Privacy Policy

This Privacy Policy explains how Zikaya Ltd (Zikaya, we, us) processes personal information when people visit zikaya.com, open accounts, use educational documents and study features, upload content or buy and sell on the marketplace (together, the Services). Zikaya Ltd decides the purposes and means of processing for the Services and is the data controller where that term applies, including under Kenya's Data Protection Act, 2019. Zikaya Ltd is based in Kenya and the Services are available internationally; where the law of the place you live gives you additional mandatory rights, those rights also apply. Words defined in the Terms of Service, such as Content and Derived Materials, have the same meaning here. This policy does not cover third-party websites or services, including payment and payout providers, which have their own privacy notices.

1. Contact and scope

For privacy inquiries, access, correction, deletion and other rights requests, email [email protected]. Copyright reports and requests to review a removal use the guided procedure on our Copyright Policy page.

2. Information collected

Depending on how you use Zikaya, we may collect categories of information such as:

Accounts: email, username/display name, password hashes and login/security records, account preferences, verification and policy acceptances.
Creator profiles and documents: public profile fields you submit, uploaded PDF files and everything in them, document titles, descriptions, academic subject metadata, previews, version history, rights declarations, reports and publication decisions.
Purchases and access: orders, prices, receipts, payment-provider references, refunds, chargebacks, CC and PC balances and transaction histories, subscriptions, document-version entitlements and access logs.
Creator financial records: earning balances and status, payout-provider references, country and payment verification status, and identity/tax information needed for a particular lawful purpose. Where feasible, providers collect sensitive identity and payment credentials directly.
Support and legal claims: email correspondence, support tickets, fraud investigations, copyright reports and removal reviews, information submitted by reporters and necessary audit records.
Technical information: IP address, device/browser type, approximate network location, request and access timestamps, essential cookies/session identifiers, error and security logs.
Information from others: transaction and payout status from payment and payout providers, and information about you that other users, rights holders or authorities give us, for example in a report or a rights notice.

Uploaded documents can contain personal information, such as an author's name or details about other people. We collect whatever an uploader chooses to include, and we use and share uploaded Content as described in sections 3 to 5.

Zikaya does not currently use analytics tools. If we introduce measurement, marketing pixels or tracking products, we will update this policy and give any notice or choice the law requires. We do not intentionally collect patient medical records for marketplace purposes, and our content rules prohibit identifiable patient information in uploaded materials.

3. Reasons and legal grounds for processing

We use information to provide, operate, secure, maintain, develop and improve the Services and our business. Depending on the applicable law and purpose, we rely on the following legal grounds:

Performance of a contract: to create and run your account; provide searches, previews and document access; process purchases, renewals and credit ledgers; manage creator publication, earnings and payouts; and support you.
Legitimate interests: to verify accounts; prevent, detect and investigate fraud, abuse, security incidents and prohibited or infringing material; enforce our terms and policies; promote listings and the Services; create Derived Materials; develop and train artificial-intelligence models and license datasets as described below; create aggregated or de-identified data; maintain records; and establish, exercise or defend legal claims. We rely on these interests only where they are not overridden by your rights and interests.
Legal obligation: to keep accounting and tax records, respond to lawful requests from authorities, handle copyright reports and removal reviews where the law requires, and meet our other legal duties.
Consent: where the law requires consent, for example for some optional cookies or for certain commercial uses of personal information. You may withdraw consent by the means we provide or by contacting us, without affecting processing that took place before you withdrew it.

Derived Materials, artificial intelligence and datasets

Under the Terms of Service, Content that users upload, including uploaded documents, may be used, alone or combined with other material, to:

create Derived Materials, such as quizzes, practice questions, flashcards, summaries, explanations and study plans, by artificial intelligence or other means, which Zikaya may offer and sell to any user, on or off Zikaya;
develop, train, fine-tune, test, evaluate and improve artificial-intelligence and machine-learning models, systems and services, whether operated by Zikaya or by others; and
be licensed or sold to third parties as AI-training datasets, including datasets that include or are derived from uploaded Content.

