Privacy Policy

NextGen Learners Hub ("we", "us", "the platform") operates nextgenlearnershub.co.ke, an online learning platform for Cambridge IGCSE Economics (0455), CBE Grade 10 Business Studies and, as its units open, Cambridge IGCSE Business (0264); the Certified AI-Ready Teacher programme (CART), professional development for practising teachers; Safe Stacks, child safeguarding training for coaches of the Speed Stacking Professional Society of Kenya (SSPSK); and Pathway Compass, a guidance tool for families choosing a CBE Senior School pathway.

We are the data controller for the personal data described in this policy, within the meaning of the Data Protection Act, 2019 (Kenya).

If you have a question about anything in this policy, write to us at the address above and a person will answer you.

Most of our students are in Form 4 or Grade 10 and many are under 18. Section 33 of the Data Protection Act, 2019 requires a parent or guardian's consent before we process a child's personal data.

If you believe a child's data is on the platform without a guardian's agreement, tell us and we will suspend the account while we check.

We collect only what the platform needs to work. Nothing here is gathered speculatively.

Your name, email address, and the phone number used for M-Pesa. Your role on the platform — student, facilitator, creator or administrator — and, for educators, the profile details you choose to publish.

Which lessons you open and how far through a video you were, your gatekeeper quiz results (called Readiness Checks on the teacher programme and Gatekeeper Checks on Safe Stacks), your unit assessment scores and attempts (on Safe Stacks, your Final Assessment results and how many of its three attempts you have used), and which units you have unlocked and when that access expires.

When you finish an interactive lab, we keep your quiz score, the date you finished and your Digital Lab Certificate. That is all. The figures you work out, your written answers and your reflection are not sent to us or saved: they stay on the page and are gone when you leave it. If you press Ask Nex for feedback, that one answer is sent to Anthropic for Nex's reply, as below, and the reply is not kept.

Every quiz has one question you answer in your own words. Once the rest of that attempt is passed, your written answer is sent to our AI provider, Anthropic, so that Nex can score it out of 3 against a model answer. We keep your answer, the score, Nex's one-line reason and the name of the AI model that scored it. Keeping them means the same answer always gets the same score, and it lets a person check the score if you question it. If the rest of an attempt is not passed, the written answer is not sent to Nex and is not kept.

The shareable link to the file you submit for a Digital Lab (a document, spreadsheet, slides, PDF or photo, wherever you keep it), your typed Paper 2 answers and any diagrams you upload with them, and the written feedback your facilitator returns to you.

M-Pesa transaction receipts, the amount, the phone number that paid, and the unit or resource bought. We never see or store your M-Pesa PIN. Payment is authorised on your own handset by Safaricom.

If you pay by card or by bank transfer (PesaLink), you enter your details on a secure page hosted by our payment provider, IntaSend. Your card number never reaches us: we receive only the confirmation, the amount and a reference.

Nex is the AI study assistant. To answer you, Nex is sent your question, your last few messages, the lesson material it relates to, and the visible text of the page you have open (the lesson, lab or session on screen, so that it can answer about what you are looking at). Nothing from your other tabs or other pages is sent. All of this goes to our AI provider to generate an answer, and we do not store the conversation.

The questionnaire answers, the child's first name and your contact number. This is set out in full in its own section below, because it works without an account and is kept to a different clock.

Standard server logs — IP address, browser type, timestamps and error traces — kept to keep the service running and secure.

When you join: your name and email, your school, your county, the subjects you teach, your TSC number if you choose to give it, and how you heard about the programme. As you study: the link and note you share for each Staffroom Lab and the facilitator's response, the sessions you have cleared and your best Readiness Check score for each, and the details on your certificate (your name and email, its reference number, the modules completed and the CPD hours). If you joined through a teachers' network that has an arrangement with us, such as Tufunzeni, we record that membership so the member price applies, and the network's named administrator can see your progress on the programme, as set out in If you joined through a teachers' network below.

When you join, through a link from SSPSK: your name and email, and your SSPSK registration number if the link carries one. A link from SSPSK's own platform carries your registration number and your name, which fills in the form for you (you can correct it, since it goes on your certificate); a link SSPSK forwards to a whole group carries neither. As you study: the link and note you share for each Coach's Bench and the facilitator's response, the modules you have cleared and your best Gatekeeper Check score for each, your Final Assessment attempts and best result, and the details on your certificate (your name and email, its reference number and the modules completed). SSPSK is the partner that vouches for you, and a named SSPSK administrator can see your progress, as set out in If you joined through a teachers' network below.

