Privacy Policy

This policy explains what data InteligentCMS collects, how we use it, and your rights — including under Kenya's Data Protection Act, 2019.

1. Who we are

InteligentCMS is operated from Kisumu, Kenya. For data protection purposes, the data controller is the InteligentCMS team. You can reach us at inteligentcms@gmail.com.

2. What data we collect

Information you give us

• Account information: First name, last name, email address, phone number, institution name, and password (stored as a salted hash, never in plain text).
• Profile information: Optional avatar image, bio, and last-used course details (college, unit, level, trainer name, class) which we save to pre-fill your next generation.
• Curriculum content: The curriculum files (.docx) you upload and any text you type into the wizard.
• Payment information: Phone number used for M-Pesa STK push, M-Pesa transaction code, and amount. We do not store your M-Pesa PIN or other Safaricom credentials.

Information we collect automatically

• Usage data: Log of your generations (unit name, timestamp, document types produced) for billing, troubleshooting, and your own document history.
• Technical data: IP address, browser type, device type, approximate location (city level), and session timestamps. Used for security and analytics.
• Cookies and local storage: Session tokens (so you stay signed in) and small analytics tags.

3. How we use your data

We use your data only to:

• Run the service — generate your documents, deliver them, save your history;
• Process payments via M-Pesa Daraja and issue receipts;
• Send you transactional emails (account verification, payment receipts, document-ready notifications) and, if you opt in, occasional product updates;
• Improve the platform — diagnose bugs, measure feature usage, prevent fraud;
• Comply with Kenyan law and respond to lawful requests.

4. AI processing of your curriculum

To generate your documents, we send portions of your input (extracted learning outcomes, course information, level, etc.) to AI providers. These currently include Groq, OpenRouter, DeepSeek, and Anthropic. These providers process your input to return generated text but do not retain it for training, per their respective enterprise terms.

We never send your full M-Pesa transaction history, password, or personal identifiers to AI providers — only the curriculum content and metadata needed to produce your documents.

5. Who we share data with

We share data only with the third parties strictly necessary to operate the service:

• Safaricom M-Pesa (Daraja): for payment processing.
• AI providers (Groq, OpenRouter, DeepSeek, Anthropic): for document generation, as described above.
• Email delivery providers: for transactional and password-reset emails.
• Hosting providers: for the storage and serving of the platform itself.

We do not sell your data. We do not share it with advertisers. We will only disclose data to law enforcement if compelled by a valid legal request under Kenyan law.

6. Data retention

• Account data: kept while your account is active. Deleted within 30 days of account deletion request.
• Generated documents and curriculum uploads: kept in your account history so you can re-download. You can request deletion at any time.
• Payment records: kept for 7 years as required for accounting and tax compliance under Kenyan law.
• Logs: rotated and purged after 90 days unless flagged for security review.

7. Your rights under Kenya's Data Protection Act, 2019

As a data subject in Kenya, you have the right to:

• Be informed about how your data is used (this policy);
• Access the data we hold about you;
• Correct inaccurate data;
• Request deletion of your data ("right to be forgotten"), subject to our legal obligations;
• Object to processing for direct marketing;
• Withdraw consent at any time;
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya — odpc.go.ke.

To exercise any of these rights, email us at inteligentcms@gmail.com. We respond within 7 working days.

8. Security

We protect your data with HTTPS encryption in transit, salted password hashing, server-side session validation, rate limiting, and access controls on the database. No system is perfect, but we treat your data with the care we'd want for our own.

9. Children's data

InteligentCMS is intended for adult trainers. We do not knowingly collect data from children under 18. If you believe we have inadvertently collected such data, contact us and we'll delete it.

10. International transfers

Some of our AI processing partners and hosting providers operate servers outside Kenya. By using the service, you consent to this transfer. We use providers that meet recognised data protection standards.

11. Cookies

We use first-party cookies and local storage to keep you signed in and to remember your preferences. We do not use third-party advertising cookies. Most of our cookies are essential for the service to work.

12. Changes

We update this policy occasionally. Material changes will be communicated via email and the "Last updated" date will change. Please review periodically.

13. Contact

Privacy questions: inteligentcms@gmail.com · WhatsApp: +254 715 082 656