Privacy Policy

Who we are

Shulebora is a school management system operated for Kenyan pre-primary, primary, junior secondary and senior secondary schools. Each subscribing school is the data controller of its learner, guardian and staff records; Shulebora acts as the data processor on that school's behalf.

Information we collect

Learner information: names, admission number, class and stream, date of birth, gender, Unique Learner Identifier (ULI), KNEC assessment indices, guardian contacts, medical notes recorded by the school, attendance, assessment scores and fee balances.

Staff information: names, designation, TSC or payroll number, contact details, teaching load, attendance and payslip records.

Account information: email address, phone number, role and the school you belong to.

Technical information: device and browser type, and error logs used to keep the service working.

How we use information

We use the data only to deliver the features your school has enabled: registers, assessments, report cards, fee invoicing and M-Pesa reconciliation, parent SMS and WhatsApp notifications, gate passes, KEMIS exports and school reporting. We do not sell data and we do not use learner data for advertising.

Parent and guardian notifications

Guardian phone numbers are used to send school messages such as fee reminders, gate pass alerts, results notices and event announcements. Messages are sent through our SMS gateway partner. A guardian can ask the school to stop notifications at any time.

Data isolation and security

Every record is tagged with a school identifier and protected by row-level security, so one school can never read another school's data. Access inside a school is limited by role. Data is encrypted in transit and at rest, and sensitive actions are written to an audit log.

Data sharing

We share data only with the infrastructure providers needed to run the service (hosting and database, SMS delivery, payment reconciliation), and with the Ministry of Education when your school chooses to generate a KEMIS export. We may disclose data where Kenyan law requires it.

Retention

School data is retained for as long as the school holds an active account, plus a grace period after cancellation so records can be exported. On written request from the Head of Institution we delete the school's data permanently.

Your rights

Under the Kenya Data Protection Act, 2019 you may request access to, correction of, or deletion of personal data held about you or your child. Requests are made through the school, which can action most of them directly in the system, or to us at info@shulebora.app.

Children's data

Shulebora holds learner data on the instruction of the school, under the school's own enrolment and consent arrangements with parents and guardians. Learners do not create their own accounts without the school issuing access.

Changes and contact

We will notify schools in the app when this policy changes materially. Questions: info@shulebora.app or WhatsApp 0702 079 899.