Privacy Policy

Who we are

Imizi is an online platform for learning Kinyarwanda and discovering Rwandan culture, based in Kigali, Rwanda. Imizi is the controller of the personal data described here. For any privacy question or request, contact us at imizi@rwandalink.com or through the contact page.

Children and parent-managed accounts

• Children under 16 can only use Imizi through a Family account created and managed by a parent or legal guardian. A Personal account is for people aged 16 and over.
• When creating a Family account, the parent or guardian confirms they are an adult with parental responsibility and gives consent for their children's profiles to be created and used as described in this policy.
• A child profile holds only a display name, an optional picture chosen by the parent, the age group, and the child's learning activity. We do not ask children for an email address, date of birth, location or contact details.
• Parents can see their children's progress, scores and activity, receive an email each time a child profile starts learning, read their children's messages with teachers, and remove a child profile or the whole account at any time. Entering the parent profile requires an extra check (Google sign-in or a parent PIN).
• We never use children's data for advertising or profiling.

What we collect

• Account details: name, email address, country, age group, and either a password (stored only as a secure hash) or your Google sign-in identifier.
• Learner profiles: display names, optional profile pictures and age group for each profile on a Family account.
• Learning activity: lessons started and completed, quiz answers and scores, certificates, and questions you ask the learning assistant.
• Private lessons and messages: bookings with teachers and the messages exchanged with them.
• Payments: what you bought, the amount and its status. Card details are entered on Stripe's secure page; Imizi never sees or stores your card number.
• Technical data: sign-in sessions, IP address and browser type, kept for security (for example to stop password guessing) and to keep the service running.

Why we use it (legal bases)

• To provide the service you signed up for — your account, lessons, progress, certificates, bookings and messages (performance of a contract).
• To process children's data, on the basis of the consent given by their parent or guardian.
• To keep accounts secure, prevent fraud and fix problems (legitimate interests).
• To keep payment and accounting records the law requires (legal obligation).
• To send service emails such as email confirmation, password reset, booking and parent notifications. We do not send marketing emails.

Who we share it with

We do not sell personal data. We use a small number of service providers who process data only on our instructions:

• Railway — hosts the Imizi application and database.
• Microsoft Azure (North Europe region) — stores lesson files uploaded by teachers.
• Stripe — processes card payments.
• Resend — delivers our service emails.
• Google — when you choose “Continue with Google” to sign in.
• OpenAI — powers the learning assistant and the marking of written answers. Only the question or answer being processed is sent, without your name or email, and it is not used to train OpenAI's models.
• Teachers you book see your name and booking details, and the messages you send them.

Some providers are outside Rwanda and the European Economic Area. Where data is transferred internationally, it is protected by the provider's contractual safeguards, such as the European Commission's Standard Contractual Clauses.

Cookies

Imizi uses only two strictly necessary cookies: one that keeps you signed in, and one that remembers your language. We do not use advertising or tracking cookies, and we do not use third-party analytics.

How long we keep it

• Account and learning data: for as long as your account is open.
• When you delete your account, your personal details are removed. Where the law requires us to keep payment records, or a certificate must remain verifiable, the record is kept with your name removed.
• Security records such as expired sessions and sign-in links are deleted automatically.

Your rights

Depending on where you live (including under the EU and UK GDPR and Rwanda's Law N° 058/2021 on the protection of personal data and privacy), you can ask to access, correct, delete or receive a copy of your data, object to or restrict how we use it, and withdraw consent at any time. You can edit your profile and delete your account yourself from Profile. For anything else, email imizi@rwandalink.com; we reply within one month. You also have the right to complain to your data protection authority.

Security

Data is encrypted in transit, passwords are stored only as secure hashes, lesson files are kept in private storage, and staff access is limited by role and recorded in an audit log.

Changes

If we make important changes to this policy we will tell you on the platform or by email. The date at the top shows when it was last updated.