Privacy notice

Who we are

AFRI-XR is provided by Tricsoft Technologies [legal name, registration number and address]. You can reach us about privacy at [privacy@afri-xr.app].

When a school uses AFRI-XR, the school decides how its students' and staff members' information is used: it is the data controller, and we process the information for it under our agreement. For accounts that are not part of a school, such as content creators, we are the data controller.

What we collect

We collect only what AFRI-XR needs to work:

• Your account: name, email address, and if you choose to give them, phone number and gender. Your password is stored only in a form that cannot be read back.
• Your school, your role in it, and your classes.
• Learning records: assignments, submissions, grades and feedback, progress, and time spent in experiences.
• Devices you use AFRI-XR on without internet: the device name and type, operating system and app version, what you downloaded, and the progress the device sends back.
• Sign-in and activity records: when you signed in, from which network address and browser, and important actions such as changes to classes or accounts.
• Usage counts, such as how often an experience is opened, used for school and platform reports.

What we do not collect

We do not collect your location, contacts, camera or microphone recordings, or biometric data. We do not show advertising, we do not sell information, and we do not build profiles for marketing.

Why we use it

We use your information:

• To provide AFRI-XR to your school and to you: classes, assignments, experiences, offline use and reports.
• To keep accounts and the platform safe, and to investigate misuse.
• To meet our legal obligations.
• For children, with the consent of a parent or guardian, which the school collects and confirms to us.

Children

Most students are under 18. Students can only join through their school, by invitation or with their teacher's class code. Before a student can use AFRI-XR, the school confirms that a parent or guardian has consented; until then the student can only sign in and read this notice.

A student's name and work are visible only to their teachers and school administrators. There are no public profiles, no messaging between students, and no advertising. A parent or guardian can ask the school to see, correct or delete a student's information, or to withdraw consent.

Who sees it

Your school sees the information about its members. Service providers who host AFRI-XR, store files, send email or report errors process it for us under contracts that require them to protect it [list of providers]. We share information with authorities only when the law requires it.

If you choose to sign in with Google, Google confirms who you are and gives us your name, email address and picture; Google's own privacy policy applies to your Google account.

Where it is kept

Information is stored in [country and hosting provider]. If it is ever processed or stored outside Uganda, we do so only where the Data Protection and Privacy Act 2019 allows it, with adequate safeguards.

How long we keep it

We keep information only as long as it is needed:

• Your account and learning records: while your account exists. When you ask to delete your account, it is erased after 14 days, a period in which you can change your mind.
• Sign-in attempts: 30 days. Ended sign-in sessions: 90 days.
• Notifications: 180 days. Closed invitations: 90 days.
• Activity records: the network address and browser are removed after one year, and the records are deleted after three years.
• Usage counts stop naming you or your device after about 13 months.
• Encrypted backups: erased information can remain in backups until they expire, at most 12 months, and is never restored except to recover from a disaster.

How we protect it

Connections are encrypted, passwords are stored in a form that cannot be read back, staff and teachers see only what their role allows, important actions are recorded, two-step sign-in is available, and backups are encrypted and kept at a separate site.

Your rights

Under the Data Protection and Privacy Act 2019 you have the right:

• To know how your information is used (this notice).
• To get a copy of it: download your data from your settings, or ask your school.
• To have it corrected: edit your profile, or ask your school.
• To have it deleted: delete your account from your settings. Students ask their school.
• To object to or restrict some uses, and to take your information elsewhere (the download is a standard JSON file).
• To complain to the Personal Data Protection Office (www.pdpo.go.ug).

Changes to this notice

When this notice changes, we show you the new version and ask you to accept it before you continue. The version date is at the top.