Privacy Policy

1. Information We Collect

When you register for STEM Impact Academy, we collect personal information such as your name, email address, school affiliation, and role. For students, we may collect information provided by their school or teacher, including names and classroom assignments.

2. How We Use Your Information

We use the information we collect to:

• Provide and maintain the STEM Impact Academy platform
• Manage user accounts, classrooms, and enrollments
• Track student progress and generate analytics for educators
• Issue digital badges and certificates
• Communicate platform updates and support information

3. Data Protection

We implement industry-standard security measures to protect your data. All data is encrypted in transit and at rest. We use Firebase infrastructure, which is SOC 2 and ISO 27001 certified, to store and process your information.

4. Student Data (COPPA & FERPA)

We are committed to protecting student privacy. We do not sell student data to third parties. Student accounts are created and managed by authorized educators. We comply with applicable student data privacy regulations including COPPA and FERPA guidelines.

5. Third-Party Services

We integrate with Google Classroom for roster management and assignment syncing. When you connect your Google account, Google's own privacy policy applies to data processed by Google. We only access the minimum data needed for classroom functionality.

6. Data Retention

We retain your data for as long as your account is active. School administrators can request deletion of all school-related data by contacting our support team. Upon account deletion, we remove personal data within 30 days.

7. Contact Us

If you have questions about this Privacy Policy, please contact us at our contact page or email us at privacy@stemimpactcenterkenya.org.

8. Your Data Rights

You have the following rights regarding your personal data:

• Right to access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate or incomplete data
• Right to erasure (“right to be forgotten”) — request deletion of your data, subject to legal retention requirements
• Right to data portability — request a copy of your data in a structured, machine-readable format
• Right to restrict processing — request that we limit how we use your data
• Right to object — object to processing of your data for certain purposes

To exercise any of these rights, email privacy@stemimpactcenterkenya.org. We will respond to your request within 30 days.

9. Children's Privacy (Under 13)

We do not knowingly collect personal data from children under 13 without verifiable parental consent. Student accounts are created by authorized school administrators acting under COPPA's “school official” exception, which permits schools to consent on behalf of parents for educational purposes.

Parents may review their child's data, request deletion, or refuse further collection by contacting their school administrator or emailing privacy@stemimpactcenterkenya.org.

10. Cookies & Tracking

We use essential cookies only for platform functionality. We do not use advertising or third-party tracking cookies.

• Session cookie: __session — 14-day expiry, HTTP-only, secure
• CSRF cookie: __csrf — session-scoped
• Cookie consent preference: sic_cookie_consent — stored in localStorage

For full details, see our Cookie Policy.

11. Subprocessors

We use the following third-party services to operate the platform. Each has been evaluated for adequate data protection measures:

• Firebase / Google Cloud Platform — hosting, database, authentication, storage (US)
• Resend — transactional email delivery (US)
• Google Classroom API — roster sync, when connected by school (US)
• Vercel — build pipeline (US)

12. International Data Transfers

Data is processed on Google Cloud servers primarily located in the United States. We rely on Google's data processing terms and standard contractual clauses to safeguard data transferred internationally.

Kenyan data protection law, specifically the Data Protection Act, 2019, applies to the processing of personal data of users in Kenya.

13. Data Breach Notification

In the event of a data breach affecting personal information, we will notify affected users and relevant authorities within 72 hours of becoming aware of the breach. The notification will include:

• The nature and scope of the breach
• The types of personal data affected
• Remedial actions taken or planned
• Contact information for questions and support

14. Changes to This Policy

We will notify users of material changes to this Privacy Policy via email or a platform banner. Changes will take effect after a 30-day notice period.

Previous versions of this Privacy Policy are available upon request by emailing privacy@stemimpactcenterkenya.org.