Privacy policy
als is built around a student’s own coursework, which makes it a private thing by nature. This page says plainly what we hold, why we hold it, and how to make us stop.
01 / What we collect
The things you hand us, on purpose.
Everything in this list is something you typed, uploaded or chose. None of it is gathered in the background, and the app asks before it takes any of it.
- Your mobile number. To create the account and send the one-time sign-in code. If you sign in with Google instead, we receive your name, email address and profile picture from Google.
- Your coursework. The units, notes, lecture slides, PDFs, photographs of handwritten notes and past papers you file. This is the material the tutor reads, and it is the most sensitive thing we hold.
- What you ask the tutor. Your questions and the answers it gives, so a conversation can continue where you left it.
- Your timetable and calendar. Classes, CATs, assignments, projects and exams, with their dates.
- Your profile, if you fill it in. Name, email address, course, year, semester and a photo. Every field is optional.
02 / What the app records
Three counters, and nothing that follows you.
What the app writes down as you use it, all of it in service of the plan limits rather than a profile of you.
-
Usage counts
Questions asked, quizzes taken, pages uploaded, and your study streak. These enforce the limits on your plan and draw the usage screen. Nothing here is shared or sold.
-
Device identifier
So a plan bought by one student works on one phone at a time. It identifies the handset, not you, and signing in elsewhere replaces it.
-
Payment records
The amount, date and reference of a subscription payment. We never see or store your card number, PIN or M-Pesa credentials, those are entered on Paystack’s own page.
-
Hashed trial marker
A one-way fingerprint of your phone number, so the 14-day free trial cannot be claimed repeatedly. It cannot be turned back into your number.
03 / What we never collect
The permissions the app does not ask for.
A study app has no business knowing where you are or who you call. These are not settings you have to switch off; the requests are not in the app at all.
- Your location. The app never asks for it, at any precision, at any time.
- Your contacts, call log or SMS messages. Not read, not uploaded, not requested.
- Your photo library. Picking one image to attach gives us that image and nothing else. There is no scan of the gallery.
- Card numbers or M-Pesa PINs. Payment happens on Paystack’s own page, not inside the app, so those details never reach us.
- Advertising identifiers. There are no ads in als and no advertising SDK in the build.
04 / Why, and on what basis
Every field, tied to a lawful reason.
The Data Protection Act, 2019 requires a basis for each use. Here is ours, stated per category rather than in one sweeping clause.
| What | Why | Basis |
|---|---|---|
| Mobile number, profile | To create your account and sign you in | Performance of a contract |
| Coursework and chats | To answer your questions from your own material | Performance of a contract |
| Usage counts, device id | To apply plan limits and stop one plan covering many people | Legitimate interest |
| Payment records | To take payment and keep lawful accounts | Contract, and legal obligation |
| Hashed trial marker | To stop the free trial being claimed repeatedly | Legitimate interest |
05 / Training
Your coursework is not our training data.
The single commitment most worth reading twice, because it is the one an AI study app is usually quietly breaking.
We do not train on it. Your notes, files, questions and answers are not used to train any AI model, ours or anyone else’s. They are not sold, not rented, and not shared with advertisers.
Nobody else on your plan can see it. A Friends plan shares the bill, not the library. The person who paid cannot open another member’s units.
What does leave, and how far. To answer a question, the relevant passages from your own material are sent to our AI provider to generate a reply. The provider processes them to produce that answer and does not retain them for training. Whole documents are not sent; only the extracts that match what you asked.
06 / Who we share it with
Five processors, each seeing only its own job.
These are the services needed to run als. There is no sixth, and none of them receive more than the column on the right says.
Some of these process data outside Kenya. Where they do, transfers rely on the safeguards in section 49 of the Data Protection Act, 2019. We will also disclose data where a court order or the law requires it, and we will tell you whenever we are permitted to.
| Service | What it does | What it sees |
|---|---|---|
| Paystack | Takes payment by M-Pesa, Airtel Money or card | Payment details you enter on their page, and the amount |
| Celcom Africa | Delivers the one-time sign-in code by SMS | Your mobile number and the code |
| Supabase | Stores your uploaded files | The files themselves, encrypted at rest |
| Sign-in with Google, and app distribution | Your Google account, only if you choose that route | |
| Our AI provider | Generates answers from your material | The passages relevant to the question you asked |
07 / How long we keep it
Kept while you need it, gone when you say.
Two things outlive a closed account, both for reasons given here, and neither can be used to rebuild your coursework.
Full detail, including how to delete without opening the app, is on the account deletion page.
-
While open
Everything stays, so the tutor keeps knowing your units and your streak keeps counting.
-
On deletion
Content is removed from live systems immediately. Encrypted backups roll over within 30 days, and are never used to restore a deleted account.
-
Payment records
7 years, as Kenyan tax and accounting law requires. Amount, date and reference only.
-
Trial marker
Indefinitely. It is a one-way hash, it is not linked to any of your content, and it cannot be turned back into your number.
08 / Keeping it safe
What stands between your notes and anyone else.
No system is perfect. If a breach ever affects you, we will tell you and the Office of the Data Protection Commissioner as the law requires.
- Encrypted in transit and at rest. Everything travels over HTTPS, and uploaded files are encrypted where they are stored.
- One device at a time. Signing in on a new phone signs the old one out, so a stolen handset loses access straight away.
- Your fingerprint or face, if you want it. The app can be locked behind biometrics from Settings.
- Staff access is narrow. Access to student content is restricted to what is needed to answer a support request you have raised, and nothing else.
09 / Your rights
Six rights, exercised by one email.
Under Kenya’s Data Protection Act, 2019. Write to privacy@ardena.co.ke and we will respond within 30 days, free of charge. If you are not satisfied, you may complain to the Office of the Data Protection Commissioner, Kenya.
- Access. Ask to be shown what we hold about you.
- Correction. Have anything inaccurate put right.
- Deletion. Have it erased, which you can also do yourself in two taps from Settings.
- Restriction. Limit what we do with it.
- Portability. Receive it in a form you can take elsewhere.
- Objection. Object to a particular use of it.
10 / Children, and changes
Who this is for, and how you will hear if it changes.
als is built for students in higher education, and it is not directed at children.
Under 13. als is not directed at children under 13 and we do not knowingly collect their data. If we learn we have, we delete it.
Under 18. Users under 18 should have a parent or guardian’s agreement before paying for anything.
Changes to this policy. If we change it, we update the date at the top. For anything significant we will tell you inside the app before it takes effect, rather than relying on you to come back and reread this page.
Questions
Ask us anything on this page.
A real person reads these. If something here is unclear, that is a fault in the writing and we would like to fix it.
Applies to als (Ardena Learning System), package com.ardena.als, and to this website. Operated by Ardena, Nairobi, Kenya. Last updated 23 August 2026.