Privacy Policy

# SomaSkul Privacy Policy

Version 1.4 Effective date: 2026-11-10 Last updated: 2026-11-10

## 1. Who operates SomaSkul

SomaSkul ("SomaSkul," "we," "us") is a study app for Kenyan secondary students, built around the CBC and KCSE curricula. SomaSkul is operated by Michael Sirari Wambani, a sole proprietor trading as SomaSkul, of Mlango Soko, Naivasha Road, Kenya. He is the data controller for the personal information described in this policy. Contact: [email protected].

## 2. Scope

This policy covers the SomaSkul mobile app, the SomaSkul payment page on our website, and the SomaSkul server they talk to. It does not cover SomaSkul's internal administration console, which only SomaSkul staff use.

## 3. Information you give us

### 3.1 Parents and guardians

A parent or guardian creates the family account. They give us:

• Their phone number. This identifies the account. We send a one-time code to it

by SMS when the account is created and when it is used on a new device. We also send one SMS about two days before each student's free trial ends, with the student's first name and where to pay.

• Their name (optional).
• **Agreement to our Terms and this Privacy Policy, and consent for each child they

add.** We record which versions were agreed to and when.

• A referral code or phone number of the parent who invited them, if they choose

to enter one.

• Feedback they send us in reply to a message from the SomaSkul team in the app's

Messages inbox (§5). Please do not include PINs, codes or other children's details.

• Why they are leaving (optional). When a parent deletes their account or removes a

child, or a student deletes their own account, the app asks which reasons apply, as tick boxes. Skipping it changes nothing. We keep only the reasons ticked, the class levels of the children, and roughly how long the account had been open. We do not keep a name, a phone number, an account number or anything typed, so an answer cannot be traced back to a person. We use the answers to improve SomaSkul.

### 3.2 Students

A parent adds each student. For each student the parent gives us:

• The student's name.
• The student's date of birth. We use it to check the student is old enough for

SomaSkul (§9) and to avoid creating the same student twice.

• Curriculum and class level, so SomaSkul shows the right notes and questions.
• A 4-digit PIN the student uses to open their own profile. Students do not get

SMS codes and do not need their own phone number.

We do not ask for an email address or a school name.

### 3.3 Content you submit while studying

• Photos of homework questions or report cards, taken with the camera or chosen

from the phone, so SomaSkul's AI can read them. We do not store these photos. They are sent to our AI provider (Anthropic, §6) to produce an answer and are not saved in any SomaSkul database.

• Messages you type to ZANA, SomaSkul's AI tutor (§4 explains what happens to them).
• Exam results you choose to enter in Performance Analysis. After the AI reads a

photo of a report card, you must confirm the results are correct before anything is saved. Results you do not confirm are never saved.

## 4. Information created while you use SomaSkul

• A device identifier created by the app (not your phone's hardware ID), used to

stop abuse of free trials and referral rewards.

• Study activity: questions answered, scores, flashcard reviews, topics mastered,

study goals and plans, so your progress is kept and can be shown to your parent (§9).

• ZANA session summaries: the subject and topic of a tutoring session.
• Which parts of the app a student uses. For each day, the app counts how many times

a student opened each feature (for example flashcards, past papers, ZANA or mock exams). Only the feature's name, the date and the count are sent to our server: not what was on the screen, not what the student typed, and not the time of day. We use these counts to know which features are working for families and to choose which messages to send a parent (§5). They are not counted for the parent's own screens.

• A notification token, if you allow notifications, so we can send reminders and

alerts to the phone.

• Crash reports. If the app crashes or hits certain errors, it sends a crash report

to Google's Firebase Crashlytics: what went wrong in the code, the phone model, Android version, app version, a Firebase install identifier, and SomaSkul's internal account number. Phone numbers, names, messages to ZANA and photos are removed or never included. We use these reports only to fix bugs.

• How the app is used (analytics). The app tells Google's Firebase Analytics which

screens are opened and when certain things happen in the app (for example: sign-up was completed, a note or ZANA was opened, a mock exam was started or finished), with simple labels such as the subject, the curriculum or the class level. It also sends the phone model, Android version, app version, a Firebase app-instance identifier and SomaSkul's internal account number. It never sends names, phone numbers, anything typed to ZANA, answers, or photos, and SomaSkul does not collect the phone's advertising ID. We use this only to learn which parts of SomaSkul help students and to improve them, never for advertising. Google keeps this data for 2 months.

