Privacy Policy
Effective: January 1, 2025
01 Overview
StudyShare is an Intelligent University Ecosystem serving 10,000+ Kenyan students. Your privacy and trust are fundamental to who we are. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use StudyShare—whether you're accessing our free study materials or using Sofia AI, your personal academic assistant.
Scope: This policy applies to all users in Kenya — whether you browse free resources, create an account, or subscribe to Sofia AI. It does not cover third-party websites or services linked from StudyShare.
Have questions about how we protect your data? Contact us at privacy@studyshare.co.ke.
02 What we collect
Account information:
- Email address and password (hashed and encrypted)
- Full name
- University or school affiliation (optional but recommended)
- Phone number (optional, for subscription verification)
Sofia AI usage:
- Questions and documents you submit to Sofia AI
- Responses generated by Sofia (stored with your account)
- Timestamp and date of each query
Subscription & billing:
- Subscription status (daily or monthly plan)
- Payment transaction ID (M-Pesa reference)
- Billing dates and amounts (KES 20 or KES 100)
- We do NOT store payment card details or M-Pesa credentials — this is handled entirely by our payment processor
Usage & analytics:
- Pages visited and time spent on each section
- Study materials downloaded or bookmarked
- Device type, browser, and basic system information
- General location (country/region, not precise GPS)
Communication:
- Support tickets and emails you send to StudyShare
- Feedback, bug reports, or feature requests
03 How we use data
We use your information only for these purposes:
- Service delivery: Maintaining your account, delivering study materials, processing Sofia AI requests, and managing your subscription.
- Personalization: Recommending study materials based on your university and past activity (optional).
- Support: Responding to your questions, fixing technical issues, and improving customer service.
- Safety: Detecting and preventing fraud, abuse, academic dishonesty, or unauthorized access.
- Analytics: Understanding usage patterns to improve features and user experience (anonymized data only).
- Legal compliance: Complying with applicable laws, court orders, or regulatory requirements in Kenya and East Africa.
We do NOT:
- Sell or rent your personal data to advertisers or marketers.
- Use your data for targeted advertising outside StudyShare.
- Share your Sofia AI questions with third parties for training or analysis.
- Use your academic history for purposes other than supporting your learning.
04 Sofia AI & data processing
Sofia AI subscription: Your subscription to Sofia AI (KES 20/day or KES 100/month) provides you access to our AI assistant and all platform features. You are not paying per question or per document—your subscription covers unlimited use of Sofia AI and access to all study materials.
How Sofia AI works: When you submit a question or document to Sofia AI, we send it to our AI processing server to generate an answer, summary, or practice question. The response is returned to you and stored in your account for future reference.
Data retention for Sofia AI:
- Questions and responses are stored in your account as long as your subscription remains active.
- After account deletion or 12 months of inactivity, Sofia AI history is permanently deleted.
- We retain minimal metadata (timestamps, usage statistics) for up to 90 days for analytics and quality monitoring.
Underlying AI model: Sofia AI is powered by Claude (by Anthropic). Your questions are processed according to Anthropic's Privacy Policy. Anthropic does not use queries from StudyShare to train Claude or improve its models.
Data security in transit: All communication between your device and our Sofia AI server is encrypted using TLS 1.3. Queries are not stored in plaintext on our infrastructure.
Your privacy with Sofia AI: StudyShare staff cannot view or access your Sofia AI questions unless you grant explicit permission for support troubleshooting. Sofia AI responses are yours alone.
05 Payment & billing
Payment processing: Sofia AI subscriptions (KES 20/day or KES 100/month) are processed through M-Pesa (Safaricom Daraja API). We use a PCI DSS-compliant payment gateway.
What we store from payments:
- Transaction ID (M-Pesa reference number)
- Amount and date of payment
- Subscription status (active, expired, cancelled)
- Last 4 digits of phone number used (for verification only)
Refunds and disputes: If you request a refund or report a payment dispute, we may need to verify the transaction with Safaricom, which may involve sharing your transaction ID and phone number with their support team. This is necessary to process your refund securely.
