LarnnitAll policies

Privacy Policy

Last updated: 2026-06-05

Larnnit (“we”, “us”) operates the Larnnit platform — a web and mobile all-in-one social learning and community platform for connecting, learning, building communities, discovering opportunities and housing, buying and selling, and events. This policy explains what information we collect, how we use it, who we share it with, and the rights you have over your data. By using Larnnit you agree to the practices described below.

1. Information we collect

  • Account information. Email, name, password (hashed with bcrypt), profile photo, university affiliation, and role (user, tutor, moderator, admin).
  • Content you create. Posts, reels, comments, messages, community contributions, marketplace listings, tutor profiles, and any media (images, video, audio, documents) you upload.
  • Payment information. Processed by our payment partners (Paystack, M-Pesa). We store transaction IDs, amounts, and status — never your full card number or banking credentials.
  • Verification documents. Tutors and verified users may upload IDs or credentials. These are stored encrypted and accessible only to our moderation team.
  • Device & usage data. IP address, device type, OS version, app version, push notification token, crash reports, and aggregated interaction logs (which screens you visit, what features you use). Used for security, debugging, and product improvement.
  • Communications data. Direct messages, group chat, audio/video call metadata (start time, duration, participants — not the call audio itself).

2. How we use your information

  • To provide and operate the Larnnit service (authentication, content delivery, chat, payments).
  • To moderate content and enforce our Community Guidelines, Acceptable Use Policy, and Terms of Service.
  • To send transactional notifications (login alerts, payment receipts, chat messages, course reminders) by email and push.
  • To improve the product (debugging, analytics, A/B testing of new features).
  • To prevent fraud, abuse, and unauthorised access.
  • To comply with applicable law and respond to lawful requests from authorities.

2a. Legal bases (EEA, UK, Switzerland)

If you are in the EEA, the UK, or Switzerland, we rely on the following Article 6 GDPR legal bases:

  • Contract (Art. 6(1)(b)) — to create your account, deliver the service you signed up for, complete purchases and tutor sessions, and provide support.
  • Legitimate interests (Art. 6(1)(f)) — to keep the platform secure, prevent fraud, debug issues, improve features, and run necessary first-party analytics. We balance our interests against your rights; you can object at any time via privacy@larnnit.com.
  • Consent (Art. 6(1)(a)) — for optional analytics/marketing cookies, push notifications, recording of tutor sessions, and any processing where we ask first. You can withdraw consent at any time without affecting the lawfulness of prior processing.
  • Legal obligation (Art. 6(1)(c)) — to retain transaction records for tax, to respond to lawful authority requests, and to report content where required by law.

For special-category data we collect (e.g. government-ID images uploaded for tutor or seller verification), we rely on your explicit consent (Art. 9(2)(a)). Where we use such data for fraud or AML compliance, we additionally rely on substantial public interest under Art. 9(2)(g) and applicable national law.

2b. Automated decision-making

Larnnit uses automated systems for spam detection, content moderation, fraud screening, and recommendation. These systems may flag or remove content, restrict an account, or decline a transaction. Decisions with significant effect (account termination, payout denial) are reviewed by a human moderator before they become final. You can ask for human review of any automated decision and contest it by emailing appeals@larnnit.com.

3. Who we share with

We do not sell your personal data. We share it only with:

  • Service providers who run infrastructure on our behalf. The current list is at /subprocessors.
  • Payment processors (Paystack, Safaricom M-Pesa, and Stripe where enabled) to complete transactions you initiate.
  • Other users, to the extent your profile, posts, comments, and listings are public or shared with chosen audiences.
  • Authorities, when required by valid legal process.
  • A successor entity, in the event of a merger, acquisition, or sale of assets — with notice to you.

4. Data retention

We keep your account data while your account is active. When you delete your account (see Delete account), we erase or de-identify your personal data within 30 days, except where retention is required for legal, accounting, or fraud-prevention purposes (typically up to 7 years for transaction records). Backups containing your data are purged on our normal backup-rotation schedule (90 days).

5. Your rights

Depending on your jurisdiction (GDPR, CCPA, Kenya DPA 2019, and similar laws), you may have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate data.
  • Delete your account and associated data.
  • Export your data in a portable format.
  • Object to or restrict certain processing.
  • Withdraw consent where processing is based on consent.

Email privacy@larnnit.com to exercise any of these rights. We respond within 30 days.

6. Children

Larnnit is intended for users aged 13 and older. We do not knowingly collect information from children under 13. Where the digital-consent age is higher than 13 (16 in many EEA member states), we require verifiable parental consent. See our Children's Privacy Notice for the full policy and the parental-consent flow.

7. Security

We use industry-standard safeguards: TLS for data in transit, encryption at rest for storage and backups, bcrypt-hashed passwords, JWT-based authentication with refresh token rotation, rate limiting, and audit logging of administrative actions. No system is perfectly secure; we will notify affected users without undue delay if we discover a breach affecting their data.

8. International transfers

Your data may be processed in countries other than where you live (currently the United States and the European Union, depending on the service — see /subprocessors for locations). For transfers out of the EEA, UK, or Switzerland to a country without an adequacy decision, we rely on the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and, where the UK is involved, the UK International Data Transfer Addendum, together with any supplementary measures required by a transfer impact assessment.

9. Region-specific notices

  • EEA / UK / Switzerland.You have the right to lodge a complaint with your national data-protection supervisory authority. In Ireland, that's the Data Protection Commission (dataprotection.ie); in the UK, the Information Commissioner's Office (ico.org.uk); in Switzerland, the Federal Data Protection and Information Commissioner.
  • California. See our California Privacy Noticefor CCPA/CPRA-specific disclosures and rights.
  • Brazil. Under the LGPD, you have rights of access, correction, anonymisation, portability, deletion, information about sharing, and revocation of consent. Contact privacy@larnnit.com. Brazilian users may also lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD).
  • Kenya. Under the Data Protection Act 2019, you have rights of access, correction, deletion, objection, and to be informed about the use of your data. The supervisory authority is the Office of the Data Protection Commissioner (odpc.go.ke).
  • South Africa. Under POPIA, similar rights apply. The Information Regulator is the supervisory authority.
  • Nigeria. Under the Nigeria Data Protection Act 2023, similar rights apply. The Nigeria Data Protection Commission is the supervisory authority.

10. Data Protection Officer & representatives

  • DPO: dpo@larnnit.com [TBD: appointed individual, if required by Art. 37 GDPR].
  • EU representative (Art. 27 GDPR, if we offer the service to EEA data subjects without an EU establishment): [TBD].
  • UK representative (Art. 27 UK GDPR): [TBD].

11. Changes

We may update this policy. Material changes will be announced in-app and by email at least 14 days before they take effect. Continued use after the effective date constitutes acceptance.

12. Contact

Privacy questions: privacy@larnnit.com
Data Protection Officer: dpo@larnnit.com
General support: support@larnnit.com