Privacy Policy
We wrote this in plain language so every Kenyan parent, teacher, and student understands exactly what data we collect and why. If anything is unclear, email us at support@edunexus.co.ke — we will respond within 7 business days.
Who We Are
EduNexus is an AI-powered education platform developed and operated by Jashor Technologies, incorporated in Kenya. We serve students, parents, and teachers navigating the CBC Junior (Grade 7–9), CBC Senior (Grade 10–12), and 8-4-4 (Form 3–4) curricula.
Through EduNexus Core, we also provide school management services to Kenyan registered schools (PP1–Grade 9), enabling headteachers, deputy headteachers, school administrators, and teachers to manage learner admissions, class enrolments, assessments, report cards, and transfers. In this context the school is the Data Controller for learner records it creates; see Section 6 for the full explanation of that relationship.
Under the Kenya Data Protection Act 2019, Jashor Technologies is the Data Controller for all personal data processed through the EduNexus platform, which it operates in Kenya under the business name EduNexus Kenya.
What Data We Collect
Student / Consumer Data
- • Full name, grade level, school
- • Term assessment scores (CBC levels 1–4)
- • Learning Compass session history
- • Career interests & pathway
- • XP points, streaks, milestones
- • Study group membership & answers
Parent / Guardian Data
- • Full name
- • Phone number (WhatsApp)
- • Email address
- • Child's academic reports received
- • Payment records (Paystack)
- • National ID number (Core schools only — for guardian verification)
- • Relationship to learner
Teacher / School Staff Data
- • Full name, school
- • Subjects & grades taught
- • Class lists & student records
- • Scheme of work content
- • Lesson plan content
- • Token balance & usage
- • School role (headteacher, deputy, admin, teacher)
When a school onboards to EduNexus Core, its administrators create official learner records on behalf of the school. This data is collected under the school's authority as Data Controller (see Section 6). The following data categories are collected:
Learner Identity
- • Full name, date of birth, gender
- • Admission number (school-assigned)
- • UPI / NEMIS pupil number (government identifier)
- • Nationality, county of origin
- • Passport photo URL (optional)
- • Special educational needs (see below — sensitive data)
Academic Records
- • Enrolment history (class, term, academic year)
- • Assessment scores and CBC performance levels
- • Term subject summaries & class position
- • Teacher and headteacher comments
- • Attendance (days present / absent)
- • Promotion decisions (promoted/repeated/graduated)
- • Transfer records and reason for transfer
- • Official school report card PDFs
⚠ Special Category Data — Special Educational Needs
The special_needs field may contain information about a learner's disabilities, learning difficulties, or medical conditions. Under Section 46 of the Kenya Data Protection Act 2019, this is sensitive personal data that may only be processed with explicit written consent from a parent or guardian, or where processing is necessary for the provision of educational support services. Schools must obtain this consent before entering special needs information into EduNexus Core.
School Institution Data
- • School name, type, NEMIS school code
- • County, sub-county, ward, physical address
- • Contact phone & email
- • School logo, motto
- • Curriculum type (CBC, 8-4-4, IGCSE)
- • Academic year and term configuration
Study Group Data
- • Group name, subject, grade
- • Member list (names, points, streaks)
- • Daily challenge answers (with correctness)
- • Leaderboard positions
Usage Data (Automatic)
- • Pages visited, features used
- • Session duration and frequency
- • Device type (mobile/desktop)
- • Browser type and OS
Legal Basis for Processing
Under Section 30 of the Kenya Data Protection Act 2019, we must have a lawful basis for processing each category of personal data. The table below sets out the basis for each type.
| Data Category | Legal Basis | Details |
|---|---|---|
| Student academic data (consumer app) | Consent | Provided by parent/guardian at registration |
| Student learning sessions | Consent + Legitimate Interest | To deliver personalised education |
| Parent contact details (consumer app) | Consent | Provided at signup; used to send reports |
| Teacher account data | Contractual Necessity | Required to provide the subscribed service |
| Payment records | Legal Obligation | Financial record-keeping under Kenya tax law |
| Usage analytics | Legitimate Interest | To improve platform performance and fix bugs |
| Study group data | Consent | Student or parent chooses to join a group |
| School institution data | Contractual Necessity | Required to set up and operate EduNexus Core for the school |
| School staff roles & access | Contractual Necessity | Required to provide Core services; school is responsible for staff notice |
| Learner registry data (Core) | Legal Obligation + Contractual Necessity | Schools are required under the Kenya Education Act to maintain learner records; EduNexus processes these on the school's instruction |
| Guardian contact data (Core) | Contractual Necessity + Consent | Collected by school for communication; guardian consent is the school's responsibility |
| Formal academic records (Core) | Legal Obligation | Schools must maintain assessment and report records under MoE regulations |
| Special educational needs data | Explicit Consent | Sensitive data under DPA S.46; requires explicit written consent from parent/guardian before processing |
How We Use Your Data
We will NEVER:
- ✕ Sell your personal data to any third party
- ✕ Use student data for commercial advertising or profiling
- ✕ Share data with parties not listed in this policy
- ✕ Process data beyond the purposes stated above without fresh consent
- ✕ Use your data to train external AI models
Children's Data
CriticalEduNexus serves students including minors under 18. We apply heightened protections to all student data in accordance with Section 44 of the Kenya Data Protection Act 2019.
