PrivacyPolicy

2. Personal Data We Collect

We collect personal data in the following categories:

2.1 Account and Identity Information

When you register on Masomolab, we collect:

• Full name
• Email address
• Username (chosen by you)
• Profile photo or avatar (optional)
• Password (stored securely via hashing; never stored in plain text)
• Two-factor authentication status and secret
• Account role and platform role (e.g., learner, instructor, admin)
• Account creation date, last login date, and update timestamps
• Email verification status
• Account status (active, banned, deleted)
• Ban reason and ban expiry date (where applicable)

2.2 Profile and Preference Data

To personalise your experience, we may also collect:

• Biography / short bio
• Time zone preference
• Language preference
• UI theme preference (light or dark mode)
• Email notification preferences
• Study reminder preferences
• Gamification data: XP points, level, achievements, learning streak, and streak last-update date

2.3 Session and Authentication Data

We use Better Auth, a server-side authentication library, to manage your sessions. This means we store:

• Session tokens and session metadata (device, IP address, user agent)
• Email verification tokens and their expiry times
• Two-factor authentication setup data
• Password reset tokens (temporary; deleted after use)
• OAuth tokens (if you sign in via a third-party provider such as Google)

Session data is used solely to keep you securely logged in and to protect your account from unauthorised access.

2.4 Organisation Data

If you create or join an organisation (such as a university, school, NGO, or company) on Masomolab, we collect:

• Organisation name, URL slug, description, and logo
• Organisation type (university, school, NGO, company, or other)
• Allowed email domains and auto-approval settings
• Your membership role within the organisation (owner, admin, instructor, teaching assistant, content manager, finance, analyst, or learner)
• Membership join date and active status

2.5 Financial and Payout Data

For organisations that sell courses or receive payouts through Masomolab, we collect:

• Bank account name, bank account number, and bank code (for bank transfer payouts)
• M-PESA payout phone number (for mobile money payouts)
• Payout email address
• Withdrawal schedule preference (e.g., monthly)
• Minimum withdrawal amount setting
• Revenue share percentage agreed with Context Window Limited
• Available balance, pending balance, and total withdrawn amounts (stored in smallest currency unit)

For individual payment transactions, we also collect:

• M-PESA Checkout Request ID
• M-PESA Merchant Request ID
• M-PESA receipt number
• Payment amount, currency, and timestamp
• Transaction status (pending, completed, failed, refunded)

We do not store full card numbers or card CVV codes. Payment processing is handled by Safaricom's Daraja API (M-PESA) and any other integrated payment processors, which operate under their own security standards.

2.6 Course and Learning Data

As you engage with content on the platform, we may collect:

• Courses you enroll in, complete, or drop
• Course progress, quiz scores, assignment submissions, and grades
• Discussion forum posts and comments
• Certificates issued (including certificate template configuration)
• Course staff roles (lead instructor, co-instructor, teaching assistant, grader, guest lecturer)
• Content you create if you are an instructor or content manager

2.7 Technical and Usage Data

When you use masomolab.com, we automatically collect certain technical information, including:

• IP address
• Browser type and version
• Operating system
• Device type
• Pages visited and time spent on each page
• Referring URLs
• Crash reports and error logs

This data is collected through cookies, server logs, and analytics tools and is used to maintain platform security and improve user experience.

2.8 Communications Data

If you contact our support team or communicate with us by email, we collect the content of those communications and your contact details for the purposes of responding to your inquiry.

3. How We Use Your Personal Data

We process your personal data on the following legal bases under the Kenya Data Protection Act, 2019: (a) performance of a contract with you; (b) your consent; (c) compliance with a legal obligation; and (d) our legitimate interests, where these do not override your rights.

Specifically, we use your data to:

• Create, maintain, and secure your account and session
• Verify your email address and identity
• Provide access to courses, learning materials, and platform features appropriate to your role
• Process payments and course enrolments
• Calculate, track, and disburse payouts to organisations
• Generate and issue certificates of completion
• Personalise your learning experience, including gamification features (XP, streaks, achievements)
• Send transactional emails (e.g., password resets, enrolment confirmations, payment receipts)
• Send study reminders and notifications, where you have opted in
• Maintain platform security and detect fraudulent or abusive activity
• Comply with our legal obligations under Kenyan law
• Conduct internal analytics to improve the platform
• Respond to support requests and resolve disputes
• Enforce our Terms of Service

4. Cookies and Tracking Technologies

Masomolab uses cookies and similar tracking technologies to operate the platform and improve your experience. Cookies are small text files stored on your device.

We use the following types of cookies:

• Strictly Necessary Cookies: Required for authentication, session management, and security. These cannot be disabled.
• Functional Cookies: Remember your preferences such as language, time zone, and UI theme.
• Analytics Cookies: Help us understand how users interact with the platform. Where used, these are anonymised or aggregated.

You can control non-essential cookies through your browser settings. Note that disabling certain cookies may affect platform functionality. We will request your consent for non-essential cookies where required by law.

5. How We Share Your Data

We do not sell your personal data. We may share your data in the following limited circumstances:

5.1 Within Masomolab

Your profile information (name, profile photo, and public bio) may be visible to other users on the platform, including instructors and administrators of organisations you belong to. Your role within an organisation is visible to that organisation's administrators.

5.2 Service Providers

We share personal data with trusted third-party service providers who assist us in operating the platform, including:

• Cloud hosting and infrastructure providers
• Email delivery providers (for transactional and notification emails)
• Payment processors (Safaricom Daraja API for M-PESA; other processors as applicable)
• Analytics and error-monitoring services
• Customer support tools

All service providers are contractually required to process your data only on our instructions and to maintain appropriate security measures.

