age 13; younger learners use Elimufy only through a school, teacher, or parent/guardian who provides the required consent. We minimise the data we collect from young users, never require more than needed, and apply the same protections throughout. A parent, guardian, or school may request access to, correction of, or deletion of a child's data at info@elimufy.com.

6. Who we share it with

• Service providers (processors) — our hosting and database provider, the third-party AI providers described above, a third-party website analytics provider, and payment and app-store billing providers (in-app purchase, mobile-money, and card processors). They act on our instructions; a current list is available on request.
• Your institution — if you join a class or an institution, relevant teachers/administrators can see your learning activity for that class.
• Legal — where required by law or to protect rights and safety.

We never sell your personal data.

7. Retention & deletion

We keep your data while your account is active and as needed to provide the service. You can ask us to delete your account and data at any time — see Account & data deletion. We may retain limited records (for example, payment and transaction records) for the period required by Kenyan tax and accounting law, and anonymised, aggregated statistics that no longer identify you. Security and abuse-prevention logs are purged automatically on a rolling schedule (typically within 90 days; records flagged by our safety checks may be kept up to a year).

8. Security

We protect data with encryption in transit, database row-level security and access controls, and least-privilege practices. No system is perfectly secure, but we work to keep your data safe and will notify you and the relevant authority of a qualifying breach as required by law.

9. Your rights

Under the Kenya Data Protection Act, 2019 you can access, correct, delete, or object to the processing of your data, and withdraw consent. Contact info@elimufy.com. You may also complain to the Office of the Data Protection Commissioner (ODPC) of Kenya.

10. Cookies & analytics

We use essential cookies to keep you signed in and secure — these are always on. On our website, only with your consent, we also use analytics to understand aggregate, anonymised usage (which pages are visited and how the site performs) so we can improve it; when enabled, this sets analytics cookies and shares usage and device signals with a third-party analytics provider acting as our processor. Analytics stays off until you accept it in our cookie banner, and you can choose “Essential only” to decline. We do not use advertising cookies and we do not sell your data.

11. Changes

We may update this policy; we'll post the new date here and, for material changes, notify you.

12. Contact

iibsofy Oy — Messipojantie 20 B, 90520 Oulu, Finland. info@elimufy.com · +358 45 239 0322. For any data-protection matter, contact us by email or at the address above.