Legal policies

Introduction

These Terms of Service govern your use of the Rukia Labs website and the Rukia Labs platform. They are an agreement between Rukia Labs LTD, a company registered in Kenya ("Rukia Labs", "we", "us", or "Provider"), and you.

These terms have two parts:

• Part A: Website Terms apply to everyone who visits rukialabs.com, including people who only browse our pages or use our pricing estimator.
• Part B: Cloud Service Agreement applies to organizations and individuals who sign up for, access, or use the Rukia Labs platform, including the Learning Portals, Rukia AI Agents, and Rukia Billing (together, the "Product").

If you signed a separate Cover Page with us to access the Product with the same account, and that agreement has not ended, Part B does not apply to you. Your separate Cover Page applies instead. Part A still applies to your use of the website.

If you are accessing or using the Product on behalf of an organization, you confirm that you are authorized to accept these terms on its behalf. By signing up for, accessing, or using the Product, you accept these terms and agree to be bound by them.

Part A: Website Terms

A1. Using the website. You may browse rukialabs.com and use its content for your own information and to evaluate our Product. You may not copy, scrape, or republish substantial parts of the website without our written permission.

A2. Our content. The website, including its text, design, graphics, logos, and the Rukia Labs name, belongs to Rukia Labs or its licensors. Nothing in these terms gives you ownership of or a license to use our trademarks.

A3. Acceptable use. When using the website, you will not: attempt to gain unauthorized access to our systems; interfere with or disrupt the website; introduce malware or harmful code; or use the website for any unlawful purpose.

A4. Pricing estimates. Our pricing page and pricing estimator give an estimate based on the numbers you enter. An estimate is not a quote or an offer. Your actual fees are set by Part B or by a Cover Page you sign with us.

A5. Third-party links. The website may link to sites and services we do not control. We are not responsible for their content or practices.

A6. No warranty. We provide the website as is. We work to keep it accurate and available, but we do not guarantee that it will be error-free or uninterrupted.

A7. Limitation of liability. To the fullest extent allowed by law, Rukia Labs is not liable for any indirect, incidental, or consequential loss arising from your use of the website. This section does not limit liability that cannot be limited under the laws of Kenya.

A8. Privacy and cookies. Our Privacy Policy and Cookie Policy explain how we collect and use information when you visit the website.

A9. Governing law. Part A is governed by the laws of the Republic of Kenya, and the courts of competent jurisdiction in Nairobi, Kenya, have jurisdiction over any dispute about it.

Part B: Cloud Service Agreement

Order Form

Framework Terms. This Order Form incorporates and is governed by the Framework Terms, made up of the Key Terms below and the Common Paper Cloud Service Agreement Standard Terms Version 2.1, which are incorporated by reference. Any modifications to the Standard Terms made in this Cover Page, including its Attachments and Supplements, control over conflicts with the Standard Terms. Capitalized words have the meanings given in this Cover Page or the Standard Terms.

Cloud Service. A cloud-based learning platform that runs courses, instruction, and administration for schools and organizations, with built-in AI agents and payment reconciliation. This agreement includes the Learning Portals (Student, Instructor, and Admin), Rukia AI Agents, and Rukia Billing for M-PESA collections and eTIMS-compliant invoicing, as described in the Service-Specific Terms below.

Order Date. The Effective Date.

Subscription Period. 1 month, renewing automatically for successive 1-month periods.

Cloud Service Fees.

• Learner fees. Fees for the Learning Portals and Rukia AI Agents are based on Monthly Active Learners at the rates on Provider's pricing page (rukialabs.com/pricing). A Monthly Active Learner is any unique learner account that logs in to or uses the Cloud Service at least once during a calendar month. Instructor and administrator accounts are not Monthly Active Learners.
• Transaction fees. Fees for Rukia Billing are a percentage of the value of each payment the Cloud Service reconciles, at the rate on Provider's pricing page.
• Fair usage quotas. Each pricing tier includes usage quotas, such as storage and AI usage for instructors and administrators, as set out on Provider's pricing page. Quotas scale with Customer's subscription. If Customer exceeds a quota, Provider may notify Customer and either limit the affected feature until the next Subscription Period or offer additional capacity at the rates on Provider's pricing page.
• Contracted plans. Annual commitments, committed Monthly Active Learner volumes, fixed monthly fees, and discounts, including discounts for annual upfront payment, apply only under a separate Cover Page signed by both parties.
• Price changes. Provider may update pricing by giving at least 60 days notice to Customer, including by email or notification within the Product. The change will apply from the next Subscription Period after the notice period ends.