When you check in at a school. You sign in and out at each school by scanning its QR code on SSPSK's platform. Each time you check in, SSPSK's platform tells us that you did, as your SSPSK membership number and the date, and nothing else: not the school, not the times. We record it as a day you used Safe Stacks, as below. We receive nothing if you have not joined Safe Stacks with your own Start Safe Stacks link.

Children's information stays out of the platform. Safe Stacks never asks you to enter a child's name, photograph, contact details, health, family or disciplinary information, in a Coach's Bench or anywhere else, and you must not. The programme's forms (the Parental Consent Form, the Concern Record and the Coach's Code of Conduct) are completed on your own screen and printed or saved as a PDF by your browser: what you type into them is not sent to us and not stored by us, and no copy exists on the platform.

On each day you use the platform while signed in, we note the date, and nothing else: no time, no page, no device. For an SSPSK coach, a day you check in at a school counts too. At the end of each month we count how many of the institution's members used the platform at least once, by signing in or by coming back while still signed in, and bill the institution for that number. Members of no institution are not recorded at all.

For a school, network or society that has an agreement with us: the contact details of its named administrator, the billing M-Pesa number in the agreement, and its invoices, payment prompts, payments and receipts, including any tax it withheld.

Your earnings ledger, withdrawal history, M-Pesa number for payouts, and the tax records we are required to keep, including KRA PIN and withholding tax deducted.

Pathway Compass is different from the rest of the platform in one way that matters: there is no account. A family answers a questionnaire, pays for a report, and reads it from a link. So this section sets out separately what it holds.

We do not ask which school your child attends or hopes to attend, and we do not ask for KJSEA results or an assessment number.

Your report lives at a private link. That link is a key, so treat it like one: anyone holding it can ask for the report. As a second lock, opening it asks for the last four digits of the phone number that paid, which means a link forwarded to somebody else shows them nothing on its own.

Everything Pathway Compass holds about your family — the answers, the report and the name — is erased 150 days after you submit. We email you 14 days before that happens so you can print or save anything you want to keep. After erasure the link stops working and we cannot bring the report back, for you or for anyone else.

The payment record itself survives, because Kenyan tax law requires it, but it is a transaction record: an amount, a date and a receipt. Your child's answers are not part of it.

The parent or guardian agrees before the questionnaire begins, which is what section 33 of the Data Protection Act, 2019 requires for a child's data. You can write to us at any time and have the whole submission deleted before the 150 days are up, and we will do it.

Nex's score on a written answer can decide one thing on its own: a score of 0, meaning no real attempt (blank in substance, off-topic, or a copy of the question), stops that attempt from passing. Any real attempt scores at least 1 and is enough to pass. Every other question in a quiz is marked exactly by our own system against a fixed answer.

Where we rely on consent — chiefly for email reminders — you may withdraw it at any time without losing access to anything you have paid for.

We do not sell your personal data and we never will. We do rely on a small number of service providers to run the platform, and your data passes through them only for the purpose named:

Your facilitator sees your submitted work, your scores and your name, because they cannot mark your work otherwise. Administrators can see account and payment records for support and accounting.

If a school or college enrolled you, a named member of their staff can see your progress. What they see, and what they do not, is set out in If your school or college enrolled you below. If you joined the teacher programme through a teachers' network, its named administrator can see your progress on the programme, as set out in If you joined through a teachers' network.

We will disclose data to a court, the Office of the Data Protection Commissioner, the Kenya Revenue Authority or another authority where the law requires it — and no further than the law requires.

Some learners reach us through an institution — a school, a college or an education company that has licensed our courses for its learners. If you signed in from your school's platform, signed up with a school email address, or used an invitation link they sent you, this section applies to you.

One named member of their staff can see your progress — nobody else. Not the institution at large, not a shared staff inbox, not your class teacher unless they are the named person. Your institution nominates exactly one administrator in its agreement with us, that address is fixed to their account, and it can only be changed by written request to us. It cannot be changed from inside the dashboard.

That person can see:

They prove it is them by a code we email to the address recorded in the agreement, so a forwarded link, a screenshot or a link found in a browser history opens nothing. Each session lasts twelve hours and then they must prove it again.

They can download the list of their learners as a spreadsheet (a CSV file), holding the same details they see on screen. A copy they download is in their keeping, and the duties below apply to it just as they do to the dashboard.

How your institution is billed. If its agreement prices the service per active member, we count at the end of each month how many of its learners used the platform in their own account at least once that month, and its invoice shows that number. The invoice never names you, and says nothing about what you did. To make the count we keep the dates you used the platform (the date only) for 13 months.

