Skulcard Privacy Policy

Last updated: 11 October 2026

1. Who we are

Skulcard is a school management system operated by Baba Tech Solutions, Kilifi, Kenya ("we", "us"). Each school that uses Skulcard is the data controller of the records it enters: the school decides what is recorded and why. Baba Tech Solutions is the data processor: we store and process those records on the school's behalf and on its instructions. This policy covers the Skulcard website (https://skulcard.com) and the Skulcard Android app.

2. Who uses Skulcard

Accounts are created by schools, not by self-signup. Users are school administrators, teachers and bursars and, where a school enables it, students and parents/guardians. Children cannot sign up on their own.

3. What data is held

Depending on how a school uses Skulcard:

• Accounts: name, email or username, phone number, role, school, and last login time. Passwords are stored only as a one-way hash; we cannot see them.
• Learners: name, admission number, class and stream, gender, date of birth, boarding status, residence, county and home address, photo, parent/guardian name, phone numbers and email, and, where the school records them, identifiers such as UPI, birth certificate number, assessment number and KCPE details; graduation details.
• Staff: name, phone, email, TSC number, national ID number, gender, photo and signature image.
• Academic data: exam results, marks, grades, subject enrolment, merit lists, report cards, timetables, assignments and learning resources.
• Files uploaded by users: the school logo and stamp, teacher photos and signatures, assignment and resource files, and spreadsheets used for bulk import.
• Messages: results and other SMS sent through Skulcard (section 5) and password-reset emails (section 7).
• Technical logs: IP address, browser/device information and requested pages (web server logs, kept about 14 days), and error logs kept by the application.
• Sessions: a sign-in session (a cookie) that lasts up to 24 hours.

4. The Skulcard Android app

• The app uses internet access to talk to Skulcard's servers, over HTTPS.
• After you sign in, the app stores your login token and a cached copy of your user profile in the app's private storage on your phone, so that you stay signed in. Signing out ends the session.
• The app opens the photo gallery or file picker only when you choose to upload a photo or a file (for example a profile photo or a spreadsheet).
• The app does not include advertising or third-party analytics.

5. Results SMS (optional)

A school can send results and other notices to parents/guardians by SMS. Only when a school user chooses to send, the recipient's phone number, the message text (which can include the learner's short name, class and results) and the sender name are sent to our SMS provider, TalkSasa, which delivers the message. We keep a record of each message (recipient, text, status and cost in SMS credits) for the school's own records. Schools pay for SMS credits, which can be bought through M-Pesa (section 6). Nothing is sent to parents unless a school user sends it.

6. M-Pesa and school fees (optional)

• Fees and payments are an optional feature that is off unless a school is enabled. A school may record fee payments, keep ledgers and issue receipts, and may connect its own Safaricom paybill so that M-Pesa payments are recorded automatically. For these we keep the amount, the M-Pesa transaction code, the date, the account number typed by the payer, the payer's phone number masked (only the last three characters are kept), and the learner the payment is matched to.
• Buying SMS credits: when a school buys SMS credits by M-Pesa, we keep the amount, the phone number used and the M-Pesa receipt number.
• We do not store M-Pesa PINs and we do not store card data. The PIN is entered on your phone and is handled by Safaricom.
• Payment details are shared with Safaricom only as needed to take or confirm a payment. A school's Safaricom API keys are stored encrypted.

7. Email

Password-reset codes are sent by email through our email delivery service, Mailgun. The email address and the code are passed to that service only to deliver the message.

8. How we use data

Only to run the school system: keep records, record and report results, produce report cards, merit lists and timetables, send the messages a school chooses to send, record fees where enabled, keep the service secure, and fix faults. We do not sell or rent personal data, we show no advertising, and we do not use data for marketing or profiling.

9. Children

Learner records are entered by schools, not by the children. Children do not sign up on their own and we do not collect data directly from children. Records are used only for the school's own academic administration. Only authorised school users, and where a school enables it the learner's own account or guardian, can see a learner's data.

Learner accounts are created by schools, not by the children. A child may sign in on a parent's or teacher's device; when using a shared device, sign out when finished.

10. Who can see data

Access is by role and separated by school: a school's users see only that school's data; teachers see their assigned classes and subjects; parents and students, where enabled, see their own records. Baba Tech Solutions staff access data only to give support, fix faults or maintain the system.

11. Where data is stored, and transfers outside Kenya

Skulcard runs on servers of DigitalOcean in London, United Kingdom, so data is stored and processed outside Kenya. Our service providers may process data outside Kenya under agreements that protect it. We protect data with HTTPS connections, hashed passwords, role-based access and separation between schools.

12. Backups

• Every night at 23:00 UTC (02:00 Kenya time) an automatic backup of the database is made and kept on the same server, in a folder that only the system administrator can read. The last 7 days are kept; older backups are deleted automatically.
• Uploaded files (logos, stamps, photos, signatures, documents) are not part of the nightly database backup.
• Before a software change we sometimes take an extra copy of the database or of the records affected. These extra copies, and the "undo" files made before a permanent deletion (section 13), are kept in restricted folders for up to 30 days and then deleted.
• Because of this, data that has been deleted can remain in backups for a short time: up to about 8 days in the nightly backups, and up to 30 days in the extra copies and undo files.

13. How long we keep data, and deletion

• Data is kept while the school's account is active, so records (for example a learner's results history) stay available.
• A learner removed by a school user is first hidden: the record stays in the database so that it can be restored.
• Permanent deletion: on a school's request we can permanently delete a class or cohort of learners together with their results, marks, fee and SMS records and their login accounts. Before doing this we write a restricted "undo" file in case the deletion was a mistake; that file is deleted within 30 days.
• Graduated learners are kept as an archive for the school until the school asks for their deletion.
• When a school stops using Skulcard it can ask us to delete all of its data (see "Delete your account or data" below).
• Web server logs are kept for about 14 days.

14. Your rights (Kenya Data Protection Act, 2019)

You have the right to be told how your data is used; to access it; to ask for correction of wrong data; to ask for deletion of data we no longer need to keep; to object to or restrict its processing; and to receive a copy of your data. Because the school is the data controller, you can ask your school first (the administrator can correct or remove most records directly), or write to us directly at the address in section 18. We will reply and confirm what we did.

If you are not satisfied, you may complain to the Office of the Data Protection Commissioner (ODPC) of Kenya: www.odpc.go.ke.

15. Delete your account or data

Skulcard accounts are created by schools, so you can also ask your school administrator to remove your account or a learner's record. To ask us directly:

1. Send an email to mutuamwilu@gmail.com from the email address of the account, so that we can confirm it is you.
2. Give your full name, your school, your role, and what you want removed (your account, a learner's record, a class, or all of the school's data).
3. We will check the request with the school where the data belongs to the school, carry it out, and reply to confirm, within 30 days.

Deleted data may remain in backups for the periods in section 12.

16. Security

HTTPS connections; hashed passwords; role-based access; each school's data separated from other schools; schools' M-Pesa API keys encrypted; restricted backups; and access by our staff only when needed. No system is perfectly secure. If a breach affecting personal data occurs, we will notify the affected schools and the ODPC as the law requires.

17. Changes to this policy

We will update this page when the system or the law changes, and change the "Last updated" date at the top.

18. Contact

Baba Tech Solutions, Kilifi, Kenya
Email: mutuamwilu@gmail.com