Privacy Policy

Last updated: 28 October 2026

1. Introduction and Scope

Morningstar AI (Pvt) Ltd respects your privacy and is committed to protecting the personal data of our corporate clients, software users, platform visitors, and partners. This Privacy Policy sets out how we collect, process, store, disclose, and safeguard personal information when you:

• Visit our website or web portals;
• Utilize our Enterprise Resource Planning (ERP) systems, custom AI tools, and Socratic learning/LMS platforms (including PromptLabs Academy);
• Deploy or interact with ShaZaam!;
• Engage our software engineering, data engineering, and AI automation services.
• This policy applies globally and complies with applicable regional data protection frameworks, including the Data Protection Act [Chapter 11:12] of Zimbabwe and international privacy standards where applicable.

2. Information We Collect

We collect information directly provided by you, automatically through your interactions with our systems, and from authorized third parties or enterprise clients.

A. Information You Provide Directly

• Identity and Contact Data: Full name, corporate email address, phone number, physical address, employer/organization name, and professional title.
• Account Credentials: Usernames, encrypted passwords, authentication tokens, and security questions used to access Morningstar AI platforms (e.g., LMS or ShaZaam! portals).
• Financial and Billing Data: Payment details, billing address, tax identification numbers, and transaction records (including dual-currency USD and ZiG payment logs).
• Communication Data: Inquiries, feedback, platform support requests, survey responses, and messaging sent through our contact forms or support channels.
• Educational and Institutional Data (ShaZaam! & LMS): Student academic marks, attendance records, school registration details, course progress, prompt history, and university certification records.

B. Information Collected Automatically

• Technical and System Data: IP address, browser type and version, operating system, hardware model, device identifier, network latency, and time-zone settings.
• Usage Data: Pages viewed, feature usage, session duration, interaction pathways, error logs, and performance metrics within our cloud or edge applications.
• Cookies and Tracking Technologies: Essential, operational, and analytics cookies used to maintain secure sessions, remember user preferences, and analyze platform traffic.

3. Purpose and Legal Basis for Processing

We process personal data only when we have a valid legal basis. The primary purposes and grounds for processing include:

4. How We Use AI and Data Security in Machine Learning Models

Morningstar AI develops and deploys Generative AI, Large Language Models (LLMs), and automated decision engines. We uphold strict standards regarding client data privacy in relation to machine learning:

• No Model Training on Private Client Data: Proprietary enterprise data, private educational records, and institutional marks processed via our custom software solutions or the ShaZaam! are never used to train, fine-tune, or improve public or third-party AI models without explicit, written consent.
• Prompt Processing: Input prompts and context submitted through our LMS platforms or AI toolsets are processed securely for execution and output generation only, in accordance with applicable session parameters.
• Edge & Local Processing: Where possible, sensitive calculations and low-latency operations are processed on-device or on local edge nodes to minimize remote data transmission.

5. Sharing and Disclosure of Information

We do not sell, rent, or trade your personal information. We may share data under the following strictly controlled circumstances:

• Institutional and Enterprise Clients: If you access our services through a school, enterprise, or university partner (such as a school using ShaZaam! or a university partner on PromptLabs Academy), relevant performance and usage data are shared with the managing institution.
• Third-Party Service Providers: Vetted vendor partners who assist with hosting, cloud infrastructure, database management, SMS/email notifications, and payment processing (e.g., local mobile money networks or payment gateways).
• Legal and Regulatory Compliance: When required by law, court order, regulatory body (such as the Data Protection Authority, ZIMRA, or law enforcement), or to defend our legal rights.
• Corporate Restructuring: In connection with a merger, acquisition, corporate reorganization, or sale of company assets, subject to strict confidentiality agreements.

6. International Data Transfers

Where data is stored or processed outside your home country, Morningstar AI enforces appropriate safeguards—including standard contractual clauses, encrypted transit channels, and strict vendor security audits—to ensure your personal data receives a level of protection comparable to local legal requirements.

7. Data Security and Retention

A. Security Measures

We implement comprehensive technical and organizational safeguards designed to protect personal data against unauthorized access, loss, alteration, or destruction, including:

• End-to-end encryption for data in transit (TLS/SSL) and at rest (AES-256);
• Role-Based Access Controls (RBAC) and strict authentication protocols;
• Regular system audits, vulnerability scanning, and secure offline-first data backup engines.

B. Retention Period

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, including contractual requirements, legal obligations, resolving disputes, and enforcing our agreements. Academic records held within ShaZaam! are retained according to the retention schedules mandated by the partnering educational institution or local regulatory authorities.

8. Your Data Protection Rights

Depending on your jurisdiction and applicable data privacy laws, you may have the following rights regarding your personal information:

• Right to Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate, incomplete, or outdated information.
• Right to Erasure (“Right to be Forgotten”): Request deletion of your personal data where there is no legal requirement for us to retain it.
• Right to Restrict or Object: Object to or restrict the processing of your data under specific operational circumstances.
• Right to Data Portability: Request the transfer of your structured data to another service provider.
• Withdrawal of Consent: Withdraw consent at any time where processing is based on consent.
• To exercise any of these rights, please contact our Data Protection Officer using the details provided in Section 11.

9. Children’s Privacy and Educational Data

In connection with the ShaZaam! school report management system, we process student data on behalf of educational institutions acting as the primary data controllers.

We do not directly solicit or collect personal information from minors without institutional authorization or parental/guardian consent provided through the participating school.

All processing of student records strictly serves educational administration, report generation, and academic tracking under contract with the respective school or ministry framework.

10. Updates to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our technology, operational practices, or legal requirements. Material updates will be posted on our website along with a revised “Last Updated” date. We encourage you to review this page regularly to stay informed about how we protect your information.

11. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data handling practices, please contact our Data Protection Office:

Email: info@morningstarzw.tech
Address: 3rd Floor, Runhare House, 107 Kwame Nkrumah Avenue, Harare, Zimbabwe