Website Spark conversations
When you message Spark, we save the full conversation, action status, and coarse browser family, device category, language, time zone and entry page for 90 days from the start of the conversation. A first-party HttpOnly session cookie lets this browser resume it. Authorized Schoolbooks support administrators can review these conversations, including those without a contact request. We do not use browser fingerprinting for chat continuity.
Messages and relevant conversation context are processed by OpenAI to provide AI assistance. Our application disables response storage and tracing for this flow; provider abuse-monitoring and retention policies still apply. Only reviewed public product articles enter the product search index. Avoid sharing passwords or private school, student or financial records in website chat.
Sending a team request or reserving a demo requires your confirmation. A confirmed request shares your conversation and contact details with our team. A confirmed demo shares your name, email and selected time with Google Calendar. Clear history removes the saved browser conversation; it does not retract a sent inquiry, cancel a calendar event or delete records separately retained for those purposes.
1) Who we are
This Privacy Policy explains how Schoolbooks Accounting (“Schoolbooks,” “we,” “us,” “our”) collects, uses, discloses, and protects personal data in connection with our website and cloud services (the “Services”). It applies to website visitors, customers and their authorized users, individuals who engage with our marketing, and job applicants.
We process personal data in line with the Data Protection Act, 2019 (Kenya) and the Data Protection (General) Regulations, 2021. Where schools use our Services, the school is typically the data controller and Schoolbooks is a data processor. In those cases, our processing is governed by our agreements with the school (the controller’s privacy policy applies to their data subjects).
2) Personal data
“Personal data” means information relating to an identified or identifiable natural person (e.g., a teacher, guardian, student, or staff member). “Sensitive personal data” includes information such as health data or official identifiers, which we handle with additional safeguards where applicable under Kenyan law.
3) Our role vs. your school’s role
- Controller (Schools): When a school uses our Services, the school decides the purposes and means of processing its community’s data (students, guardians, staff). The school’s privacy policy governs that processing.
- Processor (Schoolbooks): We process personal data on the school’s instructions, implement appropriate security, and support the school in meeting its obligations (e.g., responding to access/correction requests) as set out in our agreement.
4) Personal data we collect
- Registration/contact details (name, email, phone, role) when creating an account.
- Operational data entered into the system (e.g., fee records, invoices, attendance, inventory, payroll inputs, documents, e-signatures, uploads/attachments).
- Support/communications data (messages, feedback, attachments).
- Recruitment data for job applicants (CV, education/employment history, references).
4.1 Data you provide
- Registration/contact details (name, email, phone, role) when creating an account.
- Operational data entered into the system (e.g., fee records, invoices, attendance, inventory, payroll inputs, documents, e-signatures, uploads/attachments).
- Support/communications data (messages, feedback, attachments).
- Recruitment data for job applicants (CV, education/employment history, references).
4.2 Data collected automatically
- Device and log data (IP address, browser type, OS, device identifiers, pages viewed, timestamps).
- Usage/telemetry data to improve performance, security, and usability.
- Cookies and similar technologies (see our Cookie Policy for details and choices).
4.3 Data from third parties
- Integrations you enable (e.g., M-PESA, card processors, SMS/email gateways, calendar or SSO providers).
- Bank feeds or payment confirmations via authorized providers where enabled.
5) How we use personal data
- Provide, secure, maintain, and improve the Services.
- Configure accounts, authenticate users, and personalize experiences.
- Process school operations (fees/invoicing, collections, accounting, attendance, documents/e-signatures, communications).
- Monitor performance, debug issues, prevent fraud/abuse, and enhance security.
- Provide support, respond to requests, and send service notices.
- Generate de-identified/aggregated insights (never to re-identify individuals).
- Comply with legal obligations (e.g., tax, financial record-keeping) and enforce our Terms.
- With consent or as permitted by law, send product updates or marketing (you can opt out at any time).
5) Lawful bases under the DPA 2019
Lawful bases under the DPA 2019 may include consent, performance of a contract, compliance with a legal obligation, or our/your school’s legitimate interests balanced against data subject rights.
6) Students & children’s data
We recognise the heightened protection applicable to children’s data (see the Children Act, 2022 (Kenya) and the DPA 2019). Where a school inputs student data, the school is the controller and determines the lawful basis (e.g., a statutory mandate under the Basic Education Act, public interest, parental/guardian consent, or legitimate interests with appropriate safeguards).
- We process student data only on the school’s documented instructions.
- We implement appropriate technical and organisational measures to protect student data.
- We do not use student data for advertising, profiling unrelated to education, or sell student data.
- Where consent is used, the school is responsible for obtaining and managing valid consent from a parent/guardian.
7) How we share personal data
- Service providers and subprocessors for hosting, storage, email/SMS, telephony, analytics, payments, identity/SSO, and support tooling—bound by contracts and confidentiality.
- Integrations you enable: e.g., M-PESA, card processors, bank APIs, SMS gateways, SSO (shared as needed to provide the feature).
- Affiliates for support and platform operations under equivalent protections.
- Legal responses to required authorities or lawful requests.
- Business transfers during a merger, acquisition, or reorganisation under appropriate safeguards.
- With consent where you or your school explicitly agree.
- We do not sell personal data.
- We do not share student data for advertising purposes.
8) International data transfers
The Services may be hosted or supported from locations outside Kenya. Where we transfer personal data across borders, we implement appropriate safeguards consistent with the Data Protection Act, 2019 and Regulations (e.g., contractual clauses, adequacy determinations, or other lawful mechanisms). Details can be provided on request.
9) Security
We employ administrative, technical, and physical controls designed to protect personal data (e.g., encryption in transit, access controls, logging). No system is 100% secure; we continually improve our safeguards and expect customers to maintain good security practices (e.g., strong passwords, MFA, role-based access).
10) Retention
We retain personal data for as long as necessary to provide the Services, comply with legal obligations (including financial/tax record rules), resolve disputes, and enforce agreements. Schools may set their own retention policies; when we act as processor, we follow the school’s instructions and our agreement.
11) Your privacy rights (Kenya)
Under the DPA 2019 and applicable Regulations, data subjects may have rights to:
If your data is processed for a school, please contact the school (controller) first. Where we are controller (e.g., for our own website, billing, or marketing), contact hello@schoolbooks.ke. We may take steps to verify your identity before acting on a request.
You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya. We encourage you to contact us first so we can address your concerns.
- be informed about the use of their personal data;
- access their personal data;
- request correction/rectification or deletion where appropriate;
- object to or restrict certain processing;
- data portability where applicable;
- withdraw consent where processing is based on consent.
12) Cookies & similar technologies
We use cookies and similar technologies for authentication, performance, analytics, and security. You can manage preferences through your browser or our Cookie controls where available. See our Cookie Policy for details.
13) Marketing communications
You can unsubscribe from promotional emails at any time via the link in those emails. We may still send service notices or transactional messages (including password resets, billing notices).
14) Children’s privacy (direct use)
We do not offer accounts directly to children. Student data is provided by the school (controller) and processed by us under the school’s instructions. If you believe a child provided data to us directly, contact hello@schoolbooks.ke.
15) Changes to this Policy
We will post updates to this Policy on this page and indicate the “Last Updated” date. Material changes will be notified through the Services or by email where appropriate.
16) Contact us
For questions or requests about this Policy or our data practices: Email hello@schoolbooks.ke