Privacy Policy

Yibuka is a career, money and life-readiness platform built for young people in Kenya aged 16 to 26, and for the parents and guardians who support them. Using it means telling us things about yourself — your age, your county, how you answer an assessment, sometimes your M-Pesa number. This policy is the account of what happens to all of it.

It is written to meet the obligations of the Data Protection Act, 2019 (Kenya) and the regulations made under it, and to be readable by a seventeen-year-old and their mother without a lawyer in the room. Where the two goals pull against each other, we have chosen clarity and then said precisely what we mean.

Who this policy covers

• Anyone who visits yibuka.com without signing in.
• Students and parents who hold a Yibuka account.
• Parents and guardians who are asked to confirm consent for a young person aged 16 or 17.
• Anyone who pays for a premium report.
• Anyone who joins a waiting list or writes to us for support.

What this policy does not cover

• Websites we link to — universities, colleges, employers, scholarship pages, news sources. Following a link takes you into someone else’s privacy policy. See section 20.
• Safaricom PLC’s own handling of your M-Pesa data, which is governed by Safaricom’s privacy policy and its terms for M-Pesa. See section 11.
• Anything you choose to publish or share about yourself elsewhere, including a Yibuka report you forward to a school, employer or family member. Once you send it on, it is out of our hands.

Yibuka is the data controller for the personal data described in this policy. That means we decide what is collected and why, and we are the ones answerable for it.

Data controller

Yibuka

Data protection contact

privacy@yibuka.com

Country of establishment

Kenya

Every request, question or complaint about personal data goes to privacy@yibuka.com. We aim to acknowledge within 7 days and to resolve within 30 days. Section 17 sets out what you can ask for; section 21 sets out where to go if we do not satisfy you.

These terms carry the same meaning everywhere in this policy. Most of them come from the Data Protection Act, 2019.

The Act

The Data Protection Act, 2019 (Kenya), together with the regulations made under it, as amended from time to time.

Personal data

Any information about you from which you can be identified, directly or indirectly — your name and email, but also an identifier tied to you, such as an account ID or a phone number.

Sensitive personal data

The categories the Act treats as needing extra protection: data about your health, race or ethnicity, religious or philosophical beliefs, political opinions, sex life, genetic or biometric data, and details of family or property. See section 7 for our position on these.

Processing

Anything done with personal data: collecting it, recording it, storing it, using it, sharing it, correcting it, deleting it.

Data subject

The living person the personal data is about. Usually, you.

Data controller

The party that decides why and how personal data is processed. For everything in this policy, that is Yibuka.

Data processor

A party that processes personal data on the controller’s instructions and not for its own purposes — our cloud infrastructure providers, for instance. Section 10 lists them.

Consent

A freely given, specific, informed and unambiguous indication that you agree to a particular use of your data. Silence is not consent, and consent can be withdrawn.

Guardian

A parent or other adult with parental responsibility for a young person under 18, who confirms that the young person may hold an active Yibuka account.

The platform

The Yibuka website at yibuka.com, its accounts, assessments, reports and any related service we operate.

ODPC

The Office of the Data Protection Commissioner, Kenya’s data protection regulator.

We collect what the service needs to work and stop there. Nothing in this list exists because it might be useful one day; each category is tied to a purpose in section 6 and a retention period in section 14.

Account and identity data

Collected when you create an account: your full name, email address, the password you set (which is held by our authentication provider as a cryptographic hash and is never visible to us or stored by us in readable form), and whether you are joining as a student or as a parent or guardian.

Profile data

Collected when you complete your profile, so that guidance fits your circumstances rather than a generic Kenyan average: your age, your county (one of the 47), your school or institution, your study or work status, an optional gender, and an optional phone number. Age is required — it determines whether guardian consent applies, and whether we may serve you at all.

Guardian and consent data

Collected only where a young person is 16 or 17: the name, relationship and phone number of the parent or guardian, named by the young person; and, once consent is given, the name the guardian types to confirm it and the date and time of that confirmation. Section 8 explains the whole mechanism.

