Privacy
What we know about you, and why.
Last updated
Shule Yangu holds a school’s records so that the school can run itself and parents can see their own children. This page says what that involves in plain language. It is written under Kenya’s Data Protection Act, 2019.
The short version. Your school is in charge of its own records; we keep them for the school. We do not sell data, we do not run advertising, and we do not track you across other websites. One cookie keeps you signed in. Nothing else is set.
Who is responsible
Shule Yangu is operated by RelaTax. Under the Act, the school that enrols a learner is the data controller for that learner’s record — it decides what is recorded and who may see it. RelaTax is the data processor: we store and process those records on the school’s instructions, and we are the controller only for the accounts people use to sign in and for messages sent to us directly.
For anything on this page: info@relatax.org or +254 115 581 898.
What is recorded
Only what a school needs to run, and only when the school enters it or a parent gives it.
| About | What | Why |
|---|---|---|
| Learners | Name, admission number, date of birth, grade and class, the guardian they belong to, CBC assessment results and report cards, fee notes and payments. | Enrolment, teaching, reporting to parents, and knowing what is owed. |
| Parents and guardians | Name, phone number, email if given, which children are theirs, how they prefer to be contacted, and a PIN for the parent portal. | So the school can reach you, and so you — and only you — can see your child. |
| Staff | Name, work email, phone, role, which classes and learning areas they teach, and a password. | Signing in, and knowing who recorded what. |
| The school | Name, address, contacts, crest, bank and paybill details, fee structure, terms and calendar. | Fee notes, receipts and report cards carry the school’s own details. |
| Payments | Amount, date, the M-Pesa receipt or bank reference, the admission number quoted, and the paying phone number where M-Pesa sends it. | Matching money to the right child and issuing a receipt. We never hold the money itself — it goes to the school’s own account. |
| Activity | An audit trail of who changed what and when, and the address a sign-in came from. | So a school can answer “who altered this mark?” and so we can stop password guessing. |
Cookies and storage on your device
One cookie, shule_session, keeps you signed in. It is set only when you sign in, cannot be read by scripts, and is deleted when you sign out. There are no advertising cookies, no analytics cookies, and no third-party cookies of any kind.
The parent app remembers two small things in your browser’s own storage: that you dismissed the “add to home screen” offer, and that you have seen the notice about this page. It also caches the app’s own files so it opens without a signal. None of that leaves your device.
Messages we send
Schools send fee notes, receipts, results notices and announcements to parents through Shule Yangu. Depending on what the school has set up, those go by email, SMS, WhatsApp, or as a notification in the parent app. Reply STOP to any WhatsApp message to stop receiving them that way; you can also change your preference in the portal. Notifications to the installed app are encrypted so that the push service that delivers them cannot read them.
Who else sees it
Nobody sees a school’s records except the school and the people it authorises. Where a service outside Shule Yangu is involved, it is one of these, and only for the purpose stated:
- Safaricom (M-Pesa) — when a school turns on M-Pesa, payment confirmations arrive from Safaricom and, if a parent asks for a payment prompt, their phone number and the amount are sent to Safaricom to raise it.
- Meta (WhatsApp) — when a school sends WhatsApp messages, the recipient’s number and the message go through WhatsApp’s business service.
- Google — only if a member of staff chooses to sign in with a Google account; Google tells us the email address and nothing else is shared with Google.
- Our hosting provider — the servers the service runs on. They hold the data on our behalf and cannot use it.
- RelaTax — a platform administrator may open a school’s workspace to support it. Every such access is recorded in that school’s audit trail, visible to the school.
We do not sell, rent or trade any of it, and we do not use it to build profiles or to advertise.
How long it is kept
A school’s records are kept for as long as the school uses Shule Yangu, because a school needs last year’s results and receipts as much as this year’s. When a learner leaves, the school marks them as left and their record is kept with the school’s archive; when a member of staff or a parent leaves, the school deactivates their account and they can no longer sign in. When a school stops using the service, its records are returned to it on request and then deleted from our systems, including from backups as those expire. Backups are taken weekly and kept for eight weeks.
How it is protected
- Everything travels over HTTPS; a plain HTTP request is turned away.
- Passwords and PINs are stored hashed, never in a form we or anyone else can read back.
- Every school’s data is separated from every other school’s at the database level, and a person can only ever reach the school they belong to.
- Sign-in attempts are limited, so a password or PIN cannot be guessed by a machine.
- Keys the school gives us — its M-Pesa credentials, for instance — are encrypted at rest and never shown back on any screen.
Your rights
The Act gives you the right to know what is held about you, to have it corrected, to have it deleted where there is no longer a reason to keep it, to object to how it is used, and to complain to the Office of the Data Protection Commissioner.
Because the school controls learner and family records, the quickest route is usually the school office — a parent can see their own child’s record in the portal at any time. If the school cannot help, or your request is about RelaTax itself, write to info@relatax.org. We answer within thirty days, and sooner where we can.
Children
Learners are children, and most of what Shule Yangu holds is about them. Their records are entered by the school under its own duty of care, never collected from the child directly, and shown only to the school and to the child’s own guardians. We do not contact learners.
Changes to this page
When the product changes in a way that affects what is collected or who sees it, this page changes with it and the date at the top moves. A change that matters — a new third party, a new use of data — is also announced to the schools we serve before it takes effect.
See also the terms of service.