Privacy Policy

Last updated: 19 October 2026

This policy explains what personal data Early Monks AI collects, why, who we share it with and your rights. We follow the Kenya Data Protection Act, 2019, and apply the same standards — including those of the EU General Data Protection Regulation (GDPR) and similar laws — to every user wherever they live.

1. Data we collect

  • Account data: full name, email address, phone number, country, preferred currency, password (stored only as a one-way hash), optional profile picture, and your marketing choice.
  • Security data: sign-in times, IP address, browser type, an anonymous device identifier, failed sign-in counts and one-time codes (stored only as hashes). We use these to enforce single-device sessions, lockouts and fraud prevention.
  • Purchase data: what you bought, amounts, currency, payment references and status. Card details are handled by Pesapal; M-Pesa details by PayHero and Safaricom. We never see your card number or PIN.
  • Studio order data: your briefs, reference files and links, WhatsApp number, consultation times, messages, previews and delivered files.
  • Learning data: enrolments, lesson progress, assignments you upload with the prompts and notes you submit, evaluation scores and feedback, and certificates.
  • Lead data: if you request free prompts, your name, email and which emails we have sent you.
  • Cohort data: sessions you reserve.

2. Why we use it (and our legal basis)

  • To provide the Services you buy — performance of our contract with you.
  • To secure accounts, prevent fraud and enforce our Terms — our legitimate interest and legal obligations.
  • To send account, order, payment, course and cohort emails — performance of contract.
  • To send marketing emails — only with your consent, which you can withdraw at any time.
  • To keep accounting and tax records — legal obligation.
  • To verify certificates publicly — legitimate interest in letting employers and clients check them; only the name, course, date and ID are shown.

We do not sell your personal data. We do not use it to train AI models. We do not use advertising or cross-site tracking cookies.

3. Who we share it with

  • Pesapal and PayHero (and through them, card networks and Safaricom M-Pesa) to process payments.
  • Our hosting and email provider (HostPinnacle) which stores the site, database and files and sends our emails.
  • Zoom, when you join a live cohort through its link.
  • WhatsApp (Meta), only if you choose to message us there.
  • AI tool providers such as Google and Higgsfield, but only the content of your studio brief and references that is needed to produce your work, in line with their terms. Do not include personal data in a brief that you do not want processed this way.
  • Our free exchange-rate provider receives no personal data.
  • Authorities, where the law requires it.

4. International transfers

Some of these providers process data outside your country. Where we transfer personal data out of Kenya or another country with transfer rules, we rely on the safeguards those laws allow, such as the provider's contractual commitments.

5. How long we keep it

  • Account data: while your account is open. When you delete your account we erase your profile, picture, submissions, progress and cohort reservations immediately.
  • Payment and order records: kept in anonymised form for up to 7 years for accounting and tax purposes.
  • Delivered studio files: at least 90 days after delivery, then they may be deleted.
  • Security logs and one-time codes: codes are deleted within 2 days; session records within 30 days of ending.
  • Certificates: the verification record (name, course, date, ID) is kept so the certificate stays verifiable, unless you ask us to revoke and remove it.
  • Leads: until you unsubscribe or ask us to delete them.

6. Your rights

You have the right to be informed, to access your data, to correct it, to delete it, to object to or restrict processing, to data portability, and to withdraw consent. You can edit your profile and delete your account yourself from Profile & security. For anything else, contact us; we will respond within 30 days. If you are in Kenya you may complain to the Office of the Data Protection Commissioner; elsewhere, to your local data protection authority.

7. Security

We use encrypted connections (HTTPS), hashed passwords and one-time codes, single-device sessions, automatic idle sign-out, account lockouts, strict security headers, parameterised database queries and private file storage served only after permission checks. No system is perfectly secure; if a breach affects your data we will notify you and the regulator as the law requires.

8. Children

Our Services are for adults aged 18 and over. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

9. Changes

We will post changes here and, for material changes, notify you by email.