Assessment data

Your answers to free and premium assessments, the results computed from them — ranked career clusters, dimension scores, strengths, watch-outs, recommended next steps — and when each was taken. Results are stored as a fixed record rather than recalculated on each visit, so that what you read today is what you read last year.

Payment data

Collected when you buy a premium report: the M-Pesa phone number you enter at checkout, the amount in Kenyan shillings, the report purchased, the status of the transaction, the M-Pesa receipt code Safaricom returns, and the internal request identifiers that let a specific payment be matched to a specific attempt.

Communications data

The email address and topic you give when you join a waiting list; the content of emails and support messages you send us and our replies; and your marketing preference — whether you have opted in to hear from us beyond service messages.

Technical data

Generated automatically when you use the platform: your IP address, browser and device type, pages requested and timestamps, held in server logs by our hosting provider; and the session cookie that keeps you signed in. Section 12 covers cookies in full.

At a glance

Directly from you

The overwhelming majority. You type it into a sign-up form, a profile form, an assessment, a checkout field or an email to us. If you can see the field, you are the source.

From your parent or guardian

Where consent is required, the guardian supplies their own confirmed name when they open the consent link. Nothing else about them is collected beyond what the young person already provided.

Automatically as you browse

Server logs and the session cookie described in section 12. We do not run advertising trackers, cross-site pixels or third-party analytics on the platform.

From Safaricom

When a payment completes or fails, Safaricom returns the outcome, the receipt code and the amount. We use it to settle the transaction and to check that the amount paid matches the price we quoted.

Under the Act, personal data may only be processed where a lawful basis applies. This table states ours, purpose by purpose. Where the basis is consent, you may withdraw it at any time and we will stop that use — see section 17.

On legitimate interests

Where we rely on a legitimate interest, we have asked whether our interest is genuinely outweighed by your rights, and we process the minimum that serves it. You may object to any processing based on legitimate interests — see section 17 — and we will stop unless we can show compelling grounds that override your objection.

New purposes

If we ever want to use your data for something not listed above, we will update this policy and, where the law requires it, ask you first. We will not quietly widen the purpose of data you already gave us.

The Act gives special protection to data about health, race or ethnicity, religious or philosophical belief, political opinion, sex life, genetic and biometric data, and family or property details.

Yibuka does not ask for any of it. There is no field for your tribe, your religion, your health, your politics or your family’s means. No assessment question probes them, and no career recommendation is calculated from them. If a form appears to ask you for information of this kind, it is not ours.

Two clarifications, so the position is not overstated:

• Gender is an optional profile field. It is not treated as sensitive personal data under the Act, it is never required, and leaving it blank changes nothing about your results.
• Age is required. It is not sensitive personal data in itself, but because it determines the protections a young person is owed, we treat it with the same care.

This is the section to read most carefully, whether you are the young person or the adult standing behind them.

Our age floor

Yibuka accounts open at 16. Below that we decline the account rather than serve it, and no personal data is retained from the attempt. The free career guides, study routes and money and life-skills lessons need no account at all and remain open to anyone.

Ages 16 and 17

A young person under 18 may create an account, but it does not become active until a parent or guardian confirms it. At sign-up the young person gives their guardian’s name, relationship and phone number, and receives a private link to share with them. The guardian opens that link, sees what Yibuka is and what it will hold, and confirms by typing their own name.

How the consent link is protected

The link carries a long, unguessable, single-purpose token in its address. It is shown only to the young person who requested it, is excluded from search engines by our robots directives, is never published anywhere else, and is destroyed the moment consent is recorded. A used link cannot be reused.

What the guardian can do

• Withdraw consent at any time, by writing to privacy@yibuka.com. The account is deactivated on receipt.
• Ask to see what we hold about the young person.
• Ask us to correct or delete any of it, including the whole account and every assessment result in it.
• Ask how a result was produced. We will explain the scoring in plain terms; section 9 describes it.

We may ask a guardian to verify their identity or their relationship before acting on a request, precisely because these rights are worth protecting from misuse.

