1. Who We Are
KITABU AI is a learning app (web, Android and iOS) operated by ASTRA QUEST AI, Ouru Towers, 4th Floor, Room 402, Kisii, Kenya (Business Registration No.: BN-KDS9Y72V) ("we", "us", the "company" or the "data controller"). This Policy explains what personal data we collect when you use KITABU AI (the "Platform"), why we collect it, and your rights. For privacy questions or requests, contact hello@kitabu.ai.
We handle personal data in line with Kenya's Data Protection Act, 2019 and its regulations (the "Act"). By using the Platform you confirm you have read this Policy. Please also read our Terms & Conditions.
2. Data We Collect
2.1 Data you give us
Account details - name, email address and, where provided, phone number.
Parent/guardian details - for a learner under 18, the guardian's name and contact details and their consent.
Learner details - grade or level, country and the subjects you study.
Content you submit - questions, prompts, notes and materials you enter, voice/audio recordings and transcripts when you use voice features, the responses generated for you, and in-app safety reports you submit.
Payments - subscription and transaction records. Payments, including M-Pesa checkout where available, are handled by third-party payment providers and recorded by ASTRA QUEST AI for subscription, support, tax, accounting, fraud-prevention, and refund-review purposes. We do not store full card or mobile-money numbers.
Messages - enquiries, feedback and support requests you send us.
2.2 Data we collect automatically
When you use the Platform we collect device and usage data such as IP address, device and app or browser type, settings, app activity, and diagnostic and crash data, including through cookies and similar technologies. We use this to run, secure and improve the Platform. You are responsible for the accuracy of the data you enter.
3. Why We Use Data and Our Legal Basis
Under the Act, we use personal data on these bases:
To provide the service (performance of a contract) - create and manage your account, deliver the learning features, process subscriptions and payments, and give support.
With your consent - to send optional updates or marketing, run referral or promotional activity, and to process a child's data with guardian consent. You can withdraw consent at any time.
Our legitimate interests - to keep the Platform secure, prevent fraud and abuse, fix problems, and improve our features, balanced against your rights.
Legal obligations - to meet tax, accounting and other legal requirements and respond to lawful requests.
4. Children
KITABU AI is intended for learners aged about 9 to 18 (roughly Grade 4 to Grade 12) and is not intended for children under 9. Under the Act, anyone under 18 is a child. A learner under 18 may use the Platform only with the consent of a parent or guardian, who accepts this Policy and our Terms on the child's behalf and is responsible for the child's use.
We do not knowingly collect personal data from a child under 18 without guardian consent. If you believe a child has used the Platform without consent, contact hello@kitabu.ai and we will review and, where appropriate, remove the account and data. We encourage guardians to supervise their child's use of the Platform.
5. How We Share Data
We do not sell your personal data. We share it only as needed:
Service providers who help us run the Platform (for example hosting, cloud, analytics, payment processing, communications and support), under contracts that require them to protect your data and use it only for us.
Where required or permitted by law - to comply with the Act, a court order or a lawful request from a regulator or authority.
To protect safety and rights - to prevent or address fraud, abuse, security issues or unlawful activity, or to enforce our Terms.
In a business transfer - such as a merger or sale of assets, with appropriate safeguards.
6. Storage and International Transfer
We and our providers may store and process data on servers inside or outside Kenya, including via cloud services. Where data is transferred outside Kenya, we take the steps required by the Act to keep it protected, such as appropriate contract terms, your consent, or because the transfer is necessary to provide the service. By using the Platform you acknowledge this.
7. How We Protect Data
We use reasonable technical and organisational measures to protect personal data, and we limit access to people and providers who need it. No system can be completely secure, so we cannot guarantee absolute security. Keep your login details confidential - you are responsible for activity on your account.
8. How Long We Keep Data
We keep personal data only as long as needed for the purposes in this Policy, and for any period required by law (for example financial records). When data is no longer needed, we delete or anonymise it.