Payment Process. Bill by invoice. Provider will invoice Customer monthly in arrears for the prior month's learner fees and transaction fees. Customer will pay each invoice within 14 days from the date of invoice. If an invoice remains unpaid 14 days after its due date, Provider may, after giving Customer at least 7 days written notice (including by email), suspend access to the Cloud Service for Customer and its users until the overdue amount is paid, unless the parties agree otherwise in writing. Suspension does not delete Customer Content.

Non-Renewal Notice Period. Any time before the end of the current Subscription Period.

Technical Support. [email protected]

SLA. Provider will use commercially reasonable efforts to make the Cloud Service available at least 99.5% of the time in each calendar month. This excludes scheduled maintenance notified at least 48 hours in advance, emergency maintenance, and outages caused by Customer or by third-party services outside Provider's reasonable control, including payment networks, tax authority systems, AI model providers, and internet service providers. If Provider does not meet the SLA in two consecutive months, or in any three months in a 12-month period, Customer may, as its only remedy, terminate this Order Form upon notice and receive a prorated refund of any prepaid fees for the remainder of the Subscription Period.

Key Terms

Customer. The organization or person who accesses or uses the Product. If the person accepting this Agreement does so on behalf of an organization, "Customer" means that organization. Customer must be an organization, or an individual aged 18 or older. Learners, instructors, and other individuals who access the Product through a Customer's tenant are users under that Customer's account, not separate Customers.

Provider. Rukia Labs LTD

Effective Date. The date Customer first accepts this Agreement.

Governing Law. The laws of the Republic of Kenya.

Chosen Courts. The courts of competent jurisdiction in Nairobi, Kenya.

Covered Claims.

• Provider Covered Claims: Any action, proceeding, or claim that the Cloud Service, when used by Customer according to the terms of the Agreement, violates, misappropriates, or otherwise infringes upon anyone else's intellectual property or other proprietary rights. Provider Covered Claims exclude claims arising from AI outputs generated from Customer Content or from prompts submitted by Customer or its users.
• Customer Covered Claims: Any action, proceeding, or claim that (1) the Customer Content, when used according to the terms of the Agreement, violates, misappropriates, or otherwise infringes upon anyone else's intellectual property or other proprietary rights; (2) results from Customer's breach or alleged breach of Section 2.1 (Restrictions on Customer); or (3) results from Customer's failure to obtain any consent or notice required under applicable law, including consent from a parent or guardian before any user under 18 years of age uses the Cloud Service.

General Cap Amount. The fees paid or payable by Customer to Provider in the 12-month period immediately before the claim.

Increased Claims. Breach of confidentiality or data protection obligations.

Increased Cap Amount. 2 times the General Cap Amount.

Notice Address.

• For Provider: [email protected]
• For Customer: The main email address on Customer's account

Attachments and Supplements

Security Policy. Provider will use commercially reasonable efforts to secure the Cloud Service from unauthorized access, alteration, or use and other unlawful tampering. Each Customer's data is logically separated from other Customers' data, and one Customer's data is used only to provide the Cloud Service to that Customer.

Data Protection. Each party will comply with the Data Protection Act, 2019 of Kenya and its regulations. For personal data that Customer and its users submit to the Cloud Service, Customer is the data controller and Provider is the data processor. Provider will process that personal data only to provide the Cloud Service and according to Customer's documented instructions. Provider is the data controller only for personal data it collects for its own purposes, such as Customer account administration, billing, and communications with Customer. Provider will apply data protection safeguards consistent with the standards of the EU General Data Protection Regulation. The Data Processing Agreement at [link] forms part of this Agreement.

AI and Customer Content. Provider will not use Customer Content, including course materials and other content uploaded to the Cloud Service, to train or fine-tune AI models. Provider processes Customer Content, including by creating vector embeddings, solely to provide the Cloud Service to Customer. Provider may collect prompts submitted to AI features and the resulting outputs ("AI Interaction Data") to operate, monitor, and improve the Cloud Service. Before using any AI Interaction Data to train or fine-tune models, Provider will de-identify it so that it no longer identifies any individual or Customer, and will take reasonable steps to remove Customer Content from it. Customer may opt out of the use of its AI Interaction Data for model training at any time by notice to Provider.

