Privacy Policy

1. Who we are

SomaSmart is an AI-powered school management and learning platform operated by Alphawonders ("SomaSmart", "we", "us", "our"). SomaSmart provides software to private schools, international schools, and county education offices in Kenya and the wider East Africa region through the website at somasmart.site.

For most personal data processed through the platform, the school that subscribes to SomaSmart is the data controller — it decides why and how the data of its learners, staff, and parents is processed. SomaSmart acts as a data processor, handling that data only on the school's documented instructions. Where SomaSmart determines its own purposes — for example, managing billing accounts or improving platform security — SomaSmart acts as a controller for that limited data.

2. Scope and legal framework

This policy is written with reference to the Kenya Data Protection Act, 2019 and the regulations issued under it, as overseen by the Office of the Data Protection Commissioner (ODPC). Where a school operates in another East African jurisdiction, the equivalent local data protection law also applies, and the school should adapt this policy accordingly.

3. Personal data we collect

The categories of data processed depend on the role of the person and the modules a school enables:

• Students / learners (including minors): name, admission number, class and stream, date of birth, gender, guardian links, attendance records, assignments and submissions, exam and assessment results, CBC competency grades, report cards, and AI tutor conversation history.
• Teachers / staff: name, email, phone number, staff role, subjects and classes taught, timetable, lesson plans, grading activity, and login records.
• Parents / guardians: name, email, phone number, relationship to learner, fee and invoice records, payment history, and messages exchanged through the parent portal.
• School administrators: name, email, phone number, role and permissions, and audit records of administrative actions.
• Account and billing data: subscription tier, billing contact, KES invoices, and payment references from M-Pesa (Daraja) or Paystack. We do not store full card numbers; card processing is handled by our payment processors.
• Technical data: IP address, device and browser information, authentication tokens, and security logs used to keep accounts safe.

4. Why we process data and our lawful basis

Under the Data Protection Act, 2019, we rely on the following lawful bases:

• Performance of a contract — to deliver the platform and its features to the school and its users.
• Consent — where required, for example before optional communications; for children's data, consent is obtained and managed by the school and the parent/guardian.
• Legal obligation — to meet record-keeping, tax, and regulatory requirements.
• Legitimate interests — to secure the platform, prevent fraud and abuse, and improve reliability, balanced against the rights of data subjects.

Children's data. Learner data frequently relates to minors. SomaSmart processes it strictly on the school's instructions and applies additional care as required by the Act. Schools are responsible for obtaining and recording any parental consent needed under Kenyan law.

5. How we share data

We share personal data only as necessary to run the service, with:

• AI providers — OpenAI, Anthropic (Claude), and Groq, and self-hosted models where used, to power AI tutoring, lesson planning, quiz generation, and grading assistance. Prompts may include learner-generated content; we route requests to deliver the requested feature and do not authorise these providers to train foundation models on school data beyond what their terms permit for service delivery.
• Payment processors — Safaricom M-Pesa via the Daraja API and Paystack, to process KES subscription payments and school fees.
• SMS and messaging — Africa's Talking, to send bulk SMS notifications to parents and staff.
• Infrastructure and error monitoring — cloud hosting and error-tracking (Sentry) providers that keep the service running and secure.
• Authorities — where we are required to disclose data by law or valid legal process.

We do not sell personal data. Each of these recipients acts as a sub-processor and is bound by contractual confidentiality and security obligations.

6. Data residency and international transfers

We seek to store and process school data in a manner consistent with Kenyan data residency expectations. Some sub-processors (for example, certain AI and infrastructure providers) may process data outside Kenya. Where that happens, we rely on appropriate safeguards permitted under the Data Protection Act, 2019 — such as contractual protections and adequacy assessments — and process such transfers only to the extent necessary to provide the service.

7. Data retention

We retain personal data for as long as the school's subscription is active and as needed to provide the service, then in line with the school's instructions and applicable legal retention periods (for example, academic and financial records). On termination, we return or delete school data as set out in our agreement with the school, subject to any legal obligation to retain certain records.

8. Security

We apply technical and organisational measures appropriate to the risk, including:

• encryption of data in transit (TLS/HTTPS);
• hashed and salted passwords (bcrypt) and JWT-based authentication with token blacklisting;
• role-based access control and multi-tenant isolation by school;
• rate limiting, audit logging, and error monitoring;
• least-privilege access for our staff and sub-processors.

No system is perfectly secure, but we work continuously to protect the data entrusted to us.

9. Your rights

Under the Data Protection Act, 2019, data subjects have the right to:

• be informed of how their data is used;
• access their personal data;
• request correction of inaccurate or incomplete data;
• request deletion of their data where the law allows;
• object to or restrict certain processing;
• data portability where applicable;
• lodge a complaint with the ODPC.

Because the school is the data controller, requests from learners, parents, or staff are usually made to the school, which we support as processor. You may contact your school directly, or reach us using the details below and we will route your request appropriately.

10. Changes to this policy

We may update this policy from time to time. Material changes will be communicated to subscribing schools, and the "Last updated" date above will change. Continued use of the platform after an update constitutes acceptance of the revised policy.

11. Contact us

For privacy questions, or to exercise your rights, contact Alphawonders, the operator of SomaSmart:

Alphawonders
Concert House, Wood Garden Rd, Kilimani, Nairobi
Mon-Fri 8AM-5PM · Sat 9AM-1PM
Email: info@alphawonders.com
Web: somasmart.site

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya.