Privacy notice
Last updated 25 October 2026
The short version 👋
- We collect only what we need to teach you: your email, a nickname, your class, and what lessons you finish.
- Other learners only ever see your nickname, animal and XP — never your real name, email or phone.
- We never sell your data, show you adverts, or use tracking cookies.
- If you are under 18, your parent or guardian must agree before you join.
- You can download everything we hold about you, or delete your account, any time from your Me page.
1. Who we are
Shule Poa is an online learning service for learners in Kenya from Grade 6 to Grade 12 and Form 3 to Form 4. We teach Mathematics, Physics, Chemistry, Biology, Computer Studies and German.
For the personal data described here, the data controller is Shule Poa, Woodvale Grove, Westlands, Nairobi, Kenya. Our registration with the Office of the Data Protection Commissioner (ODPC) is in progress.
Our Data Protection Officer is Victor Kambi. You can reach them at info@shulepoa.com or 0790 712 365 about anything in this notice.
2. What we collect
| Information | Where it comes from | Why |
|---|---|---|
| Email address and password (stored only as a secure hash) | You, when you sign up | To create your account and let you log in |
| Your name | You, when you sign up | To address you and help with account problems. It is never shown to other learners |
| Nickname and animal avatar | You | Shown on leaderboards instead of your real name |
| Class (grade or form), daily goal | You | To show the right lessons and track your goal |
| County and school (both optional) | You | County leaderboards. You can leave both blank |
| Whether you are under 18, and your parent or guardian’s name and phone or email | You or your parent | To record a parent or guardian’s consent, as the law requires for children |
| A parent or guardian’s email for the weekly report, and when they confirmed or unsubscribed | The learner, then the parent confirms | To email the weekly progress report, only after the parent confirms it |
| Lessons finished, quiz and practice answers and scores, questions you got wrong, past papers you sat and the marks you gave yourself, XP, streaks, how far you watched each video | Created as you learn | To save your progress, pick up where you stopped, show your weak spots, bring back questions you missed, and give rewards |
| Reminder settings you choose, the address your phone or browser gives us for notifications, and a WhatsApp number if you add one | You | To send the reminders you turned on, and nothing else. A record of each reminder sent is kept for 90 days so we don’t repeat it |
| Whether you found a lesson helpful, and any problem you report about a lesson with the words you type | You | To find and fix confusing or broken lessons. The lesson’s teacher and our admins see the report, but not who sent it |
| M-Pesa phone number, plan, amount, M-Pesa receipt number and payment status | You and Safaricom | To take payment for Shule Poa Plus and keep records the tax law requires. We never see your M-Pesa PIN |
| Lessons, videos, documents, past papers and questions uploaded by teachers | Teachers | To teach learners |
| IP address, browser type and time of each request | Your device, automatically | To keep the service working and secure, and to stop abuse |
We do not collect sensitive personal data such as health, religion, ethnicity or biometrics, and we ask you not to put any in your nickname or school name.
3. Why we use it, and the legal basis
| Purpose | Legal basis (Kenya DPA s.30 · GDPR Art. 6) |
|---|---|
| Running your account and lessons, saving progress, streaks and XP | Performing our agreement with you (contract) |
| Letting a learner under 18 join | Consent of a parent or guardian (DPA s.33 · GDPR Art. 8) |
| Leaderboards with your nickname, avatar and XP | Performing our agreement with you; you choose your nickname and can leave county blank |
| Taking and confirming M-Pesa payments | Performing our agreement with you |
| Keeping payment records for five years | Legal obligation (Tax Procedures Act s.23) |
| Security, preventing fraud and fixing faults | Legitimate interests in keeping the service safe, balanced against your rights |
We do not use your data for advertising or marketing. We do not sell or rent it. We do not make any decision with legal or similarly significant effects about you by automated means. XP, streaks and badges are worked out automatically, but only to show your progress.
4. Children and a note for parents
Most of our learners are under 18. Under the Kenya Data Protection Act (s.33) and the GDPR (Art. 8), we only process a child’s personal data with the consent of their parent or guardian. When a learner says they are under 18, we ask for your name and phone number or email, and for confirmation that you agree. We record the date and the version of this notice you agreed to.
We may contact you on the details given to confirm your consent. If you did not agree, or you want to withdraw consent, contact info@shulepoa.com and we will delete the account.
Progress reports. A learner can share a private link to a weekly report of their learning with you, and switch it off any time. They can also ask us to email you the report every Sunday. We only start once you confirm from the email we send you, and every report has an unsubscribe link.
We collect as little as we can about children. Leaderboards show only nicknames. Learners cannot message each other, and we show no adverts.
6. Data sent outside Kenya
Our database is in the European Union (Ireland), and some of our providers process data in the United States. Under sections 48 and 49 of the Data Protection Act, we transfer personal data outside Kenya only where there are appropriate safeguards. These include the providers’ data processing agreements with Standard Contractual Clauses, encryption in transit and at rest, and access controls. For data covered by the GDPR, transfers to the United States rely on the EU–US Data Privacy Framework or Standard Contractual Clauses (GDPR Art. 45–46). You can ask us for details of these safeguards.
7. How long we keep it
| Information | How long |
|---|---|
| Account, profile, progress, lesson feedback and consent records | Until you delete your account, or until we close it at your parent or guardian’s request |
| Reminder settings, notification addresses and WhatsApp number | Until you turn that reminder off, remove the number, or delete your account. Records of reminders sent: 90 days |
| A parent’s email for the weekly report | Until the learner stops the report or deletes their account. After unsubscribing it is kept only so we don’t email them again |
| Payment records (plan, amount, date, M-Pesa receipt) | Five years, as tax law requires. When you delete your account they are detached from you and the phone number is erased |
| Server and security logs | Up to 30 days, unless needed to investigate an incident |
| Backups | Up to 30 days, after which deleted data is gone from backups too |
8. Your rights
Under the Kenya Data Protection Act (s.26 and related sections) and the GDPR (Art. 15–22), you have the right to:
- Be informed about how your data is used. This notice does that.
- Access your data. Use Download my data on your Me page.
- Correct it. Change your name, nickname, class, county and school in Settings, or ask us.
- Delete it. Use Delete my account on your Me page. This is permanent.
- Data portability: get your data in a machine-readable format (JSON) to take elsewhere.
- Object to processing based on legitimate interests, or restrict processing while a complaint is checked.
- Withdraw consent at any time. This does not affect what was done before you withdrew it.
A parent or guardian can use these rights for a child under 18. For anything you cannot do in the app, email info@shulepoa.com. We may ask you to confirm who you are. We answer within the time limits in the Data Protection (General) Regulations 2021, and never later than one month. Using your rights is free.
10. How we keep it safe
All traffic is encrypted (HTTPS), and data is encrypted at rest. Database rules mean each learner can only read their own records. Lesson videos use signed, expiring links. Payment confirmations are checked directly with Safaricom. Staff access is limited to what each role needs.
If a personal data breach puts your rights at risk, we will tell the Data Protection Commissioner within 72 hours (DPA s.43 · GDPR Art. 33). If the risk to you is high, we will also tell you, or your parent or guardian, without delay.
11. Complaints
Please talk to us first at info@shulepoa.com. You also have the right to complain to the Office of the Data Protection Commissioner (Kenya), at www.odpc.go.ke. If you live in the European Economic Area, you can also complain to your local data protection authority.
12. Changes to this notice
If we change how we use your data, we will update this notice and its date. If the change matters, we will ask you, or your parent or guardian, to read and accept it again before you continue learning.