• Your ZANA conversation history is stored on your phone, not on our servers. To

answer a message, the app sends that message and your recent conversation (up to the last 20 messages) to our server. Our server passes the latest few of them to our AI provider to write the reply, and does not keep a copy of the conversation. The exceptions are the short question excerpts described in §7. If you uninstall the app or clear its storage, the history on your phone is gone and we cannot recover it.

## 5. How we use your information

• To create and run the family account and each student's profile.
• To show notes and questions for the student's curriculum and class.
• To run ZANA, homework help from photos, flashcards, practice and mock exams.
• To show a parent their children's progress and send them study alerts.
• To send parents messages from the SomaSkul team in the app's Messages inbox, and, if

notifications are allowed, on the phone: news about fixes and new features, and requests for feedback. A message can name the parent and their children by first name, and may go only to parents whose children use (or have not yet tried) a feature. These messages never advertise other companies. Parents can reply, and we read the replies to improve SomaSkul.

• To take payments and turn on the plan that was paid for.
• To keep a student's progress in sync if they use more than one phone.
• To stop abuse of trials, referrals and payments.
• To keep the app working and improve it, including counting which screens and features

are used (§4).

We do not use your information for advertising, do not sell it, and do not share it with data brokers. The app contains no advertising code.

## 6. AI processing — ZANA, homework help and other AI features

ZANA is an AI, not a human teacher. ZANA and SomaSkul's other AI features use Anthropic's Claude models. Many answers come from SomaSkul's own notes stored on your phone and never leave it. When ZANA needs the AI:

• Your question, your recent conversation, matching SomaSkul notes, and any photo you

attach are sent through our server to Anthropic to produce the reply.

• We also send the student's curriculum and class level, and, if the student has set

a study goal, that goal and their progress towards it, so ZANA can teach at the right level. We do not send the student's name, phone number, or account number.

• A photo can still show a name. If you photograph a report card or homework page

with a name printed on it, Anthropic can see that name in the picture. SomaSkul does not crop or blur names in photos.

• Anthropic does not use this content to train its models. Under Anthropic's terms

for business customers, inputs and outputs are not used for training unless the customer opts in or sends feedback, and SomaSkul does neither. Anthropic deletes them within 30 days, except where it must keep them longer to enforce its usage policy or to comply with the law.

• Anthropic processes this data outside Kenya. We send only what each answer needs

(listed above), and Anthropic's business terms require it to keep the data secure and use it only to provide its service to SomaSkul.

SomaSkul does not currently send any of your questions to a web-search service. If we start, we will update this policy first.

See the AI & Educational Content Disclaimer for the limits of AI answers.

## 7. What SomaSkul keeps from AI conversations

ZANA learns from a small sample of good answers so it can help future students. This runs in the background and never slows you down.

• What is saved is a short study note (a definition, an example, common mistakes),

and only after a second check confirms it is accurate.

• The question that led to the note (up to about 2,000 characters) is saved with it

so our team can check the note later. It is saved in a shared table with no link to the student's name or account, but it could still contain anything the student typed. These excerpts are kept with the note and are not deleted automatically today. See the Data Retention Policy.

### 7.1 Reports of AI answers

Next to every AI answer there is a Report link. If you tap it and choose a reason, we receive the reason, where the answer appeared in the app, and the text of the AI answer you reported (up to about 1,500 characters). We do not receive your name, phone number or account details, and a report is not linked to your account. We use reports to find and fix wrong or unsuitable answers. Reports are not deleted automatically today.

### 7.2 Questions our notes did not cover

When a student asks ZANA something our study notes do not cover, we may keep a short example of the question (up to about 200 characters) with the subject, topic and class it was about, so a teacher can write a note that answers it. Before it is saved we remove phone numbers, email addresses, links and names we can recognise. It is not linked to the student's name or account, but it is still what the student typed, so please do not put personal details in a question. A teacher reads each example, writes the answer, and checks it before anyone sees it; the note then reaches every student's phone and later students can be answered without going online. We keep at most a few examples per topic, and we delete them after 90 days or as soon as a note has been written from them. We do not keep photos, follow-up messages or conversations this way.

