Privacy Policy

1 Introduction

Amenity Technologies and General Dealers ("we", "us", "our") operates the ZSchool Data platform at https://zschooldata.com ("the Service"). We are based in the Republic of Zambia (TPIN 1011635479), with offices at 120001, Kasempa Boma, Kasempa District, Northwestern Province.

We respect your privacy. This Privacy Policy explains what personal information we collect, why we collect it, how we use it, who we share it with, and what choices you have. By using the Service, you agree to this Policy.

2 Information we collect

2.1 Information you provide

When you create an account or use the Service, you may give us:

• Identity details: surname, other names, gender (where required), position/role.
• Contact details: email address, mobile phone number.
• Account credentials: username (or employee number for school teachers) and password (stored only as a secure hash — we never see your actual password).
• School details: for school-based teachers, your school name, center code, and class assignments. For individual teachers, your province and district.
• Payment details: for subscription purchases, the email and phone number you submit at checkout. Card and mobile money details are entered directly with our payment provider (DPO Pay) and are never stored on our servers.
• Generated content: the lesson plans, schemes of work, and lesson notes you create, including the subject, topic, grade, and other inputs you provide.

2.2 Information collected automatically

• Usage data: dates and counts of generations, services used, subscription status, last login time.
• Technical data: IP address, browser type and version, device type, operating system, time-zone setting (for security and abuse detection).
• Session cookies: a single secure cookie that keeps you logged in. We do not use third-party advertising cookies.

2.3 We do NOT collect

3 How we use your information

We use your information for the following purposes:

• Account management: creating, securing, and maintaining your account.
• Service delivery: generating lesson plans, schemes, and notes; storing your generated content for later retrieval; applying free-trial and subscription quotas.
• Billing: processing subscription payments through our payment provider, issuing receipts, and recording transactions for tax purposes.
• Communication: sending account-related emails (password resets, payment confirmations, subscription expiry reminders, security notices). We will not send marketing emails without your prior consent.
• Service improvement: analysing aggregated, anonymous usage trends to improve features, fix bugs, and plan capacity.
• Security & fraud prevention: detecting unauthorised access, abuse, and fraudulent payments.
• Legal compliance: responding to lawful requests by public authorities, including to meet national security or law enforcement requirements.

4 Who we share information with

We do not sell, rent, or trade your personal information. We share information only with the following categories of recipients, and only to the extent necessary:

4.1 Payment provider

When you pay for a subscription, your email, phone number, transaction amount, and reference are shared with our payment processor DPO Pay to facilitate the transaction. Card and mobile money details are entered directly with the provider and never touch our servers. DPO Pay is subject to its own privacy policy.

4.2 AI service providers

To generate your lesson plans, schemes, and notes, the inputs you supply (subject, topic, grade, sub-topic, duration, etc.) are sent to our third-party AI providers, currently Anthropic (Claude) and OpenAI. These providers process your inputs solely to return the requested output. We do not transmit your name, email, or payment information to these providers along with generation requests.

4.3 Hosting provider

The Service is hosted on a third-party hosting platform. Your data is stored on servers managed by this provider, who has access only as required for technical operation and is bound by confidentiality terms.

4.4 Legal & regulatory bodies

We may disclose your information when required by Zambian law, court order, regulator request, or where necessary to protect our rights, your safety, or the safety of others.

4.5 School administrators

If you signed up as a school-based teacher, your school's administrator (with admin access on the platform) can see your account details and generation activity. They cannot read the plain text of your password.

5 How we protect your information

We take reasonable technical and organisational measures to protect your data, including:

• Encryption in transit: all traffic between your browser and the Service uses HTTPS (TLS) encryption.
• Password hashing: passwords are stored using strong one-way hashing (we never store or transmit your password in plain text).
• CSRF protection: every form is protected against cross-site request forgery.
• Access controls: only authorised personnel can access servers and databases, and access is logged.
• Session security: session cookies are HTTP-only and use secure flags where the connection supports it.

No method of internet transmission or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security. If we become aware of a security incident affecting your data, we will notify you promptly in accordance with applicable law.

6 How long we keep your data

• Account data: kept for as long as your account is active, plus three (3) years for our legal and tax records after the account is closed.
• Generated content: kept indefinitely while your account is active, so you can re-download and re-use your past lesson plans, schemes, and notes. You may request deletion at any time.
• Payment records: kept for seven (7) years as required by Zambian tax law.
• Usage logs: kept for up to twelve (12) months for security and analytics.

7 Your rights

You have the following rights with respect to your personal data:

• Access: request a copy of the personal data we hold about you.
• Correction: ask us to correct inaccurate or incomplete information. You can also update most details yourself through your profile page.
• Deletion: request the deletion of your account and associated data, subject to our legal obligation to retain payment records.
• Export: request a download of your generated content in a portable format.
• Withdraw consent: where we rely on your consent, withdraw it at any time (this will not affect processing done before withdrawal).
• Complain: raise concerns with us, or with the relevant Zambian data protection authority.

To exercise any of these rights, contact us at the address below. We will respond within thirty (30) days.

8 Children's privacy

The Service is not directed at, and not intended for use by, persons under the age of 18. We do not knowingly collect personal data from children. If you believe a minor has provided us with personal information, please contact us and we will delete it promptly.

9 International transfers

The third-party AI providers we use (Anthropic, OpenAI) and our hosting provider may store or process data on servers located outside Zambia. By using the Service, you understand and consent to your information being transferred outside Zambia for these processing purposes. We take reasonable steps to ensure such transfers are made to providers with appropriate data protection standards.

10 Cookies

We use only essential cookies:

• Session cookie — a single, secure cookie that keeps you logged in during a visit. It is destroyed when you log out or close the browser after a period of inactivity.
• CSRF token — a security token stored in your session to prevent cross-site request forgery attacks.

We do not use third-party advertising cookies, social media tracking pixels, or behavioural analytics tools.

11 Changes to this Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify active users by email or via a notice on the platform. Continued use of the Service after changes take effect constitutes acceptance of the revised Policy.

12 Contact us

For any questions, complaints, or requests related to this Privacy Policy or how we handle your personal data, please contact us using the details below.