Users Under 18. Customer will not permit any user under 18 years of age to use the Cloud Service unless Customer has obtained consent from that user's parent or guardian as required by applicable law. Customer will tell Provider in writing before it enrolls users under 18, so that Provider can apply any additional safeguards the law requires.

Customer Content on Termination. For 30 days after this Agreement ends, Customer may request an export of its Customer Content. After that period, Provider will delete Customer Content within 90 days, except where the law requires Provider to keep it or where copies remain in backups that are deleted on their regular schedule.

Service-Specific Terms

These terms apply in addition to the rest of Part B when Customer uses the relevant part of the Cloud Service.

Learning Portals.

• Customer sets up and manages its own tenant, including which users may sign up, their roles (Student, Instructor, or Admin), and what content they can access.
• Customer is responsible for the content it and its users upload, for the accuracy of its course and assessment records, and for the conduct of its users within its tenant.
• Customer will keep account credentials secure and tell Provider promptly at [email protected] if it believes an account has been compromised.

Offline Access. Some features let users download content to their devices for offline use. Content on a user's device is outside Provider's control. Customer is responsible for securing devices used to access the Cloud Service offline and for requiring its users to do the same.

Rukia AI Agents.

• AI outputs are generated automatically and may be inaccurate, incomplete, or inappropriate. Customer and its users are responsible for reviewing AI outputs before relying on them, especially for grading, assessment, or any decision that affects a learner.
• As between the parties, Customer owns the AI outputs generated for Customer and its users, subject to Provider's rights in the Cloud Service.
• Provider may use third-party AI model providers to deliver Rukia AI Agents. Provider lists them on its subprocessor list.
• Customer and its users will not use Rukia AI Agents to: attempt to access another Customer's data; extract or reverse engineer the underlying models or prompts; bypass safety controls; or generate unlawful, harmful, or infringing content.

Rukia Billing.

• Rukia Billing connects to Customer's own M-PESA account and reconciles payments made to it. Payments settle directly into Customer's account. Provider does not receive, hold, or transfer Customer's funds.
• Rukia Billing generates and submits invoices to the Kenya Revenue Authority's eTIMS system using the information Customer provides. Customer remains responsible for its tax obligations, including the accuracy of the information it provides and reviewing invoices issued in its name.
• Reconciliation depends on data from Safaricom, the Kenya Revenue Authority, and other third parties. Provider is not responsible for errors, delays, or outages in those third-party systems, but will work with Customer in good faith to correct reconciliation errors caused by the Cloud Service.
• Customer will keep its M-PESA and eTIMS credentials secure and will tell Provider promptly if they change or are compromised.

Changes to These Terms

We may update Part A at any time by posting the new version on this page. We will give Customers at least 30 days notice of material changes to Part B by email or notification within the Product. Changes to Part B apply from the next Subscription Period after the notice period ends. If you do not agree with a change, you may stop using the Product before it takes effect.

Contact Us

• Support: [email protected]
• Legal notices: [email protected]

Who We Are and When This Policy Applies

This policy explains how Rukia Labs LTD ("Rukia Labs", "we", or "us"), a company registered in Kenya, collects, uses, and protects personal data. We are registered with the Office of the Data Protection Commissioner (ODPC) under registration number [ODPC registration number].

We handle personal data in two different roles, and this policy covers only one of them:

• Where we decide how data is used (data controller). This includes data from people who visit rukialabs.com, request a demo or contact us, manage a customer account, or handle billing with us. It also includes AI Interaction Data we use to improve our platform. This policy applies to all of this data.
• Where a school or organization decides how data is used (data processor). When a school or organization sets up its learning platform with us, it controls the data of its learners, instructors, and staff. We process that data only on the organization's instructions, under our agreement with them. If you are a learner or staff member at one of these organizations, its own privacy notice applies to you, and you should contact it first about your data. We will help the organization respond to your request.

We follow the Data Protection Act, 2019 of Kenya and its regulations. We also apply safeguards consistent with the standards of the EU General Data Protection Regulation (GDPR).

Information We Collect

We do not use the course materials or other content organizations upload to our platform to train or fine-tune AI models.

How We Use Information

The Data Protection Act, 2019 requires a lawful basis for each way we use personal data. Here is what we do and why.