Before Content is made available to third parties for AI training, Zikaya takes reasonable steps to remove or de-identify personal information it identifies in it. These steps reduce, but cannot eliminate, the chance that personal information remains, so please do not include personal information about yourself or others in uploads unless it is necessary. Derived Materials do not need to identify the creator of the Content they draw on.

Aggregated and de-identified data

We may create aggregated or de-identified data from the information we hold. Data that no longer identifies anyone is not personal information, and we may use, share, license and sell it for any purpose, including developing artificial intelligence. We do not attempt to re-identify de-identified data, except to test our de-identification methods or as the law permits.

4. Public profile information and uploaded content

Your selected creator name, biography, avatar and published listing information may be visible publicly and indexed by search engines. Private account email, legal name supplied for verification, home address, identity documents, tax identifiers and payout details are not made public merely because you list content. A creator may nevertheless reveal personal information in material they choose to upload; users should not place private or patient-related information into uploads. If you include another person's personal information in an upload, you are responsible for having a lawful basis to share it.

Listing information, previews and the creator name may also appear in Zikaya's promotion on other websites, social media and search engines, as described in the Terms of Service. Copies of documents that we deliver may carry a watermark showing Zikaya's branding, the creator name and an order or download reference, which helps us trace unauthorized redistribution. The watermark does not currently include an email address or other contact details.

Uploaded Content may also be used to create Derived Materials, to develop and train artificial-intelligence models and to build datasets licensed or sold to third parties, as described in section 3.

We share personal information as reasonably needed to operate, secure and develop the Services, with recipients such as:

Service providers that process information for us, such as third-party hosting/infrastructure providers (currently Hostinger, with hosting presently in the United States), file storage, content delivery and network security (currently Cloudflare), transactional email delivery (currently Brevo), payment collection, subscription billing, creator payouts, customer support, fraud-prevention, and artificial-intelligence and data-processing services;
other users and the public, such as the public profile and listing information in section 4, and the creator name and order reference on delivered copies;
counterparties to a transaction, such as the payment or payout provider handling it;
dataset licensees, who receive uploaded Content and datasets made from it for AI development, after the de-identification steps in section 3;
rights complainants in copyright report and removal review processes, to the extent the law permits or requires;
professional advisers, such as lawyers, accountants and auditors;
regulators, courts, law enforcement and other public authorities, where we reasonably believe the law requires or permits it, or it is necessary to protect the rights, property or safety of Zikaya, our users or others; and
a buyer, successor or investor, in connection with a proposed or actual merger, financing, acquisition, reorganization or sale of all or part of our business, subject to appropriate confidentiality.

Payment providers may include Stripe, PayPal or M-Pesa, to the extent each is enabled for a transaction, under their own terms and privacy notices.

What we sell and what we do not sell

We may license or sell uploaded Content, and datasets that include or are derived from it, to third parties for AI development, after the de-identification steps in section 3.
We may sell Derived Materials, and we may use, share, license and sell aggregated or de-identified data that no longer identifies anyone.
We do not sell account, contact, payment or other personal information that identifies you to third parties for AI training, and we do not sell it to third parties for any other purpose without your express consent.

Sharing information with service providers that process it on our behalf, or with the recipients above for the purposes in this policy, is not a sale of personal information.

6. Billing and payout information

Payment and payout services may independently collect payment-card, bank, identity or tax data under their own policies. Zikaya receives necessary transaction states, provider references, amounts, masked payment identifiers, invoice information and earnings/entitlement records. Please do not email us complete card numbers, passwords or identity documents unless we expressly ask you to through a secure verified process.

7. Cookies and similar technologies

We use strictly necessary session, authentication and security technologies to keep accounts accessible and protect transactions. We do not currently use analytics cookies. If we add optional cookies or similar tools, we will give any notice and choice the law requires. Browser preferences can affect some cookies; disabling essential cookies can prevent sign-in or checkout.

