Privacy notice

BvunzoHub is operated by [company legal name], registered in Zimbabwe under number [registration number], of [registered address] (“we”, “us”). We are the data controller for the personal information described in this notice.

Data controller licence (Cyber and Data Protection Act [Chapter 12:07] and its regulations): [licence number, if required]. Data Protection Officer: [name and contact details]. You can reach us about privacy at [privacy contact email].

When a school gives its students access, the school decides how it uses the platform for its classes. For school accounts, [the school and BvunzoHub each act as controller for their own purposes / the role of each party — to be confirmed in the school agreement].

We collect only what we need to run the service:

• Account details: a display name (a surname is optional), an email address (or, for accounts a school creates, a username), a password (stored only as a one-way hash), and your role (student, parent, teacher or school administrator). A phone number is optional (for example for EcoCash or OneMoney payments): it is not used to sign in, and we do not send text messages to it.
• Study profile: country, examination board, level, form or year, subjects, target exam session, self-assessed ability and optional target grade.
• Learning activity: answers, marks, time spent, lessons opened, flashcard reviews, study plans, streaks and progress by topic.
• AI tutor conversations: the questions you ask and the tutor's replies, including photos of questions you upload.
• Payments: the plan, amount, currency, status and the payment provider's reference. We do not receive or store card numbers or mobile money PINs.
• Technical data: session identifiers, approximate request information such as IP address (used for security and rate limiting), and device and browser type.
• School enquiries: the school name and the contact details you give us in the “Talk to us” form.

We do not ask for a date of birth, national ID number, home address, gender or photograph of you.

We do not sell personal information and we do not use it for advertising. Where we rely on consent, you can withdraw it at any time in your settings or by contacting us.

The platform is built for secondary school learners, many of whom are under 18. We collect the minimum information needed, keep it out of public pages and logs, and never show a learner's surname, school or photograph on shareable results or leaderboards (leaderboards use an automatically generated username unless the learner chooses otherwise).

Where the law requires the consent of a parent or guardian for a learner under 18, we ask for it before the relevant processing starts, and a parent or guardian can review, correct or withdraw it. [Age threshold, the exact consent requirements and verification method to be confirmed against the Act.]

A learner's conversations with the AI tutor are private. They are never shown to teachers, and they are shown to a linked parent only if the learner has agreed.

We use carefully chosen service providers that process personal information on our behalf and under contract:

• Hosting and storage: [hosting provider and region], where the database, files and backups are kept.
• AI provider: Anthropic, PBC (United States), which generates tutor replies and AI-assisted marking. We send the question and a short learning summary (board, subject, topic, recent mistakes); we do not send names, schools or contact details. [Data retention settings of the AI account to be confirmed.]
• Payment provider: Paynow (Zimbabwe) for EcoCash, OneMoney and cards. It receives what it needs to take the payment.
• Email provider: [email provider], which delivers account emails: sign-up and sign-in codes, password resets, security notices and invitations.

A school sees the progress and work of the students in its classes. A linked parent sees their own child's progress. We may disclose information where the law requires it.

Some of our providers process data outside Zimbabwe: the AI provider in the United States, and [hosting location to be confirmed]. We transfer personal information abroad only as the Cyber and Data Protection Act allows, for example where the destination provides an adequate level of protection or with the authorisation of the Data Protection Authority, and we limit what is sent to what each provider needs. [Transfer mechanism and any authorisation to be confirmed.]

When you delete your account, there is a 14-day period in which you can change your mind. After that, your name, email address, phone number, AI conversations and uploads are deleted; your learning history is kept only in anonymised form for statistics.

Subject to the Act, you (or a parent or guardian acting for a learner under 18) have the right to:

• be told how your personal information is used (this notice);
• get a copy of your personal information, including a download of your data;
• have inaccurate information corrected;
• have your information deleted, and delete your account;
• object to, or ask us to restrict, certain processing;
• withdraw consent at any time, without affecting processing that already took place;
• complain to the Data Protection Authority, the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ).

You can use most of these rights in your account settings. Otherwise contact us at [privacy contact email]; we will respond within [the period required by the Act].

Passwords are stored with a modern one-way hashing algorithm, connections are encrypted, access is limited by role (a teacher only sees their own classes), staff access to sensitive records is logged, and personal details are kept out of system logs. No system is perfectly secure; if a breach affects your information we will notify you and the Authority as the law requires.

We use only the cookies needed to sign you in, keep the service secure and remember your display preferences. See the cookie notice.

We will update this notice when our practices change and show the date of the latest version at the top. If a change is significant, we will tell you in the app before it takes effect.