How we use AI Interaction Data. We collect prompts and responses from our AI features to find errors, improve answer quality, and keep the features safe. Before we use any of this data to train or fine-tune a model, we de-identify it so it no longer identifies any person or organization, and we take reasonable steps to remove content uploaded by organizations. Organizations can opt out of this use for all their users at any time by contacting us.

We do not sell personal data. We do not use personal data to make decisions that have legal or similarly significant effects on you without human involvement.

Sharing and International Transfers

We share personal data only with the service providers we need to run our business, and only under written agreements that require them to protect it. They include:

Our current list of service providers is on our subprocessor list.

We may also share personal data where the law requires it, to protect our rights or the safety of others, or as part of a merger or sale of our business, in which case we will tell you before your data becomes subject to a different privacy policy.

Transfers outside Kenya. Some of our providers, including AI model providers, process data outside Kenya. When we transfer personal data outside Kenya, we do so only as the Data Protection Act, 2019 permits. This means the recipient provides appropriate safeguards, such as contractual protections, or the destination country has adequate data protection laws.

How Long We Keep Data and How We Protect It

We keep personal data only as long as we need it for the purpose we collected it for, or as the law requires.

Security. We protect personal data with measures appropriate to the risk, including encryption in transit, access controls limited to staff who need access, separation of each organization's data, and monitoring of our systems. No system is perfectly secure. If a data breach puts your rights at risk, we will notify the ODPC and affected people as the Data Protection Act, 2019 requires.

Your Rights

Under the Data Protection Act, 2019, you have the right to:

• be informed about how your personal data is used
• access the personal data we hold about you
• ask us to correct data that is wrong or misleading
• ask us to delete data that is false, misleading, or no longer needed
• object to our use of your data, including for direct marketing
• receive your data in a structured, commonly used format and have it moved to another provider
• withdraw consent at any time, where we rely on consent

To use any of these rights, email [email protected]. We will respond within [the time the law requires], and may need to confirm your identity first. If your data is held by a school or organization on our platform, please contact that organization, and we will help it respond.

Users Under 18

Our website is intended for adults. Some organizations on our platform may enroll learners under 18. In those cases, the organization is responsible for getting consent from a parent or guardian before the learner uses the platform, and we apply additional safeguards to that data. If you believe we have collected a child's personal data without proper consent, contact us and we will delete it.

Cookies

We use cookies that are needed to run the website and platform, and, with your consent, cookies that help us understand how the website is used. You can change your choices at any time through our cookie banner. Our Cookie Policy lists the cookies we use and what each one does.

Changes to This Policy

We may update this policy as our services or the law change. We will post the new version on this page with a new "Last Updated" date. If we make a material change, we will tell customers by email or through the platform before it takes effect.

Contact Us and Complaints

If you have a question or concern about how we handle your personal data, contact us first. We would rather fix it with you directly.

• Privacy questions, data requests, and legal notices: [email protected]. General support: [email protected]
• Data Protection Officer: [name or role]
• Postal address: Rukia Labs LTD, [physical address], Nairobi, Kenya

If you are not satisfied with our response, you have the right to complain to the Office of the Data Protection Commissioner of Kenya (odpc.go.ke).

How We Use Cookies

Cookies are small text files a website stores on your device. We and our partners also use similar technologies, such as tracking scripts, pixels, and local storage. In this policy, we call all of these "cookies".

We use cookies on rukialabs.com to run the website, understand how visitors use it, and measure our marketing. We use a smaller set inside the Rukia Labs platform to keep you signed in and to improve the product.

We only set strictly necessary cookies without asking. All other cookies, including analytics and marketing cookies, load only after you agree to them through our cookie banner. You can change your choice at any time.

This policy should be read together with our Privacy Policy, which explains how we handle the personal data these cookies collect.

Cookies on Our Website

Strictly necessary. These keep the website secure and remember your cookie choices. The website cannot work properly without them, so they do not need your consent.

Analytics. These help us understand how visitors find and use the website, so we can improve it. They load only with your consent.

Marketing and customer engagement. These help us measure our advertising, understand which visitors are interested in Rukia Labs, and respond to enquiries. They load only with your consent.

Meta's Conversions API sends conversion events from our servers to Meta, in addition to the Pixel in your browser. We only send these events for visitors who have consented to marketing cookies.

The cookie names and durations above are examples. Providers change them from time to time. Our cookie banner shows the current list.

Cookies in the Rukia Labs Platform

Inside the Learning Portals, we use a smaller set of cookies. We do not use advertising cookies inside the platform.