5.3 Legal and Regulatory Disclosure

We may disclose your personal data where required to do so by law, court order, or governmental authority, or where we believe disclosure is necessary to protect the rights, property, or safety of Context Window Limited, our users, or the public.

5.4 Business Transfers

If Context Window Limited undergoes a merger, acquisition, or sale of assets, your personal data may be transferred as part of that transaction. We will notify you of any such change and ensure the receiving entity honours the commitments made in this Policy.

5.5 Organisations You Join

If you join an organisation on Masomolab, the administrators of that organisation may access certain data about your membership, including your role, join date, and course activity within that organisation.

6. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes described in this Policy, unless a longer retention period is required or permitted by law.

• Account data: Retained for the duration of your account and for 7 years after account deletion, for legal and audit purposes.
• Payment and financial records: Retained for at least 7 years as required by Kenya's tax and financial regulations.
• Session and authentication tokens: Retained for the active session period and then securely deleted.
• Soft-deleted accounts: Accounts marked as deleted (deletedAt field) are retained in our system for a grace period before permanent deletion.
• Banned account records: Retained for the duration of the ban and for a reasonable period thereafter.
• Course activity and certificates: Retained for the lifetime of your account and for 7 years after deletion.

You may request earlier deletion of your data in accordance with Section 8 (Your Rights) below, subject to our legal retention obligations.

7. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• Passwords are hashed using industry-standard algorithms and are never stored in plain text
• Session tokens are signed and validated server-side on every request
• Two-factor authentication (2FA) is available to all users
• Email verification is required for account activation
• Financial payout data is encrypted at rest
• Access to production systems and databases is restricted to authorised personnel only
• Regular security reviews and updates to our infrastructure
• Unique database indexes on sensitive fields such as email to prevent duplication

Despite our efforts, no method of transmission over the internet or method of electronic storage is 100% secure. We cannot guarantee absolute security, and you use the platform at your own risk. If we become aware of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the Office of the Data Protection Commissioner (ODPC) as required by law.

8. Your Rights Under the Kenya Data Protection Act, 2019

As a data subject under the Kenya Data Protection Act, 2019, you have the following rights:

• Right to be informed: You have the right to be informed about how we collect and use your personal data, which this Privacy Policy provides.
• Right of access: You may request a copy of the personal data we hold about you.
• Right to rectification: You may request correction of inaccurate or incomplete personal data.
• Right to erasure: You may request deletion of your personal data, subject to our legal retention obligations.
• Right to object: You may object to processing of your personal data based on our legitimate interests.
• Right to data portability: You may request a copy of your personal data in a structured, machine-readable format.
• Right to withdraw consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.
• Right to restrict processing: You may request that we limit the processing of your personal data in certain circumstances.

To exercise any of these rights, please contact us at the details provided in Section 12. We will respond to your request within 21 days as required by the DPA.

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) if you believe your data protection rights have been violated. The ODPC can be reached at:

• Website: www.odpc.go.ke
• Email: info@odpc.go.ke
• Postal Address: P.O. Box 41079-00100, Nairobi, Kenya

9. Children's Privacy

Masomolab's platform is not intentionally directed at children under the age of 18. We do not knowingly collect personal data from children under 18. If you are under 18, you may only use Masomolab with the verifiable consent of a parent or legal guardian.

If we become aware that we have collected personal data from a child under 18 without appropriate consent, we will take steps to delete that information promptly. If you believe we have collected data from a minor without consent, please contact us immediately at the details provided in Section 12.

Organisations of type 'school' using Masomolab to serve minors are responsible for ensuring they have obtained appropriate consent from parents or guardians and must enter into a Data Processing Agreement with Context Window Limited before doing so.

10. International Data Transfers

Masomolab is operated from Kenya. Your personal data may be transferred to and stored on servers located in other countries, including where our cloud hosting and service providers operate. Where such transfers occur, we take appropriate steps to ensure that your data receives a level of protection equivalent to that provided under the Kenya Data Protection Act, 2019, including through the use of standard contractual clauses or other lawful transfer mechanisms.

11. Third-Party Services and Links

Masomolab integrates with the following third-party services whose privacy practices are separate from ours:

• Safaricom M-PESA (Daraja API): Used for payment processing. M-PESA transactions are subject to Safaricom's Privacy Policy available at www.safaricom.co.ke.
• OAuth providers (e.g., Google): If you choose to sign in via Google or another provider, that provider's privacy policy governs the information they share with us.
• Analytics and error monitoring tools: We use industry-standard tools to monitor platform performance.

The platform may contain links to third-party websites. We are not responsible for the privacy practices of those websites and encourage you to read their privacy policies.

12. Contact Us and Data Controller Details

Context Window Limited is the data controller responsible for your personal data collected through masomolab.com.

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact our Data Protection Officer at:

• Company: Context Window Limited
• Platform: Masomolab
• Website: https://masomolab.com
• Email: privacy@masomolab.com

We are committed to resolving any complaints or concerns about our privacy practices. If you are not satisfied with our response, you have the right to escalate your complaint to the Office of the Data Protection Commissioner (ODPC) as described in Section 8.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the 'Last Updated' date at the top of this Policy
• Notify you by email to the address associated with your account
• Display a prominent notice on the platform for a reasonable period

Your continued use of Masomolab after any changes become effective constitutes your acceptance of the revised Policy. We encourage you to review this Policy periodically.