Privacy Policy

ZedExams ("we", "us", "our") provides an online learning platform for Zambian Grade 4–7 learners, their teachers, and schools. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have. It applies to zedexams.com and any associated mobile or desktop apps.

1. Who we are

ZedExams is operated from Zambia. If you have any questions about this policy or about your data, you can reach us by email at support@zedexams.com, on WhatsApp at +260 977 740 465, or via the contact form on our home page.

2. Information we collect

We collect only what we need to run the service:

• Account information — your name, email address, role (learner / teacher / admin), grade (for learners), and school name (for teachers).
• Authentication data — your password is handled by Firebase Authentication; we never see or store it directly.
• Usage data — quiz and exam attempts, scores, lesson views, generation history, badges, and similar activity needed to show your progress.
• Teacher verification documents — if you apply to be a verified teacher, we collect your school name and the proof file you upload (for example a teaching certificate or a Teaching Council of Zambia registration document), together with file metadata such as filename and size. We do not ask for or collect your NRC or any other government ID number.
• Guardian contact and consent records — for learners under 18, a parent or guardian's email address or WhatsApp number so they can approve the account, plus a record of that approval (when the link was used, and the device it was used from). We use this contact only to ask for and record that approval, plus account safety and the parental rights described in section 4 — never for marketing, and we send the guardian nothing else.
• Date of birth — learner accounts only. Asked once at sign-up, so we can set up an age-appropriate experience and know whether an account needs a guardian's approval. We store the date, not a photograph or a document. Teacher and parent accounts are not asked for a date of birth at all — they simply confirm that they are 18 or older, and we record that confirmation as a yes/no answer rather than as a date.
• Ask Zed conversations — the messages you send to our AI study assistant, so it can answer follow-ups and so we can debug abuse. Contact details (phone numbers, email addresses, links) are removed before a learner's message is written to our logs.
• Device & technical data — basic browser / device information, IP address (for abuse prevention), and crash and error reports describing what went wrong so we can fix bugs.
• Product analytics — optional, and off until you opt in. If you turn analytics on (at zedexams.com/preferences), we use PostHog to collect usage events — which pages and features are used — along with device and browser information and an approximate, city-level location estimated from your IP address. Analytics profiles are identified by a random account identifier and your role, never by your name or email. For teacher and admin accounts, PostHog may also record a replay of how you interact with our screens so we can find and fix usability problems; anything typed into a form is masked out of those recordings, and they are deleted after 30 days. Learner accounts are treated differently — see section 4.

We do not ask for your physical address, NRC or other government ID number, or financial information. If you use a paid feature, payment is handled by the payment provider (see section 5) and we only receive confirmation of the transaction — never your full payment details.

3. How we use your information

• To create and secure your account, and to keep you signed in.
• To provide the learning content and AI tools you request.
• To show your progress, badges, leaderboards, and history.
• To verify teacher applications and prevent platform abuse.
• To answer your questions when you contact us.
• To improve the platform — fix bugs, monitor performance, and decide what to build next.

We do not sell your personal information, and we do not use it to send unsolicited advertising.

4. Children's privacy

ZedExams is designed for Zambian Grade 4–7 learners (typically aged 9–12). If you are a learner under 18, please use ZedExams with the awareness of your parent, guardian, or teacher. We rely on schools and parents/guardians to confirm that a learner is permitted to create an account.

When someone under 18 signs up, we ask for a parent or guardian's contact details and send them a link to approve the account. Until they approve it, the account runs in a limited mode: the learner can read lessons and past papers, but cannot use the Ask Zed assistant, join a class, appear on a leaderboard, or buy anything. The guardian's link also lets them refuse and have the account removed.

We collect only what the service needs, and we hold learner data to a stricter standard than the rest of the platform:

• Learner accounts are excluded from session replay. We never record a learner's screen — not for product analytics, and not as part of an error report.
• Learner accounts are never identified to our analytics provider and their location is not estimated from their IP address. What remains is anonymous usage counts that cannot be traced back to an individual learner.
• We never show advertising to learners, and we never share learner data for marketing.
• The same protections apply to parent and guardian accounts, because the parent portal shows a learner's progress.
• Our AI assistant is restricted to schoolwork for learners: it never asks for personal information, never claims to be a person or to keep secrets, and declines romantic, sexual or self-harm topics. If a learner writes something suggesting they are being hurt or want to hurt themselves, it stops and points them to a trusted adult and to Childline Zambia (116).
• Every AI response carries a Report control, and reports about a child's safety are reviewed the same day. See our child safety standards.

