Privacy Policy

This Privacy Policy explains how NuruTeck ("NuruTeck," "we," "us," or "our") collects, uses, shares, and protects personal information when you use the NuruTeck platform at nuruteck.com and any related services — course delivery, the AI study assistant, organization workspaces, certificate verification, and professional services (collectively, the "Platform").

This Policy applies to individual learners, organization administrators and members (schools, companies, and NGOs using a branded NuruTeck workspace), website visitors, and anyone whose certificate is verified through the Platform. By creating an account or otherwise using the Platform, you agree to the collection and use of information as described here.

In plain terms: we collect what we need to run your courses, verify your certificates, process your organization’s payments, and make the AI assistant useful — nothing more, and we never sell your personal data.

NuruTeck exists to close Africa’s digital skills gap — a mission tied directly to UN Sustainable Development Goal 4 (Quality Education) and Goal 10 (Reduced Inequalities). Keeping the individual learner tier free and privacy-respecting, and giving every organization partner (SDG 17: Partnerships for the Goals) clear control over its own members’ data, is part of how we try to deliver on that mission responsibly, not just describe it.

Who We Are

NuruTeck is based in Kigali, Rwanda, and is the data controller for account-level information collected directly through the Platform (such as your login credentials, profile, and payment records).

When you join an organization’s branded workspace (a school, company, or NGO using NuruTeck), that organization is generally the data controller for the information it asks you to provide within its workspace — such as attendance, internal progress notes, or announcements it sends you — and NuruTeck acts as its data processor, hosting and running the Platform on the organization’s behalf. If you have questions about how a specific organization uses your data, please contact that organization directly, or reach out to us and we will help route your request.

Information We Collect

We collect the following categories of information, depending on how you use the Platform:

Category	What We Collect
Account & Profile	Name, username, email address, password (stored as an irreversible hash), profile picture. If you sign in with Google, we receive your name, email, and profile photo from Google.
Organization & Team	Organization name, logo, brand colors, contact details, member roles and invites, announcements, and internal support messages you send within a workspace.
Payment Information	Phone number and transaction reference for mobile-money payments (via Agaseke/Paypack); billing name, email, and phone for card/PayPal payments (via Buy Me a Coffee); payment-proof screenshots for manually reviewed payments. We do not store full card numbers.
Learning & Usage Data	Courses viewed and completed, quiz and assessment results, progress and completion status, and certificates issued to you (including their unique verification code).
AI Assistant Interactions	Questions and messages you send to the AI study assistant, and any course content an organization submits for AI-generated quizzes. Conversations are stored in your account so you can revisit them, and relevant portions are sent to our AI provider to generate a response.
Communications & Support	Messages sent through contact or support forms, and issue reports (including an optional screenshot) submitted via the "Report Issue" tool.
Cookies & Technical Data	IP address, browser and device type, and session/security cookies needed to keep you logged in and protect the Platform from cross-site attacks.

We collect this information directly from you (when you register, pay, or message us), automatically (usage and cookie data), and from third parties you choose to connect (such as Google Sign-In).

How We Use Your Information

• Operate the Platform — create and secure your account, and authenticate your logins.
• Provide learning services — deliver course content, track progress, and generate AI-assisted quizzes from an organization’s own material.
• Issue & verify certificates — produce certificates and power their public, QR-code verification.
• Process payments — confirm mobile-money or card/PayPal payments and manage organization subscriptions and billing tiers.
• Communicate with you — send account, billing, and certificate emails, and respond to support requests and issue reports.
• Improve & secure the Platform — monitor for abuse, debug errors, and improve reliability and features.
• Comply with the law — meet tax, accounting, and other legal or regulatory requirements.
• Support organization administration — organization admins can see their own members’ progress and certificates within their workspace, for legitimate training-management purposes.

Legal Basis for Processing

NuruTeck processes personal data in accordance with Rwanda’s Law N° 058/2021 of 13/10/2021 Relating to the Protection of Personal Data and Privacy. For learners and organizations located outside Rwanda, we aim to apply the same standard of care regardless of local law. Depending on the activity, we rely on one or more of the following legal bases:

• Performance of a contract — to create your account, deliver courses, issue certificates, and process the payments you request.
• Consent — for optional features such as the AI assistant, marketing emails, or connecting a Google account, which you can decline or withdraw at any time.
• Legitimate interest — to secure the Platform, prevent fraud, and improve our services, balanced against your rights.
• Legal obligation — to meet tax, financial-record, and regulatory obligations.

