Privacy Policy

1. Who we are

The data controller is:

We are established in Kenya. We are not an EU or UK establishment. If you use the Platform from another country, we still process your data as described here, under Kenyan law, and on the systems named in section 6.

2. What we collect

Collection is mostly from you. Name and email are required to create an account; without them we cannot provide log-in or enrollments. Other fields are optional unless a specific form says otherwise.

2.1 Account

• Name (including first / middle / surname if you enter them), email, password (hashed by Firebase Auth)
• Google account name, email, and profile photo if you choose Google sign-in
• Optional phone, company, bio, photo, education/experience, and social links on your profile
• Role (student, instructor, or admin) and newsletter / notification preferences

2.2 Learning and support

• Enrollments, progress, quiz scores, bookmarks, lesson notes, study reminders
• Forum posts, Ask Instructor messages, support tickets, suggestion-box text
• Certificate records (name, course, completion date, certificate ID)
• Live-class or study-session requests you submit

2.3 Payments

• Amount, currency (KES), method (M-Pesa or bank transfer), status, and confirmation references we record
• Optional phone number if you add it to your profile
• We do not collect card numbers. We do not use Stripe, Paystack, or card processors on this Platform.

2.4 Technical and analytics

• Device/browser information that Firebase Analytics and hosting logs may receive (including IP as processed by Google)
• Page path, event names, and the analytics events listed in the Cookie Policy
• A first-party event log on our Firestore project (funnels, attribution, optional intent chips). It stores a random anonymous id, optional signed-in user id, course/lesson ids, UTM/ref campaign codes, and enumerated intent chips — not emails, Paybill numbers, quiz answers, or the text you type in catalog search
• Catalog search: we keep recent queries in your browser localStorage; Analytics receives only search surface and result count, not the typed query

2.5 What we do not collect as a student AI product

Student-facing AI chat is not offered (those routes are disabled). We do not send your lesson questions to a model as a tutoring product. Catalog recommendations are rules-based ("Because you enrolled in …"), not an LLM. Staff may send course-outline topics, newsletter draft prompts, or instructor-visible lesson text to configured AI providers to produce drafts that a human must review before publish. Those staff prompts are not used to train a VAS model.

3. Why we process data (purposes and lawful bases)

Under section 30 of the Data Protection Act, 2019 we rely on the bases below. Each activity uses one primary basis.

• Contract: create and secure your account, enroll you, deliver courses, issue certificates, process M-Pesa or bank-transfer enrollments, provide support.
• Consent: optional newsletter and similar promotional email. You can withdraw in Profile Settings or via the unsubscribe link. Registration shows the newsletter box selected by default; you may uncheck it before you submit.
• Legitimate interests: keep the Platform secure, prevent fraud, understand feature use via Firebase Analytics and our first-party event log (page views, completions, coarse search counts, campaign landings, optional intent chips), and show rules-based course suggestions from enrollments you already have. We do not show a cookie banner and do not treat a visit as EU-style consent.
• Legal obligation: keep payment and enrollment records as required for tax, accounting, and dispute handling under Kenyan law.

4. When providing data is mandatory

Email and a name are required to register. Payment confirmation is required for paid enrollment. If you do not provide them, we cannot create the account or activate the course. Profile extras, newsletter, and reminders are optional.

5. How we use data

• Operate VAS eLearning and communicate about your courses
• Verify M-Pesa and bank-transfer payments and issue receipts
• Track progress and generate participation certificates
• Send service notices; send newsletters only if you remain subscribed
• Improve the catalog using analytics events that do not include raw search text
• Enforce the Terms of Service and protect accounts

6. Who receives data

We do not sell personal data. Recipients are:

7. Transfer outside Kenya

Using the Platform involves transfer to Google (Firebase/Analytics) and, for staff AI drafts, to the provider the administrator has enabled. Transfers are for performing the service contract, for our legitimate interest in hosting a working LMS, and — where you chose Google sign-in or a staff member invokes AI — related processing by those providers. We rely on their published security programmes and on encryption in transit. We do not claim an EU adequacy decision for these transfers.

8. Retention

We keep personal data while your account is open and as reasonably necessary afterwards to provide records you may need (for example a certificate), to handle disputes, and to meet legal or accounting duties. We do not currently run a published automated erasure job on a fixed calendar (such as "delete 2 years after closure").

• Account, progress, notes, and enrollments: while the account exists, then until a valid erasure request is completed or a legal hold ends
• Payment records: as long as tax, accounting, or dispute needs require
• Newsletter: until you unsubscribe or the account is closed
• Device preferences, recent searches, anonymous analytics id, and stored UTM/ref: until you clear site data
• First-party analytics event rows: 180 days, then deleted or rolled into daily counts that have no user ids

9. Security

• HTTPS/TLS in transit
• Firebase Authentication and Firestore Security Rules
• Role-based access (student / instructor / admin)
• Paid lesson bodies and quiz answers are not exposed in the public catalog or public search

No method is perfectly secure. If a notifiable breach occurs we will follow the Act (including notifying the Data Commissioner where required).

10. Your rights

Under the Data Protection Act, 2019 you may:

• Be informed about the use of your data (this notice)
• Access the personal data we hold
• Correct inaccurate or incomplete data
• Object to processing, including analytics or marketing
• Request deletion or restriction where the Act allows (including data that is irrelevant, excessive, or no longer authorised to be kept)
• Receive data in a commonly used format (portability) where the Act applies
• Withdraw consent for the newsletter without affecting service emails

How to exercise these rights: email info@vasmetering.com from the address on your account, or write to us at the contact details in section 1. The Platform does not currently offer one-click account deletion or a self-service data export. We will verify your identity and respond as required by the Act and the 2021 Regulations (access, rectification, erasure, and portability have statutory timelines). You can update name, phone, and bio yourself in Profile; the sign-in email field is read-only — ask us if it must change.

You may also lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya.

11. Children

VAS eLearning is a professional training product. It is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe we have, contact us and we will delete the account and related records we are not required to keep.

12. Cookies and similar storage

See the Cookie Policy. We do not currently show a consent banner. Analytics can be limited as described there.

13. Automated decisions

We do not use AI or other fully automated systems to decide enrollments, payments, refunds, grades, or account bans. Enrollment after paybill or bank transfer is administrator-verified. Cancellation refunds are administrator-reviewed. Course locks follow configured rules and staff action.

14. Changes

We will post updates on this page and change the "Last Updated" date. For material changes we will also email the address on your account where practicable. Continued use after the effective date means you have had notice of the updated practices.

15. Contact