Privacy Policy

1. Who we are

Next Creata is a learning platform operated by Embiro Technologies (U) Limited (“Embiro,” “we,” “us”), registered in Uganda. We can be reached at privacy@embiro.com.

This policy explains what personal information we collect when you use the Next Creata mobile app or web app, how we use it, who we share it with, and the rights you have over it.

2. Information we collect

We collect the following categories of information.

Account information you provide

• Name, email address, password (stored hashed).
• Optional profile details: phone number, country, gender, age band, biography, preferred language, daily learning goal.
• Profile image and email if you sign in with Google (received from Google OAuth; we do not see your Google password).

Learning activity

• Cohorts and programs you enrol in.
• Lesson progress and video watch time, quiz attempts and scores, assignment submissions and instructor feedback, notes and bookmarks you create.
• Engagement signals used for the gamification features: points, badges, certificates, daily streaks, study group memberships, discussion posts.

Technical information

• Device platform (iOS / Android / web), app version, locale, and a push-notification token used to send you alerts.
• Authentication session tokens needed to keep you signed in.
• Diagnostic logs of errors so we can fix bugs (no message bodies are logged).

Files you upload

When you submit an assignment, the file you upload is stored on encrypted object storage (Cloudflare R2). Only you, your mentors, and authorised facilitators in your cohort can access it.

3. How we use it

• Run the learning experience — show you the right cohort, track your progress, deliver lessons.
• Grade your work and share mentor feedback.
• Send you transactional emails and push notifications you opted into (assignment graded, streak reminders, cohort announcements, etc.). You can change notification preferences in Profile → Notifications.
• Issue certificates and badges when you complete requirements.
• Keep the platform secure (detect abuse, debug errors, prevent fraud).
• Improve the product — aggregated and de-identified usage statistics may inform what features we build next.

We do not sell your personal information. We do not show third-party advertising in the app.

4. Legal bases for processing (EU/UK users)

Where applicable, we rely on the following bases under GDPR:

• Contract — to deliver the learning service you signed up for.
• Consent — for optional features like push notifications and optional profile fields. You can withdraw consent at any time.
• Legitimate interests — to keep the service secure and improve it.

5. Who we share data with

We use a small number of sub-processors to run the service. They only receive the data they need to perform their function, and each is bound by data-protection contracts.

• Google — sign-in (OAuth) when you choose that option.
• Vercel — hosts our web app and APIs.
• Neon — managed PostgreSQL database for your account and learning data.
• Cloudflare Stream — video hosting and adaptive streaming.
• Cloudflare R2 — encrypted object storage for files you upload.
• Resend (or equivalent SMTP provider) — transactional email delivery.
• Expo / EAS — push-notification delivery on iOS and Android.

We may also disclose information if required by law, court order, or to protect the rights and safety of users.

6. International transfers

Our sub-processors operate globally. Where data leaves your country, we use mechanisms such as standard contractual clauses or equivalents to keep your data protected.

7. How long we keep data

• Your account and learning history are kept for as long as your account exists.
• If you delete your account, we delete or de-identify your personal information within 30 days, except where we are legally required to retain it (e.g. financial records).
• System logs and backups are rotated and retained for a maximum of 90 days.

8. Your rights

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate information from Profile → Account or by emailing us.
• Delete your account (and the data tied to it).
• Export your data in a portable format.
• Object to or restrict certain processing.
• Withdraw consent for optional processing at any time.

To exercise any of these rights, email privacy@embiro.com. We will respond within 30 days. If you believe we have not handled your data correctly, you have the right to complain to your local supervisory authority — in Uganda, the Personal Data Protection Office (PDPO).

9. Security

Passwords are stored using industry-standard hashing (Better Auth / argon2). Sessions are signed and stored on-device in encrypted secure storage. All network traffic uses TLS. Access to production databases is restricted to a small operations team and audited.

10. Children

Next Creata is intended for users aged 13 and above. Users under the age of 18 should have permission from a parent or guardian before creating an account. If you believe a child under 13 has registered, contact privacy@embiro.com and we will delete the account.

11. Changes to this policy

We may update this policy from time to time. Significant changes will be announced in-app and by email at least 14 days before they take effect. The “Last updated” date at the top of this page reflects the latest version.

12. Contact

Embiro Technologies (U) Limited
Kampala, Uganda
Email: privacy@embiro.com