Privacy Policy
This explains what data ShuleMatrix collects, why, and how it's used.
1. Who this policy covers
This policy applies to schools ("Customers") that use ShuleMatrix, and to the students, parents/guardians, teachers and staff whose data schools enter into the platform ("End Users"). Schools are the data controller for their own students' data; ShuleMatrix acts as the data processor.
2. Information we collect
- Account data: name, email, phone number, role, school affiliation.
- Student records: admission details, academic results, attendance, CBC competency ratings, discipline records, and — where a school chooses to record it — basic health notes.
- Financial data: fee payment records and balances (we do not store full M-Pesa PINs or card numbers).
- Security and audit data: log-in activity and system audit records needed to protect school accounts and investigate changes.
- Public-site analytics: aggregate page, CTA and campaign events. The built-in public analytics table intentionally does not store visitor IP addresses, user agents, email addresses, phone numbers or a persistent visitor identifier.
3. How we use this information
- To provide the core functionality of the platform (marks entry, report generation, attendance, fee tracking, etc.)
- To send SMS/email notifications your school has configured (e.g. results, fee reminders)
- To maintain security, audit trails, and prevent unauthorised access
- To improve the product based on aggregated, de-identified usage patterns
4. Who we share data with
We do not sell personal data. We share data only with: (a) your school's authorised staff, based on their role; (b) service providers strictly necessary to operate the platform (e.g. SMS gateway, hosting provider); and (c) authorities where required by Kenyan law.
5. Data retention
Retention depends on the school's contractual and record-keeping requirements. School data should be retained only for as long as necessary for the service, legal obligations and agreed backup cycles, and should be exportable or deleted according to the applicable school agreement and verified operational procedures.
6. Your rights
Under the Data Protection Act 2019, parents/guardians and staff may request access to, correction of, or deletion of personal data held about them or their child, subject to the school's own record-keeping obligations. Requests should be directed to your school first, or to us at [email protected].
7. Changes to this policy
We will post any changes to this page and update the "last updated" date above. Material changes affecting how student data is used will be communicated to schools directly.
8. Contact
Questions about this policy: contact us here.