Last updated: August 25, 2026
Royal Training College (“we”, “us”, “our”) is committed to protecting the privacy of our users — whether you've enrolled directly or through an organization (a sacco, employer, or training partner) that has licensed our platform for its members. This Privacy Policy explains how we collect, use, store, and protect your personal data in compliance with the Kenya Data Protection Act, 2019 and the General Data Protection Regulation (GDPR) where applicable.
We collect the following categories of personal data:
Account information: name, email address, and authentication credentials when you create an account or purchase a course.
National ID number and phone number: if you're invited into an organization seat without an email address, we collect your national ID number and phone number to identify and authenticate your account, and an ID number is separately collected during admissions applications. These are stored against your account and never displayed publicly.
Payment information: transaction references and amounts processed through Paystack. We do not store your card details — these are handled entirely by Paystack, a PCI-DSS compliant payment processor.
Quiz and progress data: your quiz answers during the onboarding funnel, lesson completion records, quiz attempt scores, and course progress.
Financial statement data (M-Pesa Statement Analysis tool): if you choose to use this optional toolkit feature, you upload an M-Pesa statement PDF and its password. The statement is decrypted and analyzed entirely in server memory for that single request — the file, its password, and every individual transaction line are discarded the moment the analysis finishes. They are never written to a database, disk, or log. Only the derived summary you see on screen (spending categories, income sources, and totals — no individual transaction detail) is saved to your account. Line items from your statement that need categorizing may be sent to our AI provider (see Section 6) solely to generate that summary.
Organization data: if you're a member of an organization licensed onto the platform, your name, email, course progress, and completion records are visible to that organization's authorized administrators and any staff specifically assigned to support you — this is necessary for them to manage your seat and support your progress. It is never visible to other organizations or to members outside your own.
Usage data: pages visited, features used, and technical information such as browser type and device type, collected to improve our service.
Your personal data is used to:
Provide and personalise our learning platform, including course access, progress tracking, quiz results, and certificate generation. Process payments and manage your account. Send transactional emails (purchase confirmations, magic links, enrollment notifications). Improve our courses and platform based on anonymised usage patterns.
We process your data on the following legal bases: contractual necessity (to deliver the courses you have purchased), your consent (for marketing communications, if any), and our legitimate interests (to improve the platform and prevent fraud).
Your data is stored securely using Supabase, which provides enterprise-grade PostgreSQL hosting with encryption at rest and in transit. Authentication tokens are managed through industry-standard protocols. We implement row-level security policies to ensure users can only access their own data.
We share data with the following third-party processors, solely for service delivery:
Supabase: database hosting and authentication. Paystack: payment processing. Resend: transactional email delivery. Anthropic: AI processing for optional toolkit features — categorizing M-Pesa transaction line items into spending/income categories, and drafting the Scam & News Digest from admin-provided source notes. Anthropic does not use this data to train its models.
Each processor is bound by their own privacy policies and data protection obligations.
Under the Kenya Data Protection Act, 2019 and where GDPR applies, you have the right to: access your personal data, correct inaccurate data, request deletion of your data, object to or restrict processing, and data portability. To exercise any of these rights, contact us at the email address below.
We retain your personal data for as long as your account is active or as needed to provide our services. If you request account deletion, we will remove your personal data within 30 days, except where we are required by law to retain it.
Our platform is designed for adult learners and professionals. We do not knowingly collect data from individuals under the age of 18.
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the “Last updated” date.
If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at: info@royaltrainingcollege.com