Parent and guardian accounts

A parent or guardian account is an adult account and requires the holder to be 18 or over. The data we hold about a guardian is their own account data and, where they have confirmed consent, the record of that confirmation. We do not build a separate profile of a guardian from their child’s activity.

An assessment result is a description, not a verdict, and it is worth being precise about how one is produced.

How scoring works

Scoring is deterministic and rule-based. Your answers are mapped to career clusters and to dimensions such as leadership orientation, numerical reasoning or preference for independence, using fixed rules written by people. The same answers always produce the same result. There is no opaque model, no ranking of you against other users, and no data source outside your own answers and profile.

What it is not

• It is not an automated decision that produces legal effects or similarly significant consequences for you. No admission, job, scholarship or benefit turns on it.
• It is not a psychometric diagnosis, a clinical instrument or a statement about your intelligence.
• It is not a prediction of your income, your employability or your future.

Your results stay yours

Yibuka does not sell assessment results, does not share them with employers, colleges, universities, recruiters, sponsors or partners, and does not use them to rank you for anyone. If we ever offered a way to share your report with an institution, it would be your explicit choice, made per recipient, and revocable.

You can ask for an explanation of any result, ask us to correct answers you recorded in error, or ask us to delete a result entirely. Section 17 explains how.

We share personal data only where it is necessary to run the service or where the law requires it. Every provider below processes data on our documented instructions, under contract, and for no purpose of their own.

Lawful requests

We disclose personal data to authorities only against a request that is valid and lawful on its face. We check it, we disclose no more than it compels, and we tell you it happened unless the law forbids us from doing so.

Premium reports are paid for by M-Pesa, using Safaricom’s STK push. Here is exactly what happens to your data during that exchange.

1. You enter the phone number you want to pay from, and confirm the price shown in Kenyan shillings.
2. We send Safaricom the number, the amount and a reference for the report. We record a pending payment on our side.
3. Safaricom sends the prompt to your handset. You enter your PIN into Safaricom’s prompt — never into Yibuka.
4. Safaricom tells us whether the payment succeeded or failed, and returns the receipt code and the amount. We check that the amount matches what we quoted before unlocking anything.
5. We store the outcome — number, amount, status, receipt code and request identifiers — as the record of the transaction.

Safaricom’s role

For the payment itself, Safaricom acts as an independent data controller under its own privacy policy and M-Pesa terms, and keeps its own transaction records. We cannot delete a record held by Safaricom, and neither can you ask us to.

Why payment records outlive an account

Transaction records are kept for 7 years for tax and audit purposes, even if you close your account. They are reduced to the minimum that satisfies that obligation — the amount, the date, the receipt code and the reference — and are not used for anything else. Section 14 sets out the full retention schedule.

Yibuka uses one cookie. It exists to keep you signed in, and there is no version of the service that works without it.

It is set with the HttpOnly flag, so no script running in your browser can read it; the Secure flag in production, so it is only ever sent over an encrypted connection; and SameSite=Lax, which stops it from being sent along with requests initiated by other websites. Signing out deletes it, and we verify the session against our authentication provider on every request, so a revoked session stops working immediately rather than at expiry.

Your light and dark mode preference

Your choice of light or dark appearance is kept in your browser’s local storage. It never leaves your device and is never sent to us.

What we do not use

• No advertising or retargeting cookies.
• No third-party analytics or behavioural tracking.
• No social media pixels or share-button trackers.
• No cross-site profiling of any kind.

If that changes we will update this section before the change ships, and, where the law requires consent, we will ask for it before setting anything.

Controlling cookies

Your browser can block or delete cookies, including ours. Blocking the session cookie means you cannot sign in, save an assessment or open a report you have paid for — the free guides and lessons will still work.

Yibuka runs on cloud infrastructure whose data centres are located outside Kenya. That means your personal data is processed outside the country, and the Act requires us to be straightforward about it.

What is transferred, and to whom

Account, profile, guardian, assessment and payment records are stored in Google’s infrastructure; request logs sit with our hosting provider. Section 10 names them.

