Privacy Policy

Timson Academy is an online school based in Nairobi, Kenya, offering courses in AI, digital marketing, virtual assistant work, sales, and personal finance. For any question about this policy or your data, contact us at support@timsonacademy.com.

Account details you give us when you sign up: your full name, email address, and optionally your phone number.

Guardian contact: if you tell us you are under 18, we require a parent or guardian email address, which we keep on file for the life of the account.

Learning activity: which courses you enrol in, your progress through lessons, quiz attempts and scores, and any certificates issued to you.

Payment records: when you pay via M-Pesa we store the phone number used, the amount, the transaction status, and Safaricom's receipt and reference numbers. We never see or store your M-Pesa PIN.

Consent record: the date and time you accepted this policy, so we can demonstrate that consent was given.

To create and secure your account, and to verify who you are when you sign in.

To give you access to the courses you have paid for, and to track your progress and issue certificates.

To take and reconcile payments, and to resolve payment disputes.

To contact you about your account, your courses, and support requests you raise with us.

We process your data on the basis of the consent you give at signup, and where necessary to perform our contract with you — that is, to deliver the course you have enrolled in. You can withdraw consent at any time by asking us to delete your account, though we may need to retain payment records as described below.

Minors may use Timson Academy under adult supervision. We require a parent or guardian email address at signup and will not complete registration without one. A guardian may contact us at support@timsonacademy.com at any time to review, correct, or request deletion of a minor's data.

We do not sell your personal data. We share it only with the service providers that run the platform: Supabase (database, authentication, and file storage), Vercel (application hosting), Safaricom (M-Pesa payment processing), Cloudflare (content delivery, security, and video hosting), and tawk.to (live chat support, if you use it).

We may also disclose data where the law requires it, or to establish or defend a legal claim.

We keep your account data for as long as your account is open. If you ask us to delete your account we will remove your profile and learning records.

Payment and transaction records are kept for seven years after the transaction, as Kenyan tax and financial record-keeping rules require, even where the related account has been deleted.

Certificates remain verifiable after account deletion, but retain only the name they were issued to and the course completed.

Your data is held in an access-controlled database where every table denies access by default, and each account can reach only its own records. Passwords are stored hashed, never in plain text. Staff and administrator accounts are required to use two-factor authentication, and every privileged action taken on the platform is written to an append-only audit log.

Under the Data Protection Act (2019) you have the right to be informed how your data is used, to access a copy of it, to have inaccurate data corrected, to request deletion, to object to processing, and to lodge a complaint with the Office of the Data Protection Commissioner.

To exercise any of these rights, email support@timsonacademy.com. We will respond within the timeframes the Act requires.

If we make a material change to how we handle your data, we will update the date at the top of this page and notify you by email before the change takes effect.