This policy explains what personal data LawAI collects, why, and your rights. It is written to align with Kenya’s Data Protection Act, 2019. LawAI is the data controller; contact info@lawai.bar.
1. What we collect
- Account: your email, a hashed password, and optionally a display name, avatar, and the exam you are preparing for.
- Study activity: practice attempts and scores, essay submissions and grades, tutor and note conversations, and any materials you upload.
- Payments: the plan, amount, method, status and, for M-Pesa, the phone number used. We do not receive or store full card numbers.
- Technical: basic log data such as IP address and request times, used for security and rate limiting.
- Support: messages you send us and our replies.
2. Why we use it
- To provide and run the Service. This is necessary to perform our contract with you.
- To send account emails (verification, password reset, receipts, and, if enabled, study-related notices).
- To keep the Service secure, prevent abuse, and enforce our Terms: our legitimate interest.
- To meet legal, accounting, and tax obligations.
- To improve the Service, using aggregated or de-identified data where practical.
3. AI processing
To grade essays, answer tutor questions, and generate practice items, we send the relevant text (your question, essay, or note, plus statute extracts) to a third-party AI provider that runs the model. We choose providers that do not use submitted content to train their models by default. We do not send your name, email, or payment details to the AI provider.
4. Who we share data with
We share data only with providers that help us run the Service:
- a payment processor, to take payments;
- an email provider, to send account emails;
- hosting and infrastructure providers, and the AI provider described above;
- authorities or advisers where we are legally required to, or to protect our rights.
We do not sell your personal data or use it for third-party advertising.
5. International transfers
Some of our providers operate outside Kenya (for example in the United States or Europe). Where data is transferred abroad we rely on the provider’s contractual and technical safeguards to keep it protected to a comparable standard.
6. How long we keep it
We keep your account and study data while your account is active and for a reasonable period afterwards, then delete or anonymise it. Payment and transaction records are kept for as long as the law requires. You can ask us to delete your account at any time.
7. Your rights
Under the Data Protection Act you can ask us to:
- give you a copy of the personal data we hold about you;
- correct data that is wrong or incomplete;
- delete your data, or restrict or object to how we use it;
- provide your data in a portable format;
- withdraw any consent you gave (this does not affect earlier processing).
Email info@lawai.bar to exercise a right. If you are not satisfied with our response, you may complain to the Office of the Data Protection Commissioner (ODPC) in Kenya.
8. Cookies and local storage
We use your browser’s storage to keep you signed in, remember your theme choice, and show a cookie notice once. We do not use third-party advertising or cross-site tracking cookies.
9. Security
Passwords are stored hashed, traffic is served over HTTPS, and access to systems is restricted. No online service can be perfectly secure, but we take reasonable measures to protect your data and will notify you and the ODPC of a serious breach as required by law.
10. Children
The Service is for adults preparing for a professional exam and is not directed at children.
11. Changes
We may update this policy. Material changes will be posted here with a new date and, where reasonable, notified to you.
12. Contact
LawAI, info@lawai.bar.