The basis for the transfer

• The transfer is necessary for the performance of the contract between you and Yibuka — the platform cannot run without the infrastructure it runs on.
• Each provider is engaged under a written data processing agreement containing confidentiality, security and sub-processor obligations, and standard contractual protections for international transfers.
• We satisfy ourselves that the provider offers protection commensurate with the Act before entrusting personal data to it, and we do not transfer more than the service requires.

You may ask us for details of the safeguards applying to a transfer by writing to privacy@yibuka.com.

We keep personal data for as long as it serves the purpose it was collected for, and then we delete it. Where the law sets a longer floor — tax records, principally — the law wins, and we keep only the minimum it requires.

Deleting something from our live systems does not remove it from a backup taken yesterday. Backups roll and are purged within 90 days, after which the deletion is complete everywhere. In the meantime, backups are not used to serve the platform and are restored only in a disaster.

Security is a set of specific measures, not an adjective. Ours:

• Encryption in transit. The platform is served over HTTPS throughout; data moving between your device and our infrastructure is encrypted.
• Encryption at rest. Data stored with our cloud provider is encrypted on their infrastructure as standard.
• Passwords we cannot read. Authentication is handled by Firebase Authentication; passwords are stored as salted hashes and are not recoverable, by us or by anyone.
• Hardened sessions. HttpOnly, Secure, SameSite session cookies, verified server-side on every request with an immediate revocation check.
• Database rules. Access to stored records is restricted by server-side security rules, so a record is reachable only by the account it belongs to or by an authorised administrator.
• Least-privilege staff access. Administrator rights are granted deliberately and individually, never by self-service, and are limited to what an administrator needs to run the service.
• Payment isolation. We never receive your PIN, and the amount M-Pesa confirms is verified against the price we quoted before anything unlocks.
• Data minimisation. The most reliable protection for a piece of data is not holding it. We collect the fields the service needs and no others.

What you can do

• Use a password you do not use anywhere else.
• Sign out on a shared or borrowed device — a school lab, a cyber café.
• Never share your M-Pesa PIN with anyone, including anyone claiming to be from Yibuka. We will never ask for it.
• Tell us at privacy@yibuka.com if you think someone else has been in your account.

A personal data breach is any security failure that leads to the destruction, loss, alteration or unauthorised disclosure of personal data. If one happens, this is what follows.

• We contain it, establish what was affected and record the incident.
• Where the breach carries a real risk of harm, we notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of it, as the Act requires.
• We notify affected people without undue delay where there is a real risk of harm to them, in clear language: what happened, what data was involved, what we have done, and what you should do.
• Where a young person is affected, we notify their parent or guardian as well.
• We fix the cause, and we do not treat the notification as the end of the matter.

The Act gives you rights over personal data about you. Some of the following are statutory rights; the rest we extend as a matter of policy. In practice we do not distinguish between the two when you ask.

To be informed

To know what we hold, why we hold it, who receives it and how long we keep it. That is what this document is for.

To access

To get a copy of the personal data we hold about you, together with an explanation of how it is used.

To correction

To have inaccurate, misleading or out-of-date data corrected or completed — including answers recorded in error.

To deletion

To have your data erased where we no longer have a good reason to hold it, or where it is false or misleading. Section 19 covers deleting a whole account.

To object

To object to processing based on our legitimate interests, and to object to direct marketing at any time — an objection to marketing is always honoured, without exception.

To restrict

To ask us to pause a particular use of your data while an accuracy dispute or an objection is being resolved.

To portability

To receive the data you gave us in a structured, commonly used, machine-readable format so you can take it elsewhere.

To withdraw consent

Where we rely on consent, to withdraw it at any time. Withdrawal does not undo processing that was lawful before you withdrew.

To an explanation

To have any assessment result explained to you, and not to be subject to a decision with legal or similarly significant effects based solely on automated processing.

To complain

To take the matter to the ODPC, whether or not you have raised it with us first. Section 21.