That person is bound by the Data Protection Act, 2019, in their own right. Holding your data makes them responsible for it under the Act — they may use it only for supporting your learning, must keep it secure, and must not pass it on. Their institution is answerable for how they handle it, and its agreement with us says so. If you believe your data has been misused, you may complain to your institution, to us, or directly to the Office of the Data Protection Commissioner, and you do not have to go through us first.

You should have been told this by your institution before you joined. If this is the first you are hearing of it, tell us and we will take it up with them.

We are the data controller for your account and coursework. Your institution is a separate controller for whatever they hold about you in their own systems. When we show them your progress, we are disclosing your data to them as a recipient, on the basis of the agreement between us and their own relationship with you.

If they send us their own reference for you — an admission number, a student id — we store it so their reports line up with their register. It is theirs, not ours, and we use it for nothing else.

One institution at a time. You can be linked to only one institution at once. If you move, the first link must be ended before another can claim you; no institution can quietly take you from another.

When the arrangement ends — you leave, they discontinue you, or the licence lapses — the link ends, their branding stops appearing, and they stop seeing your progress from that point. Your work stays yours. Every lesson, score, assessment and certificate remains on your account, and if you return you continue from where you stopped. Certificates already earned keep their name on them, because a certificate records what was true on the day you earned it.

You can ask us to unlink you from an institution at any time. That may end access to units they were paying for, and we will tell you plainly if it does before we act.

Some teachers join the Certified AI-Ready Teacher programme through a teachers' network that has an arrangement with us, such as Tufunzeni, and SSPSK coaches join Safe Stacks through the Speed Stacking Professional Society of Kenya, which works the same way (for Safe Stacks, where this section says "Staffroom Lab" read "Coach's Bench", and "Readiness Check" read "Gatekeeper Check"; the administrator also sees whether you have passed the Final Assessment). If you joined either way, through the network's own link or at its member price, this section applies to you.

One named administrator at the network can see how its members are getting on — nobody else. As with a school, the network names that person in its agreement with us, they prove it is them with a code we email to that address, and the address changes only by written request to us.

That person can see:

If the network pays us per active member, its monthly invoice counts how many members used the platform that month, exactly as for a school: a number, never names.

They also see totals for the whole network, and a note when a member may need a nudge (not started Module 1 after a week, quiet for two weeks, or a Staffroom Lab to redo). They can download their member list as a spreadsheet (a CSV file).

That administrator is bound by the Data Protection Act, 2019, in their own right, exactly as a school's is: they may use what they see only to support their members on the programme, must keep it secure, and must not pass it on, and the network is answerable for how they handle it. You may complain to the network, to us, or directly to the Office of the Data Protection Commissioner.

Your account and your certificate are yours. If you leave the network, or ask us to unlink you, they stop seeing your progress from that point. Your sessions, labs and certificate stay on your account. Unlinking may mean the member price no longer applies to anything you buy afterwards, and we will tell you before we act.

Several of the providers above store data on servers outside Kenya. Section 48 of the Data Protection Act, 2019 permits this where appropriate safeguards exist, and we rely on the contractual protections each provider offers alongside their own security commitments.

If you would rather your data did not leave Kenya, we cannot offer you the service — the platform cannot run without hosting — and we would rather say so plainly than bury it.

Under the Data Protection Act, 2019 you have the right to:

To use any of these, email info@nextgenlearnershub.co.ke. We will respond within 30 days. We will not charge you, and we will not make the service worse for you because you asked.

If you are not satisfied with our answer you may complain to the Office of the Data Protection Commissioner, whose contact details are published at odpc.go.ke.

No system is perfectly secure. If a breach occurs that is likely to affect your rights, we will notify the Office of the Data Protection Commissioner and you, as section 43 of the Act requires.

We use browser storage for four things only:

We do not use advertising cookies, we do not run analytics, and we do not run third-party trackers.

Videos and slides are the exception we do not control. Lesson videos play in YouTube's, Google Drive's or Vimeo's own player, and lesson slides in Google's. When one loads, that company may set its own cookies and sees your IP address and device, under its own privacy policy. We send them nothing about you.

Clearing your browser storage signs you out; it does not delete your account or your progress.

When we change this policy we will update the version and effective date at the top of the page. If a change materially affects your rights, we will email you before it takes effect rather than relying on you to notice.

Earlier versions are available on request.

Questions, requests and complaints all go to the same place, and a person reads them.