Your privacy is not a feature. It's a foundation.

Account information

When a parent or guardian registers, we collect their full name, email address, phone number, country of residence, and a hashed password. We never store passwords in plain text.

Child profile data

Parents create sub-profiles for each child. For each profile we collect:

• First name (display name only — no surname required)
• Grade level (1–7) and approximate year of birth
• Academic progress: questions answered, accuracy per topic, XP, level, streak days
• In-game economy: coin balance, wallet balance, transaction history, item purchases
• Battle and tournament history: match outcomes, opponent grades (never opponent identity)

Usage and device data

We automatically collect session timestamps, features accessed, time spent per session, device type, operating system version, app version, and crash reports. We do not collect precise GPS location.

Payment data

Payments are processed through Snippe and supported mobile money operators (M-Pesa, Airtel Money, Mixx by Yas, Halotel). We receive and store only a transaction reference ID, amount, currency, date, payment method type, and success/failure status. Full card numbers, CVV codes, and mobile money PINs are never transmitted to or stored on our servers.

Communications

If you contact us via email or in-app support, we retain that correspondence together with the email address used to ensure continuity of support.

We use the information described above for the following purposes:

• Service delivery — authenticating your account, serving personalised adaptive questions, calculating rewards, and synchronising progress across devices.
• Adaptive learning — tuning question difficulty per topic in real time based on a child's recent performance.
• Payments and wallet — processing subscription charges, coin-to-shilling conversions, and withdrawal requests accurately.
• Parental visibility — populating the parent dashboard with accuracy trends, session times, wallet history, and milestone notifications.
• Safety and fair play — detecting bot-assisted play, preventing duplicate accounts, and enforcing community standards.
• Account communications — sending payment receipts, password-reset emails, security alerts, and critical service notices. We do not send marketing emails without your explicit opt-in.
• Service improvement — using de-identified, aggregated performance data to improve our question bank and difficulty algorithm. Individual children are never identifiable in this analysis.
• Legal compliance — responding to lawful government requests and meeting our obligations under Tanzanian law.

Math GiG is an educational platform intended for children in grades 1–7 (approximately ages 5–14). All accounts are created and controlled by a parent or legal guardian aged 18 or older. Children cannot independently register.

Parental consent model

By creating a child profile, the parent or guardian expressly consents to the collection of that child's learning and progress data for the sole purpose of providing the Math GiG educational service. This consent can be withdrawn at any time by deleting the child's profile.

What we do not collect from children

• Surnames, school names, or home addresses
• Photos or biometric data
• Social connections (children cannot message other users)
• Precise geographical location
• Any data used for advertising or profiling

Battle matching

When a child enters a 1v1 battle, they are matched with an anonymous opponent of the same grade level. Only the opponent's grade level and in-game alias are visible — never their real name, school, or account details.

We do not sell, rent, or trade your personal data to any third party under any circumstances.

Service providers

We engage the following sub-processors, each bound by a Data Processing Agreement:

• Supabase Inc. — cloud database (PostgreSQL), file storage, and authentication infrastructure. Data is stored in the EU (Frankfurt) region.
• Vercel Inc. — web application hosting and content delivery network.
• Snippe — payment gateway for card transactions and mobile money orchestration.

Mobile money operators

When you pay via M-Pesa, Airtel Money, Mixx by Yas, or Halotel, your mobile number and transaction amount are shared with the respective operator solely to complete the transaction. We have no control over how operators handle data passed directly to them; please review their individual privacy policies.

Legal disclosures

We may disclose personal data if required to do so by Tanzanian law, a binding court order, or to prevent or detect fraud and protect the safety of our users. We will notify you of any such disclosure unless legally prohibited from doing so.

Business transfers

In the event of a merger, acquisition, or sale of all or part of Jali Global Tech Limited, your data may be transferred to the successor entity. We will notify you via email at least 30 days before any such transfer and ensure that the recipient entity is bound by equivalent privacy obligations.

We retain your data for as long as your account remains active. The following specific retention rules apply:

• Active account data — retained for the lifetime of the account.
• Child profile data — deleted within 30 days of a parent removing the profile or closing the parent account.
• Financial records — payment transaction records are retained for 7 years to comply with Tanzania's Tax Administration Act (TAA) and Value Added Tax Act requirements.
• Support correspondence — retained for 2 years from the date of last contact.
• Anonymised aggregated data — de-identified statistical data used for product improvement may be retained indefinitely, as it cannot be linked to any individual.
• Deleted account data — upon account deletion, personally identifiable fields are purged within 30 days; financial records are anonymised but retained per the TAA requirement above.

As the account holder (parent or guardian), you have the following rights regarding your personal data and the personal data of children in your care:

• Access — request a complete copy of all personal data we hold about you and your children, in a human-readable format.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — request deletion of your data, subject to legal retention obligations.
• Portability — receive your data in a structured, machine-readable format (JSON or CSV) that you can transfer to another service.
• Restriction — ask us to pause processing of your data while a dispute is resolved.
• Objection — object to processing based on our legitimate interests.
• Withdraw consent — where processing relies on your consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, email info@jaliglobaltech.com from the email address registered to your account. We will respond within 30 days. Identity verification may be required before we release or delete sensitive data.

We take the security of your data and your child's data seriously. Our technical measures include:

• All data is encrypted in transit using TLS 1.3 and at rest using AES-256
• Production database access is restricted to core engineering staff, requires multi-factor authentication, and is fully audited
• Passwords are hashed using bcrypt with a per-user salt; we cannot recover your password in plain text
• Payment data flows directly to Snippe over a separate encrypted channel; our servers never receive raw card or PIN data
• Automated anomaly detection flags suspicious login attempts, unusual transaction patterns, and potential account compromises
• We conduct periodic internal security reviews and commission independent penetration tests

No system is perfectly secure. If you discover a vulnerability in our platform, please report it responsibly to info@jaliglobaltech.com before public disclosure.

For all privacy-related queries, data subject requests, or concerns, please contact our Data Protection Officer:

• Email: info@jaliglobaltech.com
• Support: info@jaliglobaltech.com
• Postal: Jali Global Tech Limited, P.O. Box 1234, Arusha, Tanzania

We aim to respond to all privacy requests within 5 business days and to resolve them within 30 days.

If you are dissatisfied with our response, you may escalate your complaint to the Personal Data Protection Commission of Tanzania or the supervisory authority in your country of residence.