Privacy Policy

1. Who is responsible for your data

Dereva Prep is operated by CirclePoint Limited ("we"), through derevaprep.app and the driving-school apps on derevaprep.app addresses. CirclePoint Limited is the data controller for the personal data described in this policy. Privacy questions and data-rights requests can be sent to privacy@derevaprep.app.

2. What Dereva Prep collects

Depending on how you use Dereva Prep, we may process:

• Account data: your authentication identifier, name, email address, profile image, and sign-in provider information supplied through Clerk.
• Learning data: quiz answers, scores, completed quizzes, Model Town Board attempts, progress, usage counts, and activity timestamps.
• Payment data: M-Pesa phone number, amount, plan, payment status, transaction identifiers, receipt number when returned by Safaricom, and related subscription records. Dereva Prep does not receive or store your M-Pesa PIN.
• Device and browser data: information needed to operate the site, including authentication cookies, request/security logs, and local browser storage used for guest progress and theme preferences.
• Email and notifications: your email address to send account and payment messages and, if you have not unsubscribed, practice reminders and offers. If you turn on notifications, a device token so we can send them to that device.
• Analytics data: pages viewed, buttons tapped, the ad or link a visit came from, referrer, general location, device type, operating system, and browser, measured through PostHog with a random identifier kept in your browser. Pages for your profile, exams and staff dashboards are not measured, and we do not record your screen. Dereva Prep does not intentionally send names, email addresses, phone numbers, or M-Pesa identifiers in analytics events.

3. Why Dereva Prep uses this data

• to create and secure accounts and keep users signed in;
• to provide quizzes, Model Town Board practice, progress syncing, and free/premium access controls;
• to process and reconcile M-Pesa purchases and provide paid access;
• to prevent abuse, investigate failures, maintain security, and support users;
• to comply with legal, accounting, payment, and regulatory obligations; and
• to improve reliability and understand product usage using data that is appropriate for that purpose.

Dereva Prep processes personal data where necessary to provide the service or perform a contract, where required to comply with law, where legitimate interests are permitted, and on consent where consent is the appropriate legal basis.

4. Who receives data

Dereva Prep uses service providers to operate the product. These currently include:

• Clerk for authentication and account management;
• Convex for application data and backend services;
• Vercel for web hosting, delivery, and technical request handling;
• PostHog for product analytics, as described in section 2;
• Resend for sending email;
• Google Firebase for sending notifications, if you turn them on;
• Safaricom / M-Pesa Daraja for payment initiation, confirmation, and reconciliation; and
• Google or another identity provider if you choose that provider when it is offered through Clerk; and
• Meta Platforms (Facebook and Instagram) to measure our ads, as described in section 6.

If you choose a driving instructor, or join through an instructor's link, that instructor can see your first name, when you joined, and whether you have Premium. While you have Premium, they can also see when you last practised, your practice results, and your exam readiness. They cannot see your email address, phone number, or payment details.

If you use Dereva Prep through a driving school's own app, such as safestart.derevaprep.app, that school and its instructors can see your name, that you joined, and your practice results and exam readiness. They cannot see your payment details.

If you sign up through another learner's invite link, that learner can see your first name and the initial of your last name, when you signed up, and whether you have joined Premium. Your invite link shows the people you invite your first name. Neither of you can see the other's progress, contact details, or payment details.

We may also disclose information where required by law, to protect the service or users, or in connection with a genuine business reorganisation, subject to applicable data-protection requirements.

Dereva Prep does not sell personal data or rent personal data to advertisers.

5. International transfers

Some technology providers may process or store data outside Kenya. International transfers are subject to the requirements of Kenyan data protection law, including appropriate safeguards or another lawful basis for the transfer where required.

6. Cookies and local storage

Dereva Prep uses storage that is necessary to operate the service. Clerk may use authentication cookies or similar technologies. Dereva Prep also uses local browser storage for guest progress, theme preferences, and the ad or link your first visit came from. PostHog keeps a first-party cookie with a random identifier so visits from the same browser can be counted together. If you pay without an account, your browser also keeps a random key that unlocks Premium there; we store only a scrambled copy of it, linked to your M-Pesa payment. Dereva Prep does not use third-party advertising cookies.

When you start or complete an M-Pesa payment, we tell Meta (Facebook and Instagram) that a payment happened: the amount, the plan, the Facebook ad click you arrived from if any, your browser type, and a one-way scrambled (hashed) copy of your M-Pesa number and account ID. Meta uses this to measure which of our ads lead to payments and to show our ads to people more likely to find Dereva Prep useful. We never send your name, email, progress or the raw phone number. To opt out, email privacy@derevaprep.app.

7. How long data is kept

Dereva Prep keeps personal data only for as long as it is needed for the purpose for which it was collected, to provide the account or service, resolve disputes, prevent fraud, or meet legal and financial record-keeping obligations. When data is no longer required, it should be deleted, anonymised, or otherwise handled in accordance with applicable law.

8. Your rights

Subject to applicable law, you may ask to be informed about processing, access your personal data, correct inaccurate data, object to certain processing, request deletion or restriction where applicable, request portability, or withdraw consent where processing depends on consent.

Send requests to privacy@derevaprep.app. We may need to verify your identity before acting on a request. You may also lodge a complaint with Kenya's Office of the Data Protection Commissioner.

9. Account deletion

You may request deletion of your Dereva Prep account and associated personal data by contacting the privacy address above. Some transaction, anti-fraud, dispute, tax, or accounting records may need to be retained where the law allows or requires it.

10. Children

Dereva Prep account features are intended for users who can lawfully provide their own consent. We do not intentionally collect account data from a child without the consent and safeguards required by Kenyan law. If you believe a child has submitted personal data without the required consent, contact us so the issue can be reviewed.

11. Security

Dereva Prep uses reasonable technical and organisational measures intended to protect personal data, including authenticated access, restricted credentials, secure transport, and access controls appropriate to the service. No internet service can guarantee absolute security.

12. Changes to this policy

We may update this policy when the product, providers, or legal obligations change. The effective date and version at the top of this page identify the current published version.