Zambia Data Protection Act No. 3 of 2021 Compliant
Privacy Policy & Statutory Data Protection Notice
Last Updated: October 17, 2026
Legal Notice: mooted.me is an interactive educational simulation platform for clinical case history-taking and common-law moot court advocacy. This Privacy Policy outlines our processing of personal data in compliance with the Zambia Data Protection Act No. 3 of 2021 (DPA 2021).
01. Data Controller Identity & Contact
The Data Controller responsible for the processing of your personal data on mooted.me is:
- Legal Entity Name:
TODO: Legal Entity Name (e.g., Mooted Technologies Zambia Limited) - Registered Office:
TODO: Registered Physical Address in Zambia (e.g., Stand No. 1234, Great East Road, Lusaka, Zambia) - Data Protection Officer (DPO) Contact:
TODO: DPO Contact Email (e.g., dpo@mooted.me / privacy@mooted.me)
02. Lawful Basis for Processing (DPA 2021 Section 32)
Under Section 32 and Section 33 of the Zambia Data Protection Act No. 3 of 2021, we process your personal data under the following lawful grounds:
- Consent (Section 32(1)(a)): You provide express, revocable consent upon registering an account or initiating guest mode to allow the processing of your inputs for educational simulation.
- Contractual Necessity (Section 32(1)(b)): To deliver the simulation services, maintain authentication sessions, and generate evaluation rubrics.
- Legitimate Interests: To detect malicious bots, enforce sliding-window rate limits, safeguard platform infrastructure, and prevent automated abuse.
03. Verified Data Inventory (What We Collect)
Based directly on our active database architecture and Better-Auth configuration, mooted.me collects and processes only the following categories of data:
| Category | Specific Fields Collected | Purpose |
|---|---|---|
| Identity & Account | User: id, name, email, emailVerified, image | User account management and avatar rendering. |
| Auth & Session | Session: token, expiresAt, ipAddress, userAgent; Account: OAuth tokens | Authentication state and security tracking. |
| Academic Profile | course (LAW / MEDICINE), isStudent, academicYear, tokensUsedToday | Curriculum personalization and daily token quotas. |
| Medical Simulation | MedSession: finalDiagnosis, allSymptoms; MedResponse: userDiagnosis, userPrescription | History-taking intake simulation and grading. |
| Legal Arena Simulation | LawDebate: caseTitle, legalIssue, finalScore; DebateMessage: oral arguments | Courtroom advocacy simulation and judicial rulings. |
| Active Recall | ActiveRecallCard: interval, easeFactor; QuestionVariation: AI questions | Spaced repetition memory consolidation. |
| Guest Quotas | mooted_guest cookie (HMAC signed), Arcjet IP sliding window | Enforce 5-turn guest cap & 3 sessions/24h limit. |
04. Third-Party Processors & Cross-Border Transfers
Under Section 70 of the Zambia Data Protection Act No. 3 of 2021, personal data may only be transferred outside Zambia where adequate safeguards exist and the data subject has been explicitly informed. The following processors handle data on behalf of mooted.me:
- Google Gemini (Google LLC, USA): Simulation prompts and dialogue turns are transmitted to Google Gemini servers located outside Zambia for automated LLM text generation and scoring. Data is processed transiently according to Google Cloud Enterprise terms.
- Google OAuth (Google LLC, USA): Used for single-sign-on verification. Google provides verified name, email address, and profile photo.
- Vercel Inc. (USA / Global Edge): Provides serverless web hosting, static asset distribution, and edge routing.
- PostgreSQL Cloud Host:
TODO: Cloud Database Host (e.g., Neon Tech / Supabase / AWS RDS eu-west-1)stores encrypted database records at rest. - Arcjet Labs, Inc. (USA): Provides Web Application Firewall (WAF) Shield, automated bot screening, and serverless IP-based sliding window rate limiting. Request IP and headers are inspected.
- PostHog Inc. (US / EU Cloud):
TODO: Confirm PostHog deployment host e.g. us.i.posthog.com or eu.i.posthog.com. PostHog is configured in cookieless, client-side memory-only mode without session recording, ensuring zero persistent cookies prior to consent. - Cloudflare, Inc. (Optional): Reserved for optional Turnstile CAPTCHA verification if human challenges are triggered.
05. Cookies & Local Persistence Policy
We believe in minimal, privacy-first tracking:
- Essential Authentication Cookies:
better-auth.session_token(HttpOnly, Secure, SameSite=Lax) maintains your authenticated session. - Guest Quota State:
mooted_guestcontains an HMAC-SHA256 signed JSON payload storing turn counts for anonymous trial users. - Zero Persistent Tracking Cookies: Our product telemetry (PostHog) uses in-memory persistence only. No identifying persistent cross-site tracking cookies are stored on your device.
06. Your Data Subject Rights (Zambia DPA 2021)
Under Part VII of the Zambia Data Protection Act No. 3 of 2021, you have the following enforceable rights:
- Right to Access (Section 57): You may request a machine-readable export of all personal data held about you by contacting
TODO: privacy@mooted.me. - Right to Rectification (Section 61): You may update your name, academic year, and profile information through the application onboarding settings.
- Right to Erasure / "Right to be Forgotten" (Section 62): We have implemented immediate, in-app self-service erasure controls:
- Simulation History Erasure: Click "Erase Simulation History" in your dashboard sidebar to immediately delete all clinical cases, debate transcripts, and evaluation logs.
- Full Account Erasure: Call our permanent account deletion endpoint (
DELETE /api/user/delete-account) or submit an erasure notice. All user data, linked OAuth credentials, and session logs are cascaded and deleted immediately.
- Right to Withdraw Consent (Section 34): You may withdraw consent at any time. Withdrawal terminates your active simulation access but does not affect the lawfulness of past processing.
- Response Timeframe: In accordance with statutory requirements, all formal data subject requests will be processed within 30 calendar days of receipt.
07. Data Retention & Security Standards
Retention Periods:
- Guest trial tokens and IP rate-limiting logs: Expire automatically after 24 hours.
- Active student accounts and simulation histories: Retained for the duration of the account or until deleted by the user.
- Inactive accounts:
TODO: Inactive account retention window (e.g., purged after 18 months of continuous inactivity). - Encrypted database backups:
TODO: Backup retention period (e.g., 30 days rolling).
Security Safeguards:
- Modern Transport Layer Security (TLS 1.3) encryption in transit across all endpoints.
- Serverless Arcjet WAF Shield filtering SQLi, cross-site scripting (XSS), and automated crawlers.
- Cryptographic HMAC-SHA256 signature verification preventing guest token forgery.
- Strict server-only credential isolation with zero client-side exposure of AI API keys.
08. Children's Privacy Notice
mooted.me is an educational training platform intended for university students, law apprentices, medical trainees, and adult professionals aged 18 and older. We do not knowingly solicit or collect personal data from minors under the age of 18 without verified parental or institutional consent.
Supervisory Authority Contact
If you believe your personal data has been handled inconsistently with Zambian law, you have the right to lodge a complaint with the Data Protection Commission of Zambia (Office of the Data Protection Commissioner).
← Back to mooted.me © 2026 mooted.me. All rights reserved.