If you are a parent, guardian, or school administrator and you would like to review, correct, or delete a learner's data, contact us using the WhatsApp number above and we will action your request promptly.

5. Service providers we share data with

We use a small set of trusted third-party services to run ZedExams. They process your data on our behalf, under contracts that require them to keep it confidential:

• Google Firebase — Authentication, Firestore database, Cloud Storage, Cloud Functions, and Hosting. Data is stored in Google data centres.
• AI providers — when you use Ask Zed or teacher AI generators, your prompts are sent to the AI model provider (currently Anthropic Claude and/or Google Gemini) so they can generate a response. They process the prompts as a processor only and do not use them to train their models for other customers.
• PostHog, Inc. — optional product analytics, session replay, and error tracking, and only if you opt in. Data is processed on PostHog's servers.
• Sentry — crash and error reporting (technical details of the error, plus device information) so we can diagnose faults. For teacher and admin accounts only, an error report may include a masked replay of the moments before the fault; learner and parent sessions are reported without any recording.
• Payment providers — when you pay for a subscription or top-up we share the details needed to complete the transaction with the provider you choose: MTN MoMo, Airtel Money, Zamtel Money, Lenco (mobile money and cards), or Google Play Billing for purchases made through the Android app. They handle your payment credentials; we never see or store them.

We may also disclose information if required by Zambian law, by a court order, or to protect the safety of our users.

6. How long we keep your data

• Account data is kept while your account is active.
• Quiz/exam attempts and progress are kept while your account is active so you can see your history.
• Ask Zed and AI generation logs are kept for a limited period for debugging and abuse prevention.
• If you opted in to analytics, events are retained by PostHog according to our project settings, and any session replay is automatically deleted after 30 days.
• If you delete your account, we delete or anonymise your personal data within a reasonable period, unless we are required to keep something for legal or accounting reasons.

7. Deleting your account and data

You can permanently delete your ZedExams account and personal data at any time. There are three ways to do this:

• In the app or on the web — sign in, go to Settings → Account → Delete account, type DELETE to confirm, and choose Permanently delete. Your account and data are removed immediately and you are signed out.
• On the web, without signing in — visit zedexams.com/delete-account and submit a deletion request. We verify your identity and action the request within 7 days.
• By message — email us at support@zedexams.com or message us on WhatsApp and we will delete your account for you after verifying your identity.

Deleting your account removes your profile (name, email, phone), quiz and exam results and history, saved and generated content, class memberships, notifications, referral records, and subscription records. If you opted in to analytics, we also delete your PostHog profile and its associated events. We may retain a limited amount of data where the law or our accounting obligations require it (for example, payment/invoice records kept for the statutory period); any such data is no longer linked to your profile. This action cannot be undone.

8. Your rights

You can:

• Access and update most of your information from your profile page.
• Request a copy of your data.
• Ask us to correct information that's wrong.
• Ask us to delete your account and personal data.
• Object to certain uses of your data.

To exercise any of these rights, contact us by email at support@zedexams.com, on WhatsApp at +260 977 740 465, or via the contact form. We may need to verify your identity before we act on a request.

9. Security

We use industry-standard security measures: TLS in transit, Firebase security rules to enforce access controls, hashed passwords (handled by Firebase), and regular reviews of who can access production data. No system is perfectly secure — please choose a strong password and don't share it.

10. Cookies & local storage

We use cookies and your browser's local storage for essentials — keeping you signed in, remembering your theme preference, and storing draft work so you don't lose it on a refresh. We don't use third-party advertising trackers.

Separately, we ask for your consent to use a product-analytics tool (PostHog) that helps us see which lessons and features help most — see section 2 for exactly what it collects. It is off until you opt in, we never use it for advertising, and you can turn it on or off at any time — without signing in — on our privacy preferences page. We use no third-party advertising trackers.

11. Changes to this policy

If we make a meaningful change to this policy, we'll update the "Last updated" date at the top and, where appropriate, notify you in the app or by email.