8. International hosting and transfers

Zikaya currently uses Hostinger for hosting, with infrastructure presently in the United States, and Brevo for email delivery, and Cloudflare for file storage, content delivery and network security, which may process data in many countries. Hosting provider or location may change. Data may also be processed wherever our email, payment, payout, support, security, artificial-intelligence or other providers, and our dataset licensees, operate. Hosting and processing arrangements may change for legitimate business reasons. Where the law requires, we make cross-border transfers with appropriate safeguards, such as contractual protections, or on another ground the law allows, such as where the transfer is necessary to perform a contract with you. We do not promise that information is stored exclusively in a single country.

9. Retention

We retain information only as long as reasonably necessary for the purposes above, including active account service, acquired-document access, accounting and tax duties, payment disputes, fraud prevention, safety investigations, copyright notices and legal claims. Account closure does not necessarily delete financial, rights or audit records immediately. Backups may persist for limited controlled cycles. Data is deleted or de-identified when no longer needed, subject to legal obligations and defensible retention criteria.

Aggregated or de-identified data may be kept without time limit. Content that has already been used to train or improve a model, or included in a dataset delivered to a third party, cannot practically be withdrawn from it, so removing the Content or closing your account stops future use under the Terms of Service but does not change models or datasets that already exist.

10. Security

We use reasonable technical and organizational measures designed to protect personal information, such as access controls, authentication and role restrictions, secured delivery of purchased files and audit records of sensitive administrative actions. No online service, transmission or storage system is completely secure, and we cannot guarantee the security of information. You are responsible for keeping your sign-in details confidential. Please report suspected account or data incidents to [email protected] promptly. Where the law requires, we will notify the relevant regulator and affected users of a personal data breach.

11. Your rights and choices

Depending on where you live, and subject to the conditions and exceptions in the law, you may have rights to:

be informed about how your personal information is used;
access your personal information and receive a copy, including in a portable format;
correct inaccurate or misleading information, and request deletion;
object to processing, including processing based on our legitimate interests, such as our use of your personal information for AI development, and request that processing be restricted;
withdraw consent where we rely on it;
not be subject to a decision based solely on automated processing that significantly affects you, where the law gives that right;
where a US state privacy law applies to you, know, delete and correct personal information, opt out of the sale or sharing of personal information, appeal our decision on your request, and not be discriminated against for exercising these rights; and
complain to a data protection regulator, including the Office of the Data Protection Commissioner in Kenya or, if you are in the European Economic Area or the United Kingdom, your local supervisory authority.

Send requests to [email protected]. You can also download a copy of the personal data held about your account from your account settings. We may reasonably verify your identity, or the authority of anyone acting for you, before sharing or changing records. Some requests may be limited where retention is required for an active transaction, tax, fraud prevention, copyright or other legitimate legal purpose. Where you object to processing based on legitimate interests and the law gives you that right, we will stop unless we have compelling legitimate grounds or need the information for legal claims. An objection or deletion request does not affect Content already used or datasets already delivered as described in section 9, and your privacy rights in your personal information do not by themselves end the content licenses you grant under the Terms of Service. We will comply with applicable timelines and appeal or complaint processes. For residents covered by additional local privacy notices, those mandatory rights prevail.

12. Children's information

Accounts and the purchasing, contribution and selling functions are intended only for adults age 18 or older. We do not knowingly permit minors to register or upload. If we learn that an ineligible minor has created an account, we may restrict or close the account and will delete or retain the information as the law requires. Report concerns through [email protected].

13. Changes

We may update this policy from time to time, for example when our Services, providers, practices or legal requirements change. We will publish the updated version with its date. Where a change is material, we will also notify you by email or in your account before it takes effect, and we will ask for your consent where the law requires it. Changes apply from the date they take effect.

14. Contact

Zikaya Ltd, privacy and general inquiries: [email protected]. Copyright notices: Copyright Policy reporting procedure.