### 7.3 How practice questions are doing

When a student answers a practice question, the app counts, for that question (not the student): how many times it was shown, answered correctly, answered after a hint, and answered wrongly by a student who said they were sure. We use these counts to find questions that are wrong, too easy or confusing and to improve them. The counts are sent without the student's name, account, phone number or answers, and cannot be traced back to a student.

## 8. Payments

Payments are made on SomaSkul's website, not inside the app. A parent pays for each student they want to cover.

• Payments are processed by Paystack, which accepts M-Pesa, Airtel Money and cards.

You enter your M-Pesa number or card details on Paystack's own page; SomaSkul never sees or stores card numbers or M-Pesa PINs.

• To start a payment we send Paystack the amount and a SomaSkul account reference. We do

not send Paystack your name or phone number.

• A plan is only turned on after Paystack confirms the payment to our server, never

because the app or a web page says it was paid.

• We keep a record of each payment (Paystack reference, amount, plan, and which students

it covered) for accounting and to resolve disputes, including after an account is deleted (§12).

## 9. Children and parents

SomaSkul is for students aged 13 and over. Students do not sign themselves up:

• A parent or guardian creates the account, adds each student, and gives consent

for them. We record that consent.

• We refuse to add a student whose date of birth shows they are under 13. We do not

independently verify the date of birth a parent gives.

• Students cannot make payments, and the app does not show students plans or prices.
• Parents can see their child's progress: topics they are doing well or struggling

with, study-plan activity, and alerts. Parents do not see the child's ZANA conversations, which stay on the phone (§4).

If you are a parent or guardian and want your child's information reviewed or removed, see §13 and §14.

## 10. Who we share information with

SomaSkul shares information only with these service providers, and only for the reasons given:

We may also share information if the law requires it, or to protect SomaSkul, its users or the public.

Where your information is stored. SomaSkul's server and its Supabase database are both in data centres in Frankfurt, Germany. The other providers above process what they receive in their own facilities, some of which are outside Kenya.

SomaSkul does not sell personal information and does not share it with advertisers or data brokers.

## 11. Data security

SomaSkul restricts database access with row-level security, so one student's data cannot be read by another student, and our server lets parents see only their own children. A payment can only be confirmed by Paystack on our server, never by the app. All traffic between the app, our server and our providers is encrypted (HTTPS).

No method of transmission or storage is 100% secure, and SomaSkul cannot guarantee absolute security.

## 12. Data retention

We keep your information for as long as your account is active. When an account is deleted (see §13), the personal data attached to it is removed or scrubbed.

Two deliberate exceptions, both kept because the law or the record requires it:

• Payment records are kept after account deletion, as financial records must be.
• Parent/guardian consent records are permanent and cannot be edited or deleted. A

consent record has to outlive the processing it authorised, otherwise it is not evidence.

A report of an AI answer (§7.1) is not linked to an account, so deleting an account does not remove it. Example questions (§7.2) are deleted after 90 days or when a note is written from them, and practice question counts (§7.3) are not linked to any account.

SomaSkul does not currently delete most other categories on a fixed schedule — data is kept while the account exists. See the Data Retention Policy for each category.

## 13. Account and data deletion

You can delete your account from inside the app, on the Account page (a student: Profile, then Help, privacy & account; a parent: Account & settings, then Privacy, terms & account). A parent can remove a student from the family dashboard. Deleting removes or scrubs the personal data attached to the account, except the two exceptions in §12. This includes a parent's messages from us and any feedback they sent, and a student's feature-use counts. The "why are you leaving" answers in §3.1 are not linked to the account, so deleting the account does not remove them, and they cannot be matched to you.

You can also email [email protected] (see §14) to ask for a copy of your data, a correction, or deletion, and we will handle it by hand.

## 14. How to contact us

For any question about your personal data — including requests to access, correct or delete it — email [email protected].

SomaSkul has applied to register with the Office of the Data Protection Commissioner (ODPC) as a data controller. We will publish the registration number here once it is issued.

## 15. Changes to this policy

We will update the "Last updated" date above when this policy changes. The current version is always at somaskul.co.ke/privacy. Before an important change takes effect, we will tell parents by SMS or in the app.