📚
Loading…
Loading…
Version 2026-10-10.v2 · 10 October 2026
What Study Hub stores about your family, what we do with it, who helps us, and how to see it or delete it. Written in plain language on purpose.
Study Hub is a learning service for Kenya's Competency-Based Curriculum, at shule.world. It is run by Wamatu, trading as Study Hub, Nairobi, Kenya. In the words of Kenya's Data Protection Act, 2019, we are the data controller: we decide what is collected and why, and we answer for it.
To reach us about privacy, write to privacy@shule.world or P.O. Box 2397-00606, Nairobi, Kenya. A person reads every message.
Study Hub is a pilot. Families join by invitation.
We do not collect your phone number, payment details, identity documents or location.
An email address, a photo, a date of birth, a school name, a phone number, a location, or a voice recording. The "Listen" button plays a lesson aloud. It does not record anything.
Children cannot send or receive messages through Study Hub, and there are no public profiles, leaderboards or comparisons between children.
We rely on your consent as the child's parent or guardian. You can withdraw it at any time by deleting the account, and nothing bad happens if you do.
Study Hub decides one thing automatically: which topic to suggest next, based on quiz results. It makes no other decision about your child, and you can see everything it bases that on.
We do not sell data. We do not show adverts. We do not build a profile of your child for marketing, and we never will.
Every Friday at 5pm Nairobi time we email you a short note about each child's week: their first name, what they opened and how their quizzes went. It goes only to an email address you have confirmed.
It is on unless you turn it off. You can stop it with one tap in any note, or from your Account page. The note is put together by a fixed set of rules from your child's numbers. It is not written by AI.
Lessons, questions and pictures are drafted with the help of AI, checked by a second AI pass, and approved by a named person before a child sees them.
AI tools receive lesson text and curriculum documents. They do not receive your name, your email address, your child's name, your child's answers or anything your family types.
We use seven companies. Each one may only use what it receives to provide its service to us.
| Company | What it does for us | What it receives | Where |
|---|---|---|---|
| Turso | Holds the database | Everything listed above | Ireland |
| Vercel | Runs the website | Each page request, including the internet address it came from; lesson pictures and audio | Ireland |
| Resend | Sends our emails | Your name and email address, and the text of each email. The Friday note includes children's first names and their week's results | United States |
| Anthropic | AI that drafts and checks lessons, and prepares a weekly summary of totals for the founder | Lesson text; totals such as how many quizzes were taken. No names, emails or answers | United States |
| OpenAI | AI that draws lesson pictures | A description of the picture. No family data | United States |
| AI that draws lesson pictures | A description of the picture. No family data | United States | |
| Microsoft | Records the "Listen" audio | Lesson text only. No family data | Outside Kenya |
We share data with nobody else, with two exceptions: if a Kenyan law or court requires it, or if it is needed to protect a child from serious harm.
When you tap "Share" on a progress card, your phone sends it through the app you choose, such as WhatsApp. That is your choice each time, and Study Hub does not see who you send it to.
Your family's records are stored in a database in Ireland. The website itself runs in Ireland, and the email and AI services in the table above are in the United States. So your data leaves Kenya.
We chose these companies because they keep data encrypted in transit, limit who can reach it, and are bound by contract to use it only for our service. By agreeing to this policy you consent to your family's data being stored and handled outside Kenya in this way.
| What | How long |
|---|---|
| Your account and your children's names, grades, work and progress | Until you delete the account. Then it is removed at once, in one step |
| Sign-in on a device | 30 days, or until you log out |
| Password-reset links | 1 hour |
| Email-confirmation links | 48 hours |
| Counts of sign-in attempts | Up to 1 hour |
| What you typed into a problem report | Until you delete your account, when your words are removed. Safety reports are different: see "Deleting" below |
| Backups | 90 days in files we keep, and 1 day in our database provider's own recovery copies |
| Statistics that name nobody, such as how many children got a question right | Kept, because they cannot be linked back to a child |
No system is perfectly safe. If your family's data is ever exposed, we will tell you and the Data Protection Commissioner without delay, and in any case as the law requires.
Today, one person: Wamatu, the founder. They can see family records when that is needed to run the service or to answer you.
If anyone else is ever given access, we will update this policy first and tell you. People who help review lessons do not get access to family records.
Under Kenya's Data Protection Act you have the right to know what we hold, to see it, to have it corrected, to object to how we use it and to have it deleted. For a child, the parent or guardian uses these rights on the child's behalf.
| You want to | How |
|---|---|
| See everything we hold | Account, then "Download my family's data". You get a file straight away |
| Correct something | Change a child's avatar on the family page. To correct a name or grade, or remove one child, write to us and we will do it within 7 days |
| Stop the Friday note | One tap in any note, or on your Account page |
| Withdraw your consent | Delete the account, or write to us about one child |
| Delete everything | Account, then "Delete this family account" |
| Ask a question or object | Write to privacy@shule.world. We answer within 7 days |
Deleting your account removes your details, every child's profile, all their work and progress, your consent records and your sign-in on every device. It happens at once and cannot be undone.
A few things remain afterwards, none of them linked to you:
Only a parent or legal guardian aged 18 or over may open an account or add a child. We ask you to confirm this for each child, and we record when you did.
We check that an adult is behind the account in two ways: accounts are opened by personal invitation, and you must confirm your email address before you can add a child.
If you believe a child has been added without a parent's consent, write to us and we will remove the profile.
Please write to us first, so we can put it right. You also have the right to complain to the Office of the Data Protection Commissioner:
The version and date are at the top of the page. If we change something that matters, such as collecting something new or using a new company, we will email you and ask you to agree again before you carry on.
This part is written for you, the learner.