Session recordings are kept for [30 days] and are used only to improve the platform.

If you use the platform through a school or organization, that organization decides how the platform is used and may have its own notice about cookies and tracking.

Managing Your Choices

You can accept or reject analytics and marketing cookies through our cookie banner when you first visit, and change your choice at any time using the "Cookie Settings" link at the bottom of every page.

You can also block or delete cookies through your browser settings. If you block strictly necessary cookies, parts of the website or platform may not work.

For more control over advertising, you can use Google's Ad Settings and Meta's ad preferences.

Changes to This Policy

We update this policy when we add or change the tools we use. The "Last Updated" date at the top shows when it last changed. If we add a new type of cookie that needs consent, we will ask for your consent again.

Contact Us

• Questions about cookies or your data: [email protected]
• General support: [email protected]

Rukia Labs uses the service providers below to deliver our platform. Each one processes personal data only as needed for the purpose listed, under written agreements that require them to protect it. See our Privacy Policy for how we handle personal data.

Subprocessors

Integrations We Connect to on Customers' Behalf

These services are not our subprocessors. They are our customers' own payment and tax providers. When a customer connects them, we access them using that customer's credentials to reconcile payments and issue tax invoices.

Changes to This List

We update this page when we add or replace a subprocessor. Customers will get at least 30 days notice by email before a new subprocessor starts processing their data.

Questions about this list: [email protected]

This page sets out the registrations and standards Rukia Labs operates under. We only list what is true today, and we update this page whenever something changes. For copies of any compliance documents, email [email protected].

Company Registration

Rukia Labs is currently operated by Zindua Coding School LTD, a private limited company registered in Kenya.

Planned change. In 2027, we plan to move Rukia Labs into an independent subsidiary, so that Rukia Labs operates separately from Zindua School's own training business. Before this happens, we will notify customers and update our agreements. In the meantime, each customer's data on Rukia Labs is used only to provide the platform to that customer, and Zindua School's training business has no access to other customers' data.

Data Protection

The service providers that process personal data on our behalf are listed on our subprocessor list.

Payments

Rukia Billing does not handle money. It automates the reconciliation of payment records, so you do not have to manually record payments received through M-PESA or selected Kenyan banks. Payments always settle directly into your own account.

Because we never receive, hold, or transfer customer funds, we do not need a payment service provider licence from the Central Bank of Kenya.

If this changes, we will only collect payments through a provider licensed by the Central Bank of Kenya, or obtain the required licence ourselves. We will update this page and notify customers before the change takes effect.

Security

We build security into how the platform stores and serves each organization's data.

Tenant data separation. Every organization's data is isolated from every other organization's data, across every place we store it:

• Database. Row-level security (RLS) ties every record to the organization that owns it, so each organization can only ever access its own data.
• File and video storage. Each organization has its own dedicated storage bucket, linked to that organization in our database and protected by the same row-level security rules.
• AI vector stores. Each organization's content is stored in its own dedicated vector collection, linked to that organization in our database. Rukia AI Agents only retrieve content from the organization a user belongs to.

Encryption. All data is encrypted in transit between your device and our platform, and encrypted at rest across our servers and storage.

Network protection. Our website and platform sit behind Cloudflare, which provides protection against distributed denial-of-service (DDoS) attacks and a web application firewall (WAF) that filters malicious traffic.

Account protection.

• Every request is checked to confirm the user is allowed to access the specific record they ask for, protecting against insecure direct object reference (IDOR) attacks.
• Sign-in is protected against brute-force attacks.
• Two-factor authentication (2FA) is available for all accounts and required for administrator accounts.
• Sessions use secure cookie settings and expire automatically.

Internal access. Our team accesses company systems and infrastructure only through accounts protected by multi-factor authentication or single sign-on.

Audit logs. We keep audit logs of key actions on the platform, so activity can be reviewed and investigated when needed.

Backups and recovery. Our application and authentication databases are backed up automatically to separate cloud storage, and we maintain a recovery process to restore service and data if something goes wrong.

Breach response. If a personal data breach occurs, we will notify affected organizations without delay. Where we are the data controller, we will notify the Office of the Data Protection Commissioner within 72 hours, as the Data Protection Act, 2019 requires.

Requests

For compliance documents, such as our certificate of incorporation or KRA PIN certificate, or questions about anything on this page, email [email protected].