1. Who We Are
WamPrepAI (“WamPrepAI”, “we”, “us”, or “our”) is operated by Wambri Group Limited, a company incorporated in Kenya, and is the data controller responsible for your personal data under the Data Protection Act, 2019 (“the DPA”) and the Data Protection (General) Regulations, 2021. This policy applies to all users of the WamPrepAI website and application (the “Service”).
2. Information We Collect
We collect the following categories of personal data:
- Account information: your name, email address, and authentication details when you register or sign in.
- Interview data: the role, industry, experience level, and interview type you configure; your spoken responses and any resulting voice recordings and transcripts; and the AI-generated questions, scores, and feedback produced from your session.
- Payment data: your M-Pesa phone number, transaction reference, amount, and confirmation status for any payment you make. We do not collect or store your M-Pesa PIN or full mobile money account credentials — these are handled directly by Safaricom.
- Usage and device data: log data, approximate location derived from IP address, browser type, device information, and how you interact with the Service.
- Referral data: referral codes you generate or redeem, and the fact that a referral was used, so that referral rewards can be applied correctly.
- Communications: any information you provide when you contact us for support or other enquiries.
3. How We Use Your Information
We use your personal data to:
- Create and manage your account and authenticate you when you sign in;
- Generate interview questions, conduct voice-based mock interviews, and produce AI feedback and scoring;
- Process payments, activate subscriptions and credits, and maintain accurate billing records;
- Operate referral programs and apply associated rewards;
- Monitor, maintain, secure, and improve the Service, including diagnosing technical issues;
- Communicate with you about your account, transactions, or changes to the Service;
- Comply with our legal and regulatory obligations, including tax, financial, and record-keeping requirements under Kenyan law; and
- Detect, prevent, and investigate fraud, abuse, or violations of our Terms of Service.
4. Legal Basis for Processing
In accordance with section 30 of the DPA, we process your personal data on the following legal bases: performance of the contract between you and us when you use the Service (including generating your interview feedback and processing payments); your consent, where required, such as when you provide a voice recording; compliance with a legal obligation, such as retaining payment records; and our legitimate interests in operating, securing, and improving the Service, provided those interests do not override your rights and freedoms.
5. Automated Processing and AI-Generated Feedback
Your interview responses are analysed using artificial intelligence to generate scores and feedback. This automated analysis is a core, expected feature of the Service that you actively initiate and is used only to give you practice feedback — it does not produce any legal effect or similarly significant decision about you, and no automated output from the Service is used, by us, to make hiring, employment, or other consequential decisions about you. If you have concerns about a specific automated result, you may contact us at help@wamprepai.com for a human-reviewed explanation.
6. How We Share Your Information
We do not sell your personal data. We share personal data only in the following circumstances:
- Service providers: with third-party providers who host our infrastructure, provide account authentication, process voice interactions, and power the artificial-intelligence processing used to generate questions and feedback. These providers act as data processors on our behalf, are bound by contractual confidentiality and security obligations, and may only use your data to provide services to us.
- Payment processing: with Safaricom PLC to process M-Pesa payments. Safaricom processes this data under its own privacy policy as an independent controller of the mobile money transaction.
- Legal and regulatory disclosure: where required to comply with a legal obligation, court order, or lawful request from a Kenyan regulatory or law-enforcement authority.
- Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality safeguards.
7. Cross-Border Data Transfers
Some of our service providers may store or process personal data on servers located outside Kenya. Where this occurs, we take steps required under sections 48 to 50 of the DPA to ensure the transfer is subject to appropriate safeguards, such as contractual commitments requiring a comparable standard of data protection to that guaranteed under Kenyan law, before your data is transferred.
8. Data Retention
We retain your personal data for as long as your account remains active and for a reasonable period afterwards to comply with our legal, accounting, and regulatory obligations, resolve disputes, and enforce our agreements. Interview transcripts and feedback are retained so that you can review your practice history; you may request earlier deletion at any time as described in Section 9 below. Payment records are retained for the period required under applicable Kenyan financial and tax record-keeping laws.
9. Your Rights Under the Data Protection Act, 2019
As a data subject, you have the right to:
- Be informed of the use to which your personal data is to be put;
- Access your personal data that we hold;
- Request correction or rectification of inaccurate or outdated personal data;
- Request erasure of your personal data, subject to any legal obligation requiring us to retain it;
- Object to the processing of your personal data, in whole or in part;
- Request restriction of processing in certain circumstances;
- Receive a copy of your personal data in a structured, commonly used, machine-readable format (data portability); and
- Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.
To exercise any of these rights, contact us at help@wamprepai.com. We will respond within the timeframes required under the DPA. If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya.
10. Cookies and Similar Technologies
We use a strictly necessary, encrypted session cookie to keep you signed in and to secure your account. We do not currently use third-party advertising or analytics cookies. If this changes, we will update this policy and, where required by law, request your consent before doing so.
11. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction, including encryption of data in transit, access controls, and secure authentication. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
12. Data Breach Notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Office of the Data Protection Commissioner and, where required, affected users without undue delay, in accordance with section 43 of the DPA.
13. Children's Privacy
The Service is intended for users aged 18 and above and is not directed at children. We do not knowingly collect personal data from anyone under 18. If we become aware that we have collected personal data from a person under 18 without appropriate consent, we will delete it promptly.
14. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes to our practices or applicable law. We will update the “Last updated” date above and, where changes are material, notify you through the Service or by email.
15. Contact Us
If you have questions about this Privacy Policy or wish to exercise your data protection rights, contact us at help@wamprepai.com.
This document is provided as a general-purpose template intended to align with the Data Protection Act, 2019 (Kenya) and has not been reviewed by a qualified lawyer. It is not a substitute for independent legal advice.