Consumer app — parental consent required
On the EduNexus consumer app, student profiles are created by a parent or guardian who agrees to this policy on the child's behalf. Students under 18 may not create their own accounts independently.
EduNexus Core — school-created learner records
When a school uses EduNexus Core, the school (as Data Controller) creates learner records during the admission process. The school is responsible for obtaining the necessary parental consent or providing notice to guardians under the Kenya Education Act and DPA 2019. EduNexus processes these records on the school's instruction.
Student self-login
Once a parent creates a consumer profile, students may be given their own login to access the Learning Compass, study groups, and their personal dashboard. This login is still governed by parental consent.
Minimum data principle
We collect only the data strictly necessary for educational purposes. For Core learner records, admission number, UPI, and date of birth are collected to satisfy MoE/NEMIS requirements; special needs data is collected only with explicit parental consent.
No advertising to minors
Student and learner data is never used for advertising, commercial profiling, or any purpose outside direct educational support.
Parental access and deletion
Parents may request access to, correction of, or deletion of their child's data at any time by emailing support@edunexus.co.ke. For Core learner records, deletion requests that affect official school records will be processed in coordination with the school.
Schools & EduNexus Core — Data Controller Relationship
ImportantEduNexus Core is a school management platform. When a Kenyan school subscribes to Core, it acts as an independent Data Controller for all learner records it creates within the system. Jashor Technologies (EduNexus) acts as a Data Processor — processing that data only on the school's documented instructions.
The School (Data Controller) is responsible for:
- • Obtaining parental/guardian consent or notice before admitting learners
- • Obtaining explicit consent before entering special needs data
- • Ensuring the accuracy of learner records
- • Responding to data subject rights requests from parents
- • Retaining records for the period required under MoE regulations
- • Notifying guardians about how their child's data is managed
EduNexus (Data Processor) is responsible for:
- • Storing and securing learner data to DPA 2019 standards
- • Enforcing Row Level Security so only authorised school staff can access records
- • Processing data only as instructed by the school
- • Notifying the school of any data breach within 72 hours
- • Deleting learner data on written instruction from the school
- • Never selling or sharing Core learner data with any third party
A Data Processing Agreement (DPA) governs this relationship. Schools that subscribe to EduNexus Core are bound by that agreement. If you are a parent whose child's school uses EduNexus Core, please contact your school administration regarding how your child's data is managed at school level. You may also contact us at support@edunexus.co.ke and we will direct your request to the appropriate school.
Intelligence Bridge (Optional)
Schools may optionally enable the EduNexus Intelligence Bridge — a paid feature that connects Core learner records to EduNexus OS AI modules (learning risk analysis, growth milestones, remedial planning). When enabled, Core enrolment and academic performance data is analysed by DeepSeek AI to produce school-level intelligence reports. This feature is off by default and can only be activated by the school's headteacher or administrator. The same AI data commitments listed in Section 7 apply to all Intelligence Bridge processing.
AI and Your Data
EduNexus uses DeepSeek AI (accessed via Together AI) to power the following features:
Learning Compass
Real-time personalised tutoring sessions
Learner Blueprints
Personalised learning intelligence reports
Career Recommendations
Pathway suggestions based on student strengths
Study Group Challenges
Daily AI-generated subject questions
Scheme of Work
AI-assisted lesson content for teachers
AI Data Commitments
Data Sharing — Our Processors
We share data only with the following service providers, each bound by a Data Processing Agreement and prohibited from using your data for their own commercial purposes:
| Provider | Purpose | Data Shared | Location |
|---|---|---|---|
| Supabase | Database & authentication | All user data | EU (Frankfurt) |
| Together AI | AI processing | Minimised, anonymised data | United States |
| Vercel | Platform hosting & CDN | Static assets only — no personal data | Global CDN |
| Paystack | Payment processing | Name, email, payment details only | Nigeria / Kenya |
| WhatsApp (Meta) | Report delivery to parents | Parent's phone number + report content | United States |
International Data Transfers
Some of our service providers are located outside Kenya. Under Section 48 of the Kenya Data Protection Act 2019, we are required to disclose these transfers and the safeguards in place.
