PRIVACY NOTICE.
IoT & Robotics Rwanda is committed to data minimization, member privacy, and transparent retention. Here is exactly what data we hold, why we hold it, how long we keep it, and how you control it.
1. Data Controller
IoT & Robotics Rwanda (IRR) is a community-oriented technology initiative based in Kigali, Rwanda. For all matters regarding personal data, privacy rights, data portability, or account deletion, contact our privacy desk at:
Community Lead: IoT & Robotics Rwanda Platform Team
Location: Kigali, Rwanda
2. Data We Collect & Why
We collect strictly the data necessary to provide community membership, project collaboration, learning courses, and confirmed event participation. We never sell personal data or monetize member profiles.
Account & Authentication Data
Data: Email address, hashed password (managed securely by Supabase Auth), display name, optional bio, and optional GitHub profile link.
Basis: Contract performance (providing your authenticated membership and login access).
Community & Discussion Contributions
Data: Forum topics, discussion replies, project submissions, team collaboration notes, and media attachments.
Basis: Legitimate community interest (fostering open engineering knowledge and peer learning in Rwanda).
Learning Progress & Event Participation
Data: Course enrollments, lesson completion status, video playback positions, and confirmed event registrations / attendance.
Basis: Consent and service delivery (saving your learning curriculum progress and confirming workshop attendance).
Collaboration Inquiries
Data: Name, organization name, work email, and collaboration proposal message submitted via `/partners`.
Basis: Pre-contractual inquiry and legitimate relationship management.
3. Data Retention Schedule
We retain personal data only as long as necessary for community operations, technical accountability, and educational continuity.
| Category | Retention Period | Post-Retention Action |
|---|---|---|
| Active Member Accounts | Duration of active membership | Retained until member-requested closure |
| Closed / Deleted Accounts | Erased immediately upon deletion | Credentials, private email, and personal profile permanently destroyed |
| Public Forum Discussions | Permanent community learning archive | Preserved with author anonymization if account closed; editable/deletable prior to closure |
| Collaboration Inquiries | 24 months from submission | Archived and purged from database |
| Administrative Audit Logs | 12 months from recorded event | Retained for security accountability, then safely purged |
| Rate Limit Records | 24 to 48 hours | Automatically expired and cleared by database cleanups |
| Temporary Upload Chunks | 24 hours maximum | Automated orphan cleaner purges uncommitted storage objects |
4. Cookie Disclosure: Strictly Essential Only
4. Cookie Disclosure & Privacy-Conscious Product Analytics
We respect your privacy and bandwidth. IoT & Robotics Rwanda operates with a strict zero-tracking policy: We respect your privacy, trust, and bandwidth. IoT & Robotics Rwanda operates with a strict zero-advertising, zero-cross-site-tracking policy:
- No Advertising Cookies: We do not use advertising cookies, marketing pixels, or third-party behavioral trackers.Essential Authentication Only: We use strictly essential session cookies (
sb-*-auth-token) required to maintain your encrypted sign-in session and synchronize credentials across requests. - No Third-Party Analytics: We do not load Google Analytics, Meta Pixel, or commercial tracking scripts into your browser.No Advertising or Marketing Pixels: We do not use advertising cookies, retargeting pixels, commercial data brokers, or cross-site behavioral trackers.
- Essential Authentication Only: We use strictly essential session cookies (`sb-*-auth-token`) required to maintain your encrypted sign-in session and synchronize credentials across requests.Privacy-Hardened Product Analytics: We use a privacy-conscious PostHog integration to measure launch funnels, course engagement, and application health. All telemetry is proxied through our first-party origin (
/ingest/*) with European Cloud data residency options. - Zero Session Recording: Session recording is permanently disabled. We never record screens, mouse movements, or keystrokes.
- Zero Personal Content / PII: Telemetry never collects names, emails, passwords, discussion bodies, inquiry messages, or uploaded file names. Authenticated members are linked only via an internal opaque identifier.
- Strict Route Exclusions: Administrative (
/admin/*), member account (/account/*), and authentication (/auth/*) routes are completely excluded from analytics capture. - Do Not Track & Global Privacy Control: We automatically honor browser
Do Not TrackandGlobal Privacy Controlsignals by disabling analytics capture entirely.
Your Analytics Preferences
5. Your Rights: Export & Deletion
You maintain sovereign ownership of your personal data. Under Rwandan privacy principles and international data protection standards, you have the right to:
Download a machine-readable JSON copy of all personal records, course progress, event registrations, and authored contributions anytime directly from your account.
Go to Account SettingsPermanently delete your account, authentication credentials, and personal profile. You can trigger self-service erasure or email privacy@iotroboticsrwanda.org.
Manage Account Deletion