Privacy Policy

This Privacy Policy explains how ValidBridge, operated by Stratnovo Systems in Kenya ("we", "us"), handles personal data when you use validbridge.co.ke, organization sites on ValidBridge, our apps and related services (the "Service"). We follow the Data Protection Act, 2019 of Kenya and its regulations.

Words such as "Organization", "Administrator", "Member" and "Customer Content" have the meanings given in our Terms of Service.

• Organization data: when you learn or teach inside an Organization (your school, college, employer or course creator), that Organization is the data controller for your learning data, such as enrolments, progress, submissions, grades, attendance and recordings. We process that data on the Organization's behalf and on its instructions. Contact your Organization first about this data.
• Our own data: we are the data controller for account data we need to run the platform, such as sign-in details, security logs, billing for ValidBridge plans, support requests and visits to validbridge.co.ke.

• Account data: name, username, email address, password (stored only in hashed form), profile photo and preferences.
• Organization and membership data: the Organizations you belong to, your role, user groups and invitations.
• Learning data: courses you take or create, progress, quiz answers, assignment submissions and files, code you run in exercises, grades, feedback and certificates.
• Live class data: attendance (joined, left, how long), chat messages, questions, poll and quiz answers and, when a host records, the recording including audio and video.
• Community data: posts, comments, discussions and boards you contribute to.
• Payment data: for ValidBridge plans, the billing contact, plan and invoice history. For course purchases, the purchase record and payment reference from Paystack. We do not receive full card numbers or M-Pesa PINs.
• Technical data: IP address, device and browser type, pages visited, sign-in times and security events, and error reports.
• Communications: messages you send to support and your email preferences.

We use personal data to:

• provide the Service: sign you in, run courses, live classes, assessments, certificates, communities and payments (to perform our contract with you or your Organization);
• keep the Service and accounts secure, prevent fraud and abuse, and fix problems (our legitimate interests);
• send service emails such as verification, password reset, invitations, class reminders and receipts (to perform the contract);
• send product news, only if you have agreed and with an unsubscribe link in each email (consent);
• understand how the Service is used, in aggregate, so we can improve it (legitimate interests);
• meet legal, tax and accounting duties (legal obligation).

We do not sell personal data and we do not use it for advertising.

When you or an Administrator use an AI feature (for example, drafting a lesson, generating a quiz, captions or audio, translating, or asking the assistant a question), the content needed for that task is sent to our AI provider, Google Gemini by default, which processes it for us to return the result.

• We send only the content needed for the task.
• We do not use your Customer Content to train our own AI models.
• AI features are used when someone chooses to use them; an Organization can turn AI features off.

• Your Organization: Administrators and instructors of an Organization you join can see your profile, activity, progress, submissions, grades and attendance in that Organization.
• Other members: your name, photo and contributions are visible to others where you take part, such as communities, live classes and discussions.
• Paystack: when you buy a course, Paystack processes the payment for the selling Organization under its own privacy policy.
• Service providers that help us run ValidBridge, such as cloud hosting, email delivery, AI processing, error monitoring and usage analytics. They may only use data to provide their service to us, under contracts that require them to protect it.
• Integrations your Organization turns on, such as webhooks, Zapier or calendar invitations.
• Authorities, when the law requires it, or to protect the rights, safety or property of our users or others.
• A buyer or successor, if our business is reorganised or sold, under this policy.

Some of our service providers process data outside Kenya. When that happens, we transfer data only as allowed by the Data Protection Act, 2019, with appropriate safeguards, such as contracts that require the same level of protection.

• Account data: for as long as your account exists. When you delete your account, we delete or anonymise your personal data, except where we must keep it by law.
• Organization data: for as long as the Organization keeps it or has its site. When an Organization is deleted, its Customer Content is deleted.
• Billing records: for as long as tax and accounting law requires.
• Security logs: for a limited period, then deleted.
• Deleted data can remain in backups for a limited time before it is overwritten.

We protect personal data with technical and organisational measures, including encryption in transit (HTTPS), hashed passwords, optional two-factor authentication, role-based access within Organizations and, on eligible plans, audit logs of administrative actions. No system is completely secure; if a breach affects your personal data, we will notify you and the Data Commissioner as the law requires.

Schools and training providers may give learners under 18 access to ValidBridge. In that case the Organization is responsible for obtaining consent from a parent or guardian as required by section 33 of the Data Protection Act, 2019, and for deciding what data is collected. We process children's data only on the Organization's instructions and only to provide the Service.

We use a small number of cookies and similar technologies:

• Essential cookies keep you signed in, remember which Organization you are using and protect against attacks. The Service does not work without them.
• Preference cookies remember settings such as language.
• Analytics cookies help us understand, in aggregate, how the Service is used. You can block them in your browser settings without losing core features.

Under the Data Protection Act, 2019 you have the right to:

• be told how your personal data is used;
• access the personal data we hold about you;
• correct inaccurate data or complete incomplete data;
• have data deleted when it is no longer needed or was processed unlawfully;
• object to processing, including for direct marketing;
• receive your data in a portable format;
• withdraw consent at any time, where we rely on consent.

You can update most details in your account settings. For anything else, email [email protected]. If your request is about data an Organization controls, we will pass it to that Organization or help it respond. We may need to confirm your identity first.

You can also complain to the Office of the Data Protection Commissioner (ODPC) of Kenya at odpc.go.ke.

We will update this policy when our practices or the law change, and change the "Last updated" date above. For significant changes, we will tell you by email or in the product before they take effect.

Questions or requests about privacy: [email protected]. ValidBridge is a product of Stratnovo Systems, Kenya.