9. Your Rights
Subject to the Act, you can: ask what data we hold and get a copy; correct inaccurate data; ask us to delete data or restrict its use; object to certain processing or to direct marketing; ask for portability of data you gave us; and withdraw consent at any time (this does not affect processing already done). You can also unsubscribe from marketing using the link in any such message.
To exercise a right, contact hello@kitabu.ai (for a child, the guardian should make the request). We may ask you to verify your identity. We aim to respond within the time the Act requires, and may decline requests that are unfounded, excessive or that we must refuse to comply with the law.
10. Account and Data Deletion
You can delete your account and personal data at any time - in the app, at https://app.kitabu.online/deletion, or by emailing hello@kitabu.ai (for a child, via the guardian).
You can also ask us to delete specific personal data without deleting your Kitabu AI account. Email hello@kitabu.ai from the address linked to your account, describe the data you want deleted, and include your account email or phone number. We may ask you to verify your identity.
After we verify your request, we delete or anonymise eligible data within 30 days, except data we must keep by law, such as tax, accounting, transaction, fraud-prevention, security, or dispute records, which we keep only as long as required and then delete.
11. Cookies and Similar Technologies
We use cookies and similar technologies (such as local storage and SDKs) to keep you signed in, remember your preferences, keep the Platform secure, and understand and improve how it is used. We use the following categories:
Strictly necessary - needed for sign-in, security and core functions; these are always on.
Functional - remember your settings and preferences.
Analytics - help us see how the Platform is used so we can improve it; where required, used with your consent.
You can accept, reject or delete cookies through your browser or device settings. Blocking some cookies may affect how the Platform works. This list may change as the Platform develops.
On the public marketing website, before you choose, optional provider scripts are not loaded and optional first-party events, identifiers, attribution, and the analytics queue stay in memory. If you allow analytics, Kitabu stores a random anonymous identifier, a browser-session identifier, event IDs, page path, page title, approximate engagement, visible pricing plan/cycle, and campaign attribution such as UTM values, referrer and click IDs; provider cookies such as fbp/fbc/ttp are read only after marketing consent. These identifiers do not include your name, email, phone, school, child content, answers, or exact child grade. A public website form is never copied into analytics.
GA4 may load with analytics-only consent. Meta Pixel, TikTok Pixel and Google Ads load only after explicit marketing consent. Advertising events use only the random anonymous identifier and, for an explicitly consented parent-role event, a coarse grade band (1–3, 4–6, 7–9 or 10–12); exact child grade is not sent to advertising providers. The server may use PostHog for consented first-party analytics. You can choose necessary only, analytics only, or analytics plus marketing in the website banner, and reopen Privacy settings at any time to withdraw optional consent. Withdrawal stops future optional collection and removes the local optional queue; it does not undo processing already completed.
12. AI Features
KITABU AI uses artificial intelligence to generate learning support based on what you submit. This helps with learning and is not a decision that has legal or similarly significant effects on you. We do not make decisions about you based solely on automated processing without a lawful basis under the Act.
If an AI answer or other generated content appears unsafe, inappropriate, harmful, or incorrect, you can report it inside the app. We use report details, the reported content, and relevant context to review and improve safety.
13. Links to Other Services
The Platform may link to third-party websites or services we do not control. This Policy does not cover them, and we are not responsible for their content or privacy practices. Please review their policies.
14. Users Outside Kenya
We operate from Kenya. If another data protection law (such as the EU or UK GDPR) applies to you, you may have additional rights, including the right to complain to your local authority. Contact hello@kitabu.ai to exercise any such rights.
15. Changes to This Policy
We may update this Policy from time to time. We will post the updated version on the Platform, and changes take effect when posted. Please check it from time to time.
16. Complaints
If you have a concern, contact us first at hello@kitabu.ai. You also have the right to complain to the Office of the Data Protection Commissioner (ODPC), www.odpc.go.ke.
17. Contact
Data controller: ASTRA QUEST AI
Address: Ouru Towers, 4th Floor, Room 402, Kisii, Kenya
Email: hello@kitabu.ai
Phone: +254 716 175 485
Website: app.kitabu.online