Privacy notice

Wandwise

Effective date: [launch date] Last updated: Sat 7 Nov, 2026

1. Who we are

Wandwise is a learning app for Kenyan learners in Grades 4 to 9, made by Edara Technologies Ltd., a company registered in Kenya (“Wandwise”, “we”, “us”, “our”). It is available at wandwise.co.ke and app.wandwise.co.ke (together, the “Service”).

We are the data controller for the personal data described in this notice: we decide why and how it is processed. This notice explains what we collect, why, who we share it with, how long we keep it, and your rights.

It is issued under the Kenya Data Protection Act, 2019 (the “DPA”), the Data Protection (General) Regulations, 2021, and Article 31 of the Constitution of Kenya, 2010, and follows the ODPC’s guidance note on processing children’s data.

Most of our learners are children. Section 5 explains how we protect them.

2. Who uses Wandwise

• Guardians: parents and legal guardians who add their children as learners.
• Teachers: teachers and tutors who add learners, with each learner’s parent or guardian’s consent.
• Learners: children whose accounts are created by a guardian or teacher. Learners can’t sign up by themselves.
• Website visitors: anyone who visits wandwise.co.ke.

3. Personal data we collect

3.1 Guardians and teachers

• First and last name, email address, phone number and county
• Your role (guardian or teacher) and your confirmation of consent (Section 5), with the time you gave it and the version of the terms you accepted
• Your password, stored only as a one-way hash, or, if you sign in with Google, your Google account identifier, name and email
• Two-step sign-in settings, if you turn it on
• Your settings, such as theme and email preferences (the weekly report, and news and tips)
• The learners linked to your account

3.2 Learners

We collect only what a learner needs to use Wandwise:

• First and last name, school name and grade, entered by the adult who adds them
• A username and password. The password is stored only as a one-way hash.
• An avatar the learner picks from a set of animals, and their settings (theme, mascot colours, reduce motion, sounds and voice)
• Their learning activity: lessons started and finished, answers to questions, quiz results, progress per subtopic, XP, streaks, stars, achievements and milestones

We never collect a learner’s email address, phone number, photos, videos, voice recordings, location or date of birth. Learners can’t chat, message, or see other learners or their results.

If a learner uses Get started without an account, we ask only for a guardian’s email address, so we can ask that guardian to set them up. We collect nothing about the child at that step, and we don’t save the address (Section 11).

3.3 Collected automatically

• IP address, browser and device information, and sign-in times, used for security, keeping you signed in and preventing abuse
• Records of important account actions (for example, adding or deleting a learner), for security and accountability

3.4 Website visitors

On wandwise.co.ke we use PostHog analytics, which sets first-party cookies and records the pages you view, the buttons you click, and your device and browser information (Section 9). The website has no forms and doesn’t ask for your name or email.

4. Why we use personal data, and our lawful basis

5. Children’s data

Under section 33 of the DPA, we process a child’s personal data only with the consent of their parent or guardian, and only in the child’s best interests.

• Consent first. Only an adult can create a learner account. Guardians confirm that they are the learner’s parent or legal guardian. Teachers confirm that they have the consent of each learner’s parent or guardian. This confirmation is required before an account can be set up. We record when it was given.
• Minimal data. We collect only a learner’s name, school, grade, chosen avatar, sign-in details and learning activity (Section 3.2).
• Learning only. We use children’s data only to teach, to show progress, and to keep the Service working and safe. We never sell it, never use it for advertising, and never build marketing profiles from it.
• No trackers on learner screens. Learner screens have no ads, no third-party trackers, no chat and no contact with other learners.
• Who can see it. A learner’s data is visible to the learner, to the adults linked to them, and to our staff only where needed to support the Service.
• Control stays with the adult. A linked adult can see the learner’s progress, change their username, reset their password, and delete the learner, which deletes all of the learner’s data.

6. Automated processing

We work out each learner’s progress automatically from their answers, for example stars and a level such as Meeting expectations. These are learning tools for the learner and their adults. They are not used to make decisions that have legal or similarly significant effects on anyone.

