Privacy Policy

Account information: your full name, email address, account type (student or employer), and password (stored securely hashed by our authentication provider, Supabase — we never see or store your plain-text password).

Payment information: when you pay for a course or an employer unlock, your payment is processed directly by Pesapal (for M-Pesa and card payments in Kenya) or Stripe (for international cards). We receive and store only the transaction reference, amount, and status — never your full card number, M-Pesa PIN, or banking credentials.

Course activity: enrolments, lesson completion progress, quiz and sandbox answers, assessment scores, and capstone project submissions.

Self-reported profile data: if you choose to build a talent profile, the headline, bio, skills, years of experience, availability, and portfolio links you enter yourself, plus a phone number if you provide one for employer contact purposes.

We use your data to: deliver the courses and features you have paid for; grade your sandbox, assessment, and capstone submissions using Anthropic's Claude API and generate feedback and certificates; build and display your talent profile if you opt in, and match you to relevant job postings; process payments and prevent fraud; and, only if you opt in, send you marketing communications about new courses or features. You can opt out of marketing emails at any time without affecting your access to paid course content.

We share data with the following service providers, only as needed to run Tundemy:

Anthropic — receives the text of your sandbox, assessment, and capstone submissions in order to grade them via the Claude API. Anthropic processes this data to generate a grade and feedback and does not use it to train its models.

Pesapal / Safaricom (M-Pesa) — receives your name, email, phone number, and payment amount to process M-Pesa and card payments made in Kenya.

Stripe — receives your name, email, and card details to process international card payments. Tundemy never sees or stores your full card number.

Resend — receives your email address to deliver transactional emails such as signup confirmation, password resets, and certificate notifications.

Supabase — hosts our database and authentication system. All account, course, and profile data described above is stored on Supabase's infrastructure.

We do not sell your personal data to anyone, and we do not share talent-pool contact details with an employer unless that employer has paid to unlock your specific profile.

We retain your account and course data for as long as your account remains active, so that you keep access to your course history, certificates, and talent profile. If you request account deletion, we will delete or anonymise your personal data within 30 days, except where we are required to keep certain records (such as payment records) for longer to comply with Kenyan tax or financial regulations. Certificate verification records may be retained indefinitely in anonymised or minimal form (certificate ID, course, and completion date) so employers can continue to verify certificates you have already shared with them.

As a data subject under Kenya's Data Protection Act, 2019, you have the right to: access the personal data we hold about you; request correction of inaccurate or outdated data; request deletion of your data, subject to the retention exceptions described above; object to or restrict certain processing of your data, including marketing communications; and request a copy of your data in a portable format.

To exercise any of the rights above, email hello@tundemy.com from the email address associated with your account. We will verify your identity and respond within the timeframes required under the Data Protection Act (generally within 7 days to acknowledge, and without undue delay to fulfil a valid request).

Tundemy uses essential cookies to keep you signed in and to remember your session — these are required for the platform to function and cannot be disabled while using the service. We do not currently use third-party advertising or tracking cookies.

We use industry-standard measures to protect your data, including encrypted connections (HTTPS) for all traffic, row-level access controls on our database so users can only access their own data, hashed password storage, and restricted internal access to payment and personal data. No system is completely secure, but we work to keep these protections current.

Tundemy is not intended for, and is not directed at, anyone under the age of 18. We do not knowingly collect personal data from children. If we become aware that a user under 18 has created an account, we will close the account and delete the associated data.

We may update this Privacy Policy from time to time to reflect changes to our practices or applicable law. We will update the "Last updated" date above when we do, and for material changes we will make reasonable efforts to notify active users by email.

Questions about this policy or your data can be sent to hello@tundemy.com.