Lemba Privacy Policy

This policy explains what Lemba collects, why, who else handles it, how long it is kept, and what you can do about it. It describes the Lemba app as it actually works. Where something is not yet settled, it says so.

In short

• Lemba is run by [operator name to be confirmed] in Ghana. Lemba is not your university.
• Your courses, timetable, work, attendance, grades, plans and reminders are yours. They are stored on your phone and on Lemba's servers so they are safe and can be restored, and nobody else can see them. Joining a class never shares them.
• A class shares academic information only: courses, class times, venues, lecturers, semester dates, shared assignments and exams, and announcements.
• Your conversation with Lemba stays on your phone.
• When Lemba needs its AI provider, Anthropic, to understand a request or read a photo or document, it sends only what that needs, and only after you agree. Anthropic does not use it to train its models.
• Payments are made on Kora's page. Lemba never sees your mobile money number, PIN or card details.
• You can delete your account and data from the app at any time.
• Lemba does not sell your data, show ads or track you across other apps.

Who is responsible for your data

The data controller for Lemba is [operator name to be confirmed], [postal address to be confirmed]. Registration with Ghana's Data Protection Commission: [Data Protection Commission registration number to be confirmed].

For anything about your privacy, contact privacy@lemba.one. For general help, see Support.

This policy applies to the Lemba app and the Lemba website. It is written for Ghana's Data Protection Act, 2012 (Act 843) and applies wherever you use Lemba.

What Lemba collects and why

Your account

• Email address, and a password if you sign up with email. Your password is stored only as a scrambled hash by our hosting provider; nobody at Lemba can read it. Used to sign you in and to reach you about your account.
• Sign in with Apple or Google. Apple gives us an account identifier and an email address (which can be Apple's private relay address). Google gives us an account identifier, your email address, your name and a link to your profile picture. Lemba does not use the picture. Used to sign you in.
• Your first name, if you give it. Used to greet you. In a class, everyone sees the names of the people who run it and of its class reps, and its moderators see every member's name.
• Sign-in records. When you sign in, in the app or on Lemba's website, our hosting provider records the time, your IP address and your device or browser type in its security logs, which it keeps for a short time.
• Your agreements: which version of the Terms of Service and this policy you accepted, your choice about Lemba's AI provider, and when.

Your email and sign-in details are needed to have an account. Your name is optional.

Your studies

• Your academic setup: institution, programme, level, semester and dates. Needed to organise your semester and to find your class.
• Courses and timetable: course names and codes, lecturers, credits, class times, venues, and changes such as a cancelled lecture.
• Work: assignments, tests, exams and their due dates, details you add, whether they are done, and scores you enter.
• Attendance you record.
• Grades and results: course results, grades, grading rules you teach Lemba, and GPA, CGPA or CWA figures, including ones from a results slip you photograph.

You choose what to add. Without it, Lemba has less to help with, but nothing else changes.

Your plans and reminders

• Personal plans: events, appointments, work shifts, travel and study sessions, with their times and any note.
• Reminders and whether they are done.
• Planning preferences: bedtime, wake time and when you like to study.

These are private. They help Lemba plan your time and remind you. They are never shared with your class or anyone else.

Talking to Lemba

• Your conversation with Lemba is stored on your phone only. You can clear it in Settings.
• Voice. When you tap to speak, your phone's speech recognition (Apple's on iPhone, usually Google's on Android) turns your voice into text. Lemba receives only the text and keeps no audio. See Voice below.
• Photos and documents you choose to send (for example a timetable, a notice or a results slip).

Your class

If you join or create a class, Lemba stores your membership, your role in running the class, whether you are its class rep, and what you contribute to it. See Shared classes.

Lemba Pro

If you buy Lemba Pro, Lemba stores the plan, the amount and currency, the payment's status and references, and when your Pro starts and ends. See Payments.

Lemba's website

Lemba's website is for people who already have a Lemba account: you sign in with that account, and the website never creates one. If you sign in there with Google or Apple and there is no Lemba account for it, the sign-in record that created is deleted straight away, or within a day if the sign-in was interrupted.