7. Who we share personal data with

We don’t sell, rent or trade personal data. We share it only with the service providers we need to run the Service, under agreements that require them to protect it and use it only on our instructions:

We may disclose personal data if the law requires it, for example to the Office of the Data Protection Commissioner (ODPC), a court or law enforcement.

We will update this notice before we add or replace a provider that handles personal data.

8. Transfers outside Kenya

Our app data is stored in the European Union, website analytics are processed in the European Union, and some providers (email and Google sign-in) process data in the United States. As section 48 of the DPA requires, we transfer personal data outside Kenya only with appropriate safeguards:

• agreements with each provider that require protection equivalent to the DPA’s;
• providers that maintain appropriate technical and contractual safeguards; and
• encryption of personal data in transit and at rest.

9. Cookies

On wandwise.co.ke: we use PostHog analytics cookies to understand how visitors use the website, such as which pages are viewed and which buttons are clicked. When you first visit, a notice tells you that we use cookies. These cookies serve our legitimate interest in running and improving the website. They are not used for advertising, and we don’t sell this data. You can block or delete cookies at any time in your browser’s settings.

In the app (app.wandwise.co.ke): we use only the cookies and browser storage needed to keep you signed in, protect your account and remember your settings. There are no analytics or advertising trackers in the app.

10. Security

• Data is encrypted in transit (HTTPS) and at rest.
• Passwords are stored only as one-way hashes. Learner passwords are shown once, to the adult, when they’re issued.
• Guardians and teachers can turn on two-step sign-in.
• Access is limited by role: adults see only their own learners, and our staff see only what their role needs.
• We take measures to detect and prevent abuse of the Service.

Data breaches

If a personal data breach happens, we will notify the ODPC within 72 hours of becoming aware of it, as section 43 of the DPA requires. We will tell affected guardians and teachers without undue delay where the breach is likely to put their or their learners’ rights at high risk.

11. How long we keep data

We keep personal data for as long as the account it belongs to exists:

• A learner’s data is kept until a linked adult deletes the learner. Deleting a learner permanently deletes all of their data.
• A guardian’s or teacher’s data is kept until they delete their account, which they can do in Settings once their learners have been deleted.
• A learner’s Get started request: the guardian’s email address is used only to send that one email. It isn’t saved to any account or kept as a record.
• Website analytics are kept by PostHog in line with our PostHog settings.

Deleted data may stay in our encrypted backups for a short time until they’re overwritten.

12. Your rights

Under the DPA, you have the right to:

1. be told how we use your personal data (this notice);
2. access the personal data we hold about you or your learner;
3. correct inaccurate or incomplete data;
4. have data deleted;
5. object to processing, including to receiving news and tips;
6. restrict processing in certain cases;
7. receive your data in a structured, commonly used, machine-readable format.

Most of these you can do yourself in the app. You can edit your profile, change a learner’s details or username, turn off emails, delete a learner, or delete your account. For anything else, email us (Section 13). A parent or guardian can exercise these rights on behalf of their child.

We will respond within 30 days and won’t charge for reasonable requests.

13. Contact us

Edara Technologies Ltd. (trading as Wandwise)
Legal and privacy: legal@wandwise.co.ke
Help: support@wandwise.co.ke
Phone: +254 798 646 579
Physical address: Kings Serenity, Ongata Rongai, Kajiado County, Kenya
Postal address: P.O. Box 10175-00100, Nairobi, Kenya

Complaints

If you believe your data protection rights have been infringed, you can complain to the Office of the Data Protection Commissioner (ODPC): https://www.odpc.go.ke, complaints@odpc.go.ke.

14. Changes to this notice

We may update this notice when our practices, our providers or the law change. We will update the “Last updated” date. When a change is significant, we will tell guardians and teachers by email or in the app before it takes effect.

15. Governing law

This notice is governed by the laws of the Republic of Kenya.

This privacy notice was last reviewed on Sat 7 Nov, 2026.