1. Who we are
Somocloud ("Somocloud", "we", "us") is a school management platform built in Nairobi, Kenya. It includes the website at somocloud.org, school portals hosted on somocloud.org and its subdomains, and the Somocloud mobile apps for Android and iOS (together, the "Service").
We handle personal data in line with the Kenya Data Protection Act, 2019 and its regulations, and with other data protection laws that apply where our schools operate.
2. Schools and our role
Most information in Somocloud is entered and managed by a school. For that information:
- The school is the data controller. It decides which learner, parent and staff records to keep and who can see them.
- Somocloud is the data processor. We store and process that information on the school's behalf, only to provide the Service, and under the school's instructions.
If you are a parent, learner or staff member and want to access, correct or delete school records, please contact your school first. We will help the school respond to your request.
Somocloud is the data controller for information we collect directly, such as demo requests from our website and enquiries sent to our support team.
3. Information we collect
| Category | Examples |
|---|---|
| Account details | Name, phone number, email address, role (teacher, principal, bursar, parent, learner), school, and a securely hashed password or one-time login code. |
| Learner records | Name, admission number, UPI/NEMIS number, class and stream, date of birth, gender, guardian links, attendance, assessment marks, grades and report cards. |
| Staff records | Name, contact details, TSC or staff number, subjects and classes taught, and duties assigned by the school. |
| Fees and payments | Fee structures, invoices, balances, receipts, and M-Pesa transaction details (such as transaction code, amount, time, payer name and phone number) used to match payments to learner accounts. We do not collect or store M-Pesa PINs or bank card numbers. |
| Content you create | Lesson plans, schemes of work, assessments, notes, messages, uploaded files and school website content. |
| Communications | Messages you send us through WhatsApp, email, phone or our demo form (school name, contact name, phone, email, role, school level and county/town). |
| Technical data | IP address, device and browser type, app version, login times, and security and error logs. |
4. How we use information
- To provide the Service: markbooks, report cards, fee collection and reconciliation, parent portals, timetables, government returns (such as KEMIS/NEMIS exports) and analytics for the school.
- To sign you in, keep your account secure and prevent fraud or misuse.
- To send service messages, such as one-time login codes, fee receipts, report card notices and important account updates.
- To respond to support requests and demo enquiries.
- To maintain, troubleshoot and improve the Service.
- To meet our legal obligations.
We do not sell personal information, we do not show advertising in the Service, and we do not use learner data to build marketing profiles.
5. Children's information
Somocloud is used by schools, so it holds information about learners who are children. Learner records are created and controlled by the school, which is responsible for obtaining any parental consent required by law. Learner accounts, where a school enables them, are limited to the learner's own school information.
The Somocloud mobile app is designed for school staff and parents. It is not directed at children, and we do not knowingly collect information directly from children outside the school's use of the Service.
6. How we share information
We share personal information only as needed to run the Service:
- Within your school. Users see information according to the role and permissions the school gives them. For example, a parent sees only their own children's records.
- Payment providers. Safaricom (M-Pesa) and partner banks, to receive fee payments and confirm transactions.
- Messaging providers. Email, SMS and WhatsApp (Meta) providers, to deliver login codes, receipts and notifications.
- AI providers. Some Data Bank features use an AI service (currently Mistral AI) to adapt teaching resources. We send only the teaching content needed for the request, not learner records.
- Hosting and infrastructure. Cloud server and backup providers that store data for us under confidentiality and security obligations.
- Government reporting. When a school chooses to export or submit returns (such as KEMIS or NEMIS), the school controls that submission.
- Legal reasons. When required by law, court order or a lawful request from authorities, or to protect the safety of users.
Some providers may process data outside Kenya. Where that happens, we take steps required by the Data Protection Act to make sure the data stays protected.
7. Mobile app
The Somocloud app for Android and iOS:
- Uses internet and network-state access to sync with your school's account and to work offline when your connection drops.
- Stores a copy of the data you need (such as class lists and marks you have entered) on your device so you can keep working offline. Marks that have not yet synced stay on the device, linked to your account, so they are not lost and can sync the next time you sign in. Uninstalling the app or clearing its storage removes all of this data from the device.
- Stores your sign-in token in your device's secure storage (Android Keystore / iOS Keychain).
- Lets you share files, such as report cards or receipts, only when you tap Share.
- Does not access your location, contacts, camera, microphone or photos, and contains no advertising or third-party tracking SDKs.
Data sent between the app and our servers is encrypted in transit using HTTPS (TLS).
8. Security
We protect information with encryption in transit (HTTPS), hashed passwords, encryption of sensitive credentials such as payment integration keys, role-based access control, audit logs of key actions, and regular backups. No system is perfectly secure, so please keep your password private and tell us right away if you think your account has been misused.
9. How long we keep information
We keep school records for as long as the school has an active Somocloud account, or as long as the school instructs us. Financial records may be kept longer where the law requires it. When a school leaves Somocloud, we can export its data and then delete or anonymise it within 90 days, except where we must keep it by law. Backups are overwritten on a rolling schedule.
Demo requests and support messages are kept for up to two years, unless you ask us to delete them sooner.
10. Your rights
Under the Kenya Data Protection Act, 2019 you have the right to:
- be told how your personal data is used;
- access your personal data;
- ask for incorrect or misleading data to be corrected;
- ask for data to be deleted;
- object to processing; and
- receive your data in a portable format.
For school records, send your request to your school or to us and we will work with the school. We aim to respond within 7 working days. You may also complain to the Office of the Data Protection Commissioner.
11. Delete your account
You can ask us to delete your Somocloud account and its associated personal data at any time:
- Email somocloudafrica@gmail.com with the subject "Account deletion request", or
- WhatsApp +254 748 818 188.
Please include your full name, your school, and the phone number or email on the account. We will confirm your identity and delete your account within 30 days. Your school may keep certain records it is legally required to hold (for example, academic results and fee receipts), but your login access and personal profile will be removed.
12. Cookies
Our website and web portal use essential cookies to keep you signed in, protect forms against forgery (CSRF), and remember basic preferences. We do not use advertising cookies.
13. Changes to this policy
We may update this policy as the Service changes. We will post the new version on this page and update the "Last updated" date. If changes are significant, we will notify schools or show a notice in the Service.
14. Contact us
Questions or requests about privacy:
- Email: somocloudafrica@gmail.com
- WhatsApp / Call: +254 748 818 188
- Location: Nairobi, Kenya