How to exercise them

Write to privacy@yibuka.com from the email address on the account, saying what you want. There is no form to fill in and no fee.

• We acknowledge within 7 days.
• We resolve within 30 days, or sooner where the law requires. If a request is genuinely complex and needs longer, we will tell you why and when to expect it, within that same window.
• We may ask you to verify your identity first. This protects you: the point of an access request is defeated if we hand your data to somebody pretending to be you.
• Requests are free. We may charge a reasonable fee, or decline, only where a request is manifestly unfounded or excessive — for instance, repetitive copies of the same records — and we will explain if so.

When we may say no

Occasionally the law prevents us from doing what you have asked: a payment record we must keep for tax, or data whose deletion would infringe someone else’s rights. Where we refuse, we will tell you which part of your request we have refused, on what ground, and how to challenge it.

On behalf of someone else

A parent or guardian may exercise these rights for a young person under 18. We may ask for evidence of the relationship before acting.

Marketing email is opt-in. If you did not tick the box, you will not receive it. Every marketing message carries a working unsubscribe link, and unsubscribing takes effect immediately and permanently unless you opt in again.

Messages that are not marketing

Some emails are part of the service rather than promotion, and you cannot opt out of them while you hold an account: password resets, security notices, guardian consent requests, payment receipts, and notice of changes to these policies. They are sent because you have an account, not to sell you anything.

Changing your mind

Use the unsubscribe link, or write to privacy@yibuka.com. We do not ask why, and we do not send a series of messages trying to talk you out of it.

You can leave at any time, and leaving should not require a negotiation.

How to close an account

Write to privacy@yibuka.com from the email address on the account, asking us to close it. A parent or guardian may make the same request for a young person under 18. The request is honoured on the same timeline as any other.

What is deleted

• Your account, sign-in credentials and profile.
• Every assessment answer and every result, free and premium alike.
• Guardian contact details held on the account.
• Your marketing preferences and waiting-list entries.

What survives, and why

A minimal transaction record — amount, date, receipt code, reference — is kept for 7 years because tax and audit law requires it. It is severed from your profile and used for nothing else.

Yibuka links out constantly — to universities and colleges, to employers and job listings, to scholarship and bursary pages, to news and government sources. Those links are the point of a guidance platform, but they carry you off ours.

We do not control those websites and are not responsible for their content, their accuracy or their privacy practices. Once you follow a link, the other site’s privacy policy applies, not this one. Read it before you hand over anything about yourself.

Start with us

Write to privacy@yibuka.com and tell us what has gone wrong. A person reads it. We acknowledge within 7 days and aim to resolve within 30 days, and if we have got something wrong we would rather hear it from you than from the regulator.

Then, or instead, the regulator

You have the right to lodge a complaint with the Office of the Data Protection Commissioner at any time, whether or not you have raised it with us first. Nothing in this policy or in our Terms of Service takes that right away.

Authority

Office of the Data Protection Commissioner

Address

Britam Tower, Hospital Road, Upper Hill, Nairobi, Kenya

Email

info@odpc.go.ke

Website

https://www.odpc.go.ke

Complaints portal

https://complaints.odpc.go.ke

The Act also provides for compensation where you suffer damage as a result of a contravention. Raising a complaint costs you nothing and does not affect your use of Yibuka.

This policy will change as Yibuka changes. When it does:

• The version number and effective date at the top of this page change with it.
• For material changes — a new purpose, a new category of recipient, a substantially longer retention period — we notify account holders by email before the change takes effect, and where the law requires consent, we ask for it rather than assuming it.
• For minor changes — clarified wording, a corrected address — we update the page and the date.
• Previous versions are archived. Write to privacy@yibuka.com for a copy of the version that applied on a particular date.

Continuing to use Yibuka after a change takes effect means the updated policy applies to you. If you do not accept it, you may close your account under section 19.

Privacy and data rights

privacy@yibuka.com

Everything else

support@yibuka.com

Tell us what you need and, if you have an account, write from the email address on it — that is the quickest way for us to be sure we are talking to the right person.