• A sign-in cookie. The website keeps you signed in with one cookie that only the website can read, for up to 12 hours. It is needed for the website to work and is not used to track you. Signing out removes it.
• Your appearance choice. If you choose Light or Dark on the website, your browser remembers it. It stays in your browser.
• What the website shows you comes from your account on Lemba's servers: your email, your first name and your Lemba Pro. The website does not show or receive your studies, plans, class or conversations.

How the app is used

• Usage events: which features are used and how a Lemba request went (for example "answered on the phone" or "asked a question"), as fixed labels and counts, with the app version and whether it is the iPhone app, the Android app or the website. Never the words you said, course names, grades, plans or notes.
• Error reports: an error code and a cleaned-up message (quoted text, emails, links, identifiers and long numbers are removed), where in the app it happened, the app version, and whether it is the iPhone or Android app.
• Wrong-answer reports: if you report a Lemba answer, the kinds of answer it was. Your words and Lemba's reply are included only if you choose "Report with what I said".

Usage and error reports help us see what works and fix what breaks. You can turn them off in Settings, under Privacy.

What Lemba does not collect

Lemba does not collect your location, contacts, calendar, health data, browsing history or advertising identifiers. It does not record audio, and it never receives your payment credentials. There are no advertising or third-party analytics tools in the app or on the website.

Lemba and AI

Lemba answers many questions on your phone, without sending anything. For everything else (understanding what you say or type, reading a photo or document, and study help) Lemba uses an AI provider, Anthropic, through Lemba's own server. This is part of Lemba Pro.

Nothing is sent to Anthropic until you agree. The first time it is needed, Lemba asks. You can change your answer at any time in Settings, under Privacy. Your answer is kept with your account and Lemba's server checks it before anything is sent, so changing it on one device applies to all of them. If you say no, Lemba still answers what it can on your phone.

What is sent with a request is only what that request needs:

• your message and up to six recent turns of the conversation, so a follow-up makes sense;
• today's date and time, and your institution, programme, level and semester;
• your courses (codes, names and lecturers), your class times for the coming weeks and any attendance you marked for them;
• your open work (titles, types, due dates and whether done);
• your plans from yesterday to two weeks ahead (titles, types and times, not notes) and your open reminders;
• any photo or document you attached.

Lemba does not send your name, email, grades or scores (unless you ask it to read a results slip), notes or preferences as context.

What happens there. Under Anthropic's commercial terms, Anthropic does not use Lemba's requests to train its models. It normally deletes them within 30 days. It may keep material flagged as breaking its usage policy for up to two years, and may keep data longer where the law requires. Anthropic processes data mainly in the United States.

What the AI decides. The AI only interprets your words. Lemba's own code then checks every change against your data and makes it, and anything important is confirmed with you first. Dates, deadlines, free time and grade figures always come from your own data, never from the AI's text. The AI does not make decisions about you with legal or similar effects.

Voice

Lemba listens only after you tap. There is no wake word and nothing listens in the background.

• On iPhone, iOS may turn your speech into text on your phone or on Apple's servers, depending on your device and language; iOS tells you about this when you first allow speech recognition.
• On Android, your phone's speech recognition service turns your speech into text. On most phones this is Google's, which may work on the phone or on Google's servers, depending on the phone, its language downloads and its settings. The service and what it keeps are set by your phone and its maker, under their own terms.

Lemba receives only the resulting text, which is then handled like a typed message. Lemba does not record or keep any audio.

Photos and documents

When you send a photo or document to Lemba, it goes to a private storage area only you and Lemba's server can reach. It is read once, then deleted. If a request is interrupted, anything left behind is removed by a later clean-up once it is a day old, normally within a few days.

So that Lemba does not pay to read the same timetable twice, what it reads from a timetable, a grading table or a course outline may be reused when someone sends exactly the same file. That reading has no link to you. Results slips and anything you wrote yourself are never reused.

