Privacy policy.

Skulbase is a school management system for Kenyan schools, on the web at skulbase.com and in the Skulbase mobile app. This policy covers both. Schools sign up and invite their staff, learners and parents; the school decides what is recorded about its learners and is responsible for that data, and Skulbase processes it on the school’s behalf.

Questions about this policy: alexotieno293@gmail.com or 0740 129 444.

• Account details: name, email address, phone number, password (held by our sign-in provider, never by us) and, if you use it, your Google account’s name and email.
• School records: what the school enters — classes, admission numbers, exam marks, report cards, attendance, timetables, fees and payments, and, where the school uses those modules, boarding, health, discipline, transport, library and leave records.
• Photos and files you choose to upload, such as profile photos and scanned exam papers.
• Location, only on the bus driver’s screen while a trip is running, so parents can see the bus. It is never collected in the background or from other users.
• Payment details for M-Pesa and Pesapal fee payments: phone number, amount and receipt number. Card details go straight to Pesapal and never reach us.
• Technical data needed to run the service: sign-in sessions. If the app crashes, the crash details stay on your phone unless you choose to send them to us.

• To run the school features you and your school use: marks, report cards, attendance, fees, messages to parents.
• To sign you in and keep your account secure.
• To send messages the school asks us to send (email, SMS, WhatsApp) and service messages about your account.
• To fix problems and improve the service.

We do not sell personal data or use it for advertising. We share it only with the services that run Skulbase, each bound to protect it:

• Clerk (sign-in), Supabase (database and file storage), Vercel (hosting).
• Resend (email), Africa’s Talking (SMS) and Meta WhatsApp (messages).
• Safaricom M-Pesa and Pesapal (fee payments).
• Anthropic, when a school uses AI features such as reading a scanned exam paper; the content is processed to produce the result and is not used to train models.

Inside a school, people see what their role allows: admins and teachers see their school’s records, parents see their own children, learners see their own results. We may disclose data where the law requires it.

Learners’ records are created by their school. A learner’s account is opened with an invite code from the school, and parents see their children through the parent portal. Schools are responsible for any consent their learners and parents need to give. Parents may ask the school, or us, to correct or delete their child’s data.

Data is encrypted in transit (HTTPS) and at rest, payment credentials a school saves are encrypted again by us, and access is limited by role. No system is perfectly secure, but we work to protect your data and will tell affected schools promptly about any breach.

We keep data while the school uses Skulbase. When you delete your account, your sign-in and the records that are only yours are deleted straight away. Records you made for the school stay with it, no longer linked to you. When a school asks to close its account, its data is deleted within 90 days, apart from what the law requires us to keep.

Under Kenya’s Data Protection Act, 2019 you may see, correct, or delete your personal data and object to how it is used. Ask your school, or contact us at alexotieno293@gmail.com.

Delete your account at any time: in the app, open Profile → Delete account, or use the account deletion page.

If we change this policy we will update the date above, and tell schools by email about significant changes.