How We Share Your Information

We do not sell personal data. We share personal information only with the following categories of recipients, each of whom processes it under their own privacy terms and only for the stated purpose:

Recipient	Purpose	Data Shared
Google (Google LLC)	Optional "Sign in with Google"	Name, email address, profile photo
Paypack / Agaseke	Mobile-money payment processing (Rwanda)	Phone number, payment amount, transaction reference
Buy Me a Coffee / PayPal	International card & PayPal payments	Billing name, email, phone, payment amount
OpenAI	Powers the AI study assistant & AI-generated quizzes	Submitted prompts and relevant course content
Render (hosting provider)	Application and database hosting	All Platform data, encrypted in transit and at rest
Your organization’s admins	Managing their own branded workspace	Your name, role, course progress, and certificates within that workspace

We may also disclose information where required by law, to enforce our terms, or to protect the rights, safety, or property of NuruTeck, our users, or the public — for example, in response to a valid legal request from a Rwandan or other competent authority.

Certificates & Public Verification

Every certificate NuruTeck issues carries a unique QR code and verification link. Scanning the code, or visiting the verification page directly, confirms your name, the course completed, the issuing organization (if any), and the completion date to anyone who has the code or link — by design, so employers and institutions can trust the credential.

What this means for you: treat your certificate the way you would a printed diploma — its verification details are accessible to anyone who scans it or has the link, even though it is not searchable or listed publicly on its own.

Cookies & Tracking Technologies

• Session cookies — keep you signed in between visits.
• Security (CSRF) cookies — protect forms (login, payment, support) from cross-site request forgery.
• Functional cookies — remember dashboard preferences such as your last-viewed course.

We do not use third-party advertising trackers or sell cookie data. You can block or delete cookies in your browser settings, but doing so will prevent you from staying logged in.

Data Retention

• Account data — retained while your account is active, and for a reasonable period afterward for security, legal, and dispute-resolution purposes.
• Payment records — retained as required by applicable tax and financial recordkeeping rules.
• Certificates — retained indefinitely by default, so a credential remains verifiable years after it was issued. You may request that a certificate be delisted from public verification; see Your Privacy Rights below.
• Support messages & issue reports — retained as needed to resolve the matter and maintain a quality record, then periodically reviewed for deletion.

Data Security

• Passwords are hashed — never stored in plain text.
• Encryption in transit — the Platform is served over HTTPS, and our database connection requires encryption in transit.
• Restricted access — administrative and database access is limited to personnel who need it to operate the Platform.

No method of transmission or storage is 100% secure. If you believe your account or data has been compromised, contact us immediately.

International Data Transfers

NuruTeck is based in Rwanda, but some of the providers we rely on — including our hosting provider and our AI provider — process data on servers located outside Rwanda, including in the United States. Where personal data is transferred internationally, we rely on our providers’ contractual and technical safeguards to protect it to a standard consistent with this Policy.

Your Privacy Rights

Subject to applicable law, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate or incomplete information.
• Deletion — request deletion of your account and associated personal data, subject to our retention obligations above.
• Objection & restriction — object to certain processing, such as marketing emails, or ask us to restrict use of your data.
• Portability — request your data in a portable format.
• Withdraw consent — at any time, for processing that relies on consent, such as the AI assistant or optional communications.

To exercise any of these rights, contact us using the details below. We will respond within a reasonable time and may need to verify your identity first. You may also lodge a complaint with Rwanda’s National Cyber Security Authority (NCSA), or the data protection authority in your own country of residence.

Children’s Privacy

The Platform is intended for users aged 13 and older who register directly. Where younger learners access NuruTeck as part of a school or organization’s branded workspace, that organization is responsible for obtaining any parental or guardian consent required by law before enrolling the child, consistent with its role as data controller for its members described in "Who We Are" above.

If you believe a child has provided us with personal data without appropriate consent, please contact us and we will take reasonable steps to remove it.

Changes to This Policy

We may update this Privacy Policy from time to time as the Platform evolves. When we do, we will revise the effective date at the top of this page, and for material changes we will notify you by email or a notice on the Platform before the change takes effect. We encourage you to review this page periodically.

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or how your information is handled, please reach out — we read every message ourselves.

Email: nuruteck@gmail.com
WhatsApp: +250 790 145 255
Address: Kigali, Rwanda