Photos and documents you send are never shared with your class.

Shared classes

A class is a group of students on the same programme, level and semester. Classes are created by students, not by universities.

What a class shares with its members: the class's courses, class times, venues and lecturers, semester dates, shared assignments and exams, announcements, and who runs the class and who its class reps are (first names and roles). Students choosing the same programme, level and semester can see a class's name, how many students it has and what it offers before they join, but not who is in it.

What you add to a class: if you share your timetable with your class, Lemba sends only your courses, class times, venues, lecturers and semester dates, never anything else. Announcements and shared work you post are seen by your classmates.

What is never shared with a class or its members, whatever their role (owner, admin, moderator or class rep): your personal plans, reminders, study sessions, planning preferences, attendance, grades, results, GPA, scores, notes, photos and documents, your conversation with Lemba, and your notification choices. Lemba's database enforces this, not just the app.

Sharing a grading system. After you confirm how your institution grades, Lemba may offer to share that grading table with other students at your institution and programme, as a reference they check for themselves. It is shared only if you agree, without your name, and only as the table (grades, marks and points), never your own results.

Running a class creates records: roles, class rep changes, membership changes, moderation, hand-overs of the class, and recovery decisions. Members can see changes to roles, class reps and who runs the class. Removals, restrictions and moderation are visible only to the class's moderators and above. Votes in a recovery decision are private: members see only how many voted. Anything you tell Lemba's reviewers about a class dispute is seen only by them.

Reports and hiding. If you report an announcement, the class's moderators see the report and its reason but not who made it. Lemba's support can see who reported it. You can also hide announcements from a person; that choice stays on your phone and nobody is told.

If you leave a class, what you contributed stays for your classmates. If you delete your account, your announcements are taken down, and the courses, class times, dates and shared work you contributed stay for your classmates, without your name.

Payments

Lemba Pro is paid for on the payment page of Kora (Korapay), a payment provider. You enter your mobile money details on Kora's page, not in Lemba, and Lemba never receives them.

To start a payment, Lemba gives Kora the amount, the currency, a reference for the payment, and your email address and first name. Kora tells Lemba whether the payment succeeded. Lemba keeps the plan, amount, currency, status, references and dates of each payment, and when your Pro starts and ends.

Kora handles your payment under its own terms and privacy notice, and may act as a separate controller of the payment information it collects.

Emails Lemba sends

Lemba sends only a few emails, all about your account: a link to reset your password when you ask for one, a confirmation when a payment turns on or extends your Lemba Pro (it is also your receipt), a reminder 3 days before your Pro ends, and a note when it has ended. Lemba does not send newsletters or marketing emails.

These emails contain only what they are about (for a payment: its amount, reference and your Pro dates), never your classes, grades, plans or conversations with Lemba. Lemba does not track whether you open them or tap their links. Lemba keeps a record of which of these emails it sent, without their content, for 13 months.

Who else handles your data

Lemba does not sell personal data or share it for advertising. These providers handle it for Lemba:

• Supabase hosts Lemba's database, sign-in, file storage and server functions, in London, United Kingdom.
• Cloudflare hosts Lemba's website and passes its requests to Lemba's servers. It processes your IP address and browser details to deliver the website and keeps request logs for up to 7 days.
• Anthropic provides Lemba's AI, only with your agreement (see Lemba and AI).
• Kora processes Lemba Pro payments.
• Resend sends Lemba's emails (see Emails Lemba sends). It receives your email address and the email itself.
• Apple provides Sign in with Apple, speech recognition on iPhone, and delivers the app on iPhone.
• Google provides Sign in with Google, if you use it, and on most Android phones the speech recognition. If you got Lemba from Google Play, Google delivers the app.

Each provider handles data under its agreement with Lemba or, for Apple, Google and Kora, also under its own terms. Lemba may also disclose data where Ghanaian law requires it, for example to comply with a court order, and will tell you where the law allows.

