Who processes your information
Sanaa Academy uses personal information to administer registrations, collect and verify payments, provide secure course access, support learners, and meet applicable obligations. Contact the support contact shown on the academy website once enrollment opens for privacy questions, corrections, access requests, or complaints.
What we collect and why
We collect the learner’s name, email, contact phone, adult/under-18 category, optional experience and project interests, consent records, payment references and status, account sessions, lesson activity and project submissions. We use the minimum information needed to deliver and protect the course. We do not collect exact dates of birth or store card numbers, PINs, or M-PESA credentials.
Account and enrollment processing is necessary to provide the requested service. Guardian consent is required for under-18 learners. Optional course-update email is based on your separate choice; withdraw it in your profile or via an unsubscribe link. Operational security and applicable recordkeeping also require limited processing.
Children and guardians
A parent or guardian must use their own verified account email, provide contact details and confirm their authority and consent before registering a child. The guardian manages account access and payment. Contact us to withdraw consent or correct guardian information. We may seek proportionate additional verification where necessary and will not knowingly enroll a child without appropriate authorization. Third-party AI services have their own age and account rules; guardians must review them.
Service providers and international processing
We use Cloudflare for hosting and database services, Paystack for payment processing, and the configured email provider for delivery. Live classes use the announced meeting provider. These services may process information outside Kenya. The academy must configure appropriate processing agreements and safeguards for transfers. We do not sell learner information or publish private progress, contact details, submissions, or meeting links.
Your choices and rights
Use your portal profile to update basic information, manage optional email consent, download your data, or request account deletion. Ask support about correction, access, objection, restriction, consent withdrawal, or a guardian request. Identity will be verified before disclosing or changing account information. Requests are reviewed under applicable Kenyan data protection requirements. You may raise a complaint with Kenya’s Office of the Data Protection Commissioner.
Retention and deletion
Login codes expire after 10 minutes and are single use. Learner sessions expire after seven days, and admin sessions after twelve hours. Expired credentials and temporary login emails are routinely purged. Incomplete registrations should be reviewed after 30 days, and learning records after 12 months following the cohort. Financial and audit records are retained only for the documented period required for accounting, disputes, or legal obligations; the operator records the reason before fulfilling or declining a deletion request. Account deletion removes contact, guardian, session, progress, and submission data, and pseudonymizes retained transaction records.
Security, cookies, and recordings
Essential cookies secure your session. Turnstile helps prevent abuse on public forms. We do not set advertising cookies. We use access controls, encrypted transport, and limited administrative access. No service can guarantee absolute security. Recordings are shared only if specifically arranged with suitable notice and permissions; they are not an automatic course benefit.