Billing emails: We send subscription confirmations, renewal reminders, and receipts to your registered email. You can disable non-critical emails in your account settings.
07 Security
Data encryption:
- All data in transit is encrypted using TLS 1.3.
- Passwords are hashed using bcrypt with salt, not stored in plaintext.
- Sensitive data at rest (Sofia AI history, payment info) is encrypted using AES-256.
Access controls:
- Only authorized StudyShare staff can access user data, and only when necessary.
- Access is logged and monitored for suspicious activity.
- Multi-factor authentication (MFA) is required for all admin accounts.
Infrastructure security:
- StudyShare runs on AWS infrastructure with regular security audits.
- Firewalls and intrusion detection systems monitor for threats.
- We perform quarterly penetration testing and vulnerability assessments.
- Database backups are encrypted and stored in secure, geographically redundant locations.
Your responsibility: You are responsible for keeping your password confidential. Do not share your StudyShare login with others. If you suspect unauthorized access, change your password immediately and contact us.
No guarantee: While we implement industry-standard security, no system is 100% secure. We cannot guarantee absolute security against all attacks.
08 Data retention
We retain your data only for as long as necessary to provide the service or comply with legal obligations:
| Data type | Retention period |
|---|---|
| Account information (email, name, university) | Active account + 12 months after deletion |
| Sofia AI history | Active subscription + 30 days after cancellation |
| Payment/transaction records | 7 years (required for tax compliance in Kenya) |
| Usage analytics (anonymized) | 12 months |
| Support tickets / emails | 3 years (for dispute resolution) |
| Server logs (IP, browser, etc.) | 30 days |
Account deletion: When you delete your account, all personal data is removed within 30 days. Some data (payment records, anonymized analytics) may be retained longer for legal or operational reasons, but it will not be linked to your identity.
Right to deletion: You can request permanent deletion of your account and associated data at any time. We will comply within 30 days, except where legal obligations require retention.
09 Your rights
Under the Kenya Data Protection Act (2019), you have the following rights:
Access: You have the right to request a copy of all personal data we hold about you. Submit a request to privacy@studyshare.co.ke, and we will provide it within 30 days.
Correction: If any information is inaccurate or incomplete, you can update it directly in your account settings or request that we correct it.
Deletion: You can request deletion of your account and associated personal data. We will delete it within 30 days, except where legal obligations require retention (e.g., payment records for tax purposes).
Portability: You have the right to receive your data in a structured, portable format (e.g., CSV). Email privacy@studyshare.co.ke to request this.
Restrict processing: You can request that we limit how we use your data (e.g., stop analytics tracking). Some features may be unavailable if you restrict certain processing.
Opt-out of communications: You can opt out of marketing emails anytime by clicking "Unsubscribe" in any email, or updating your preferences in account settings. You cannot opt out of transactional emails (receipts, password resets, support responses) as these are necessary to operate the service.
File a complaint: If you believe your rights have been violated, you can file a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya.
Response time: We will respond to all data requests within 30 days. If your request is complex, we may ask for clarification to process it accurately.
11 Children's privacy
StudyShare is designed for students ages 13 and up. We do not knowingly collect data from children under 13.
Users under 18: If you are between 13 and 18, you represent that your parent or guardian has consented to your use of StudyShare and this Privacy Policy. Your parent or guardian can request access to or deletion of your personal data by contacting privacy@studyshare.co.ke.
If we discover data from children under 13: We will immediately delete it and notify the parent or guardian.
12 Policy updates
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Major changes will be announced via email at least 30 days before taking effect.
Your continued use of StudyShare after policy changes means you accept the updated policy. We encourage you to review this page regularly to stay informed.
A revision history is maintained at the top of this page.
13 Contact us
If you have questions about this Privacy Policy or want to exercise your rights, reach out:
- Privacy inquiries: privacy@studyshare.online
- Data access requests: privacy@studyshare.online
- Support & general: support@studyshare.online
- Legal: legal@studyshare.online
- Mailing address: StudyShare, Nairobi, Kenya
Data Protection Officer (DPO): Inquiries can also be directed to our DPO at dpo@studyshare.co.ke.
Average response time: 5–7 business days.