Where your data is processed

Your account and data are stored in London, United Kingdom. The server functions the app calls run there too. Lemba's website is delivered from Cloudflare's network, from the location nearest to you. Requests to the AI provider are processed mainly in the United States. Payment processing happens with Kora. Emails are sent through Resend, which may process them in the United States. Your data stays protected under Ghana's Data Protection Act wherever it is processed, and Lemba uses only providers that commit by contract to protect it.

How long Lemba keeps data

• While you have an account: your account, studies, plans, reminders and class membership are kept until you delete them or your account.
• Things you delete: they disappear from your phone straight away. Lemba's server keeps them, marked as deleted, for 90 days so your other devices catch up, then removes them completely.
• Your conversation with Lemba: on your phone, until you clear it or sign out.
• AI requests: the result of a request is kept for up to 24 hours (so a repeated request does not run twice), and a record without its content for 30 days. Records of AI use (which feature, how much it cost, whether it worked) are kept for 13 months.
• Photos and documents: deleted right after reading; anything an interrupted request left behind is removed by a later clean-up once it is a day old, normally within a few days.
• Usage events: 13 months. Error reports: 90 days. Wrong-answer reports: 12 months.
• Class records: a class's history for 3 years; the details of a recovery decision (votes and statements) for a year after it ends; reports about announcements for a year after they are dealt with.
• Your agreements (which versions you accepted): while you have an account.
• The website's sign-in cookie: up to 12 hours, or until you sign out. Website request logs at Cloudflare: up to 7 days.
• Records of emails Lemba sent (which email and when it was sent; never its content): 13 months.
• Payment records: six years from the end of the year of the payment, because Ghana's tax law requires business records to be kept for at least six years, and then deleted. They are kept without your name if you delete your account.

The limits for records on Lemba's servers are applied by a clean-up that runs once a day, so a record can stay up to a day past them. Our hosting provider keeps backups for a short time (currently up to 7 days), after which deleted data is gone from them too.

Deleting your account

You can delete your account in the app: Settings, then Delete account. This deletes your account and everything in it, on your phone and on Lemba's servers. If you signed in with Apple, Lemba also asks Apple to withdraw your Apple ID's sign-in to Lemba, and tells you if that could not be done. See Delete your account and data for exactly what is deleted and what is kept.

How Lemba protects your data

• Everything between the app and Lemba's servers is encrypted in transit, and our hosting provider encrypts stored data.
• Each student's data is separated in the database itself, so one student cannot read another's, whatever their role in a class.
• Keys to Lemba's providers are kept on the server, never in the app.
• Access to production systems is limited to the people who run Lemba.

No system is perfectly secure. If a security breach affects your personal data, Lemba will tell you and Ghana's Data Protection Commission as soon as reasonably practicable.

Your rights

Under Ghana's Data Protection Act you can:

• Ask for a copy of the personal data Lemba holds about you. Lemba will respond within 40 days.
• Correct your data. You can edit most of it directly in the app; for anything else, contact us.
• Delete your data, by deleting your account in the app or by asking us.
• Object to processing that causes you damage or distress, or to direct marketing. Lemba does not send marketing.
• Withdraw your agreement to AI processing at any time in Settings.
• Complain to Ghana's Data Protection Commission (dpc.gov.gh). We would like the chance to help first: privacy@lemba.one.

To use a right, contact privacy@lemba.one. We may need to confirm it is really you before acting.

Younger students

Lemba is made for students at universities and other tertiary institutions. It is not meant for children. If you are under 18, use Lemba only with the permission of a parent or guardian.

Messages from Lemba

Lemba sends you messages only about your account and what you asked for, such as a sign-up code or a password reset. It does not send marketing. If that ever changes, Lemba will ask first and you will be able to stop them at any time.

Changes to this policy

When this policy changes, the version and date at the top change. If a change matters for how your data is used, Lemba will tell you in the app before it takes effect.

Contact

[operator name to be confirmed], [postal address to be confirmed]

Privacy: privacy@lemba.one Support: support@lemba.one