European Union (Supabase — Germany)
GDPR ProtectedThe EU has the GDPR, which provides protections at least equivalent to the Kenya DPA 2019. Your data stored with Supabase benefits from these stronger protections.
United States (Together AI, Meta/WhatsApp, Vercel)
Contractual SafeguardsNo adequacy decision exists between Kenya and the US. We rely on Data Processing Agreements and Standard Contractual Clauses to safeguard your data with US-based processors.
Nigeria (Paystack)
CBK RegulatedPaystack is licensed to operate in Kenya by the Central Bank of Kenya and is subject to Nigerian data protection law (NDPR 2019), which has similar requirements to the Kenya DPA.
How Long We Keep Your Data
We retain personal data only as long as necessary for the purpose it was collected, or as required by Kenyan law. The schedule below applies to all categories.
| Data Type | Retention Period | Reason |
|---|---|---|
| Account & profile data | While account is active, then deleted within 30 days of a verified deletion request | Necessary to provide the service |
| Student assessment scores (consumer app) | While account is active + 30 days after deletion | Forms core of the educational record |
| Learning Compass sessions | While account is active + 30 days after deletion | Powers progress tracking |
| Study group data | While account is active + 30 days after deletion | Community feature |
| Payment records | 7 years from date of transaction | Kenya VAT Act & Income Tax Act obligation |
| Learner Blueprint PDFs | While account is active + 30 days after deletion | Parent record |
| AI conversation logs | Anonymised after 90 days, then retained for debugging | Platform improvement; personal data removed |
| Database backups | 30-day rolling backup window | Disaster recovery |
| Usage analytics | 24 months rolling | Platform performance monitoring |
| Core learner identity records | For the duration of the school's active subscription, then transferred to the school or deleted on instruction — minimum 3 years recommended by MoE | Schools have a legal duty to maintain learner records under the Kenya Education Act |
| Official school report cards | For the duration of the school's active subscription; school may request export before closing their account | Formal academic records — schools are responsible for long-term archiving per MoE requirements |
| Learner promotion & transfer records | For the duration of the school's active subscription + 1 year, or as instructed by the school | Required for school administration continuity and potential MoE audits |
| Special educational needs data | Deleted immediately upon written request from parent/guardian or the school; otherwise retained for duration of learner enrolment only | Sensitive data — minimum retention, explicit consent-based |
| Guardian national ID numbers | Retained while the learner is actively enrolled; deleted 30 days after learner status changes to transferred/graduated/archived | Collected for school verification purposes only |
Data Security
Encrypted in transit
All connections use TLS 1.2+. No unencrypted HTTP.
Row Level Security (RLS)
Every database table enforces per-user access policies at the database layer.
Hashed passwords
Passwords are never stored in plain text. Supabase uses bcrypt hashing.
Service role isolation
The database service key is never exposed to client code. All elevated access goes through server-side routes only.
Access logging
All API access is logged. Suspicious patterns trigger alerts.
Regular reviews
We review security practices and audit data access controls on a quarterly basis.
Your Rights Under the Kenya Data Protection Act 2019
Right to Access (S.26)
Request a copy of all personal data we hold about you.
Right to Rectification (S.27)
Require us to correct inaccurate or incomplete data.
Right to Erasure (S.28)
Request deletion of your data (the "right to be forgotten").
Right to Restriction (S.29)
Ask us to limit how we process your data in certain circumstances.
Right to Portability (S.30)
Receive your data in a structured, machine-readable format.
Right to Object (S.31)
Object to processing based on legitimate interest, including profiling.
Withdraw Consent (S.30)
Where processing is based on consent, you may withdraw it at any time without affecting past processing.
Automated Decisions (S.32)
Not be subject to decisions based solely on automated processing that significantly affects you.
How to exercise your rights
Email support@edunexus.co.ke with the subject line "Data Rights Request" and your name. We will acknowledge within 48 hours and respond fully within 21 days (the maximum allowed under the Kenya DPA 2019, extendable by a further 21 days for complex requests with notice).
Automated Decision-Making & Profiling
EduNexus uses automated processing (AI) to generate several outputs. Under Section 32 of the Kenya DPA 2019, we must disclose where automated decisions have a significant effect on you.
Learner Blueprint reports
No significant legal effectWhat the AI does
AI analyses assessment scores and generates a personalised report
Human oversight
Parents and teachers review the report; it does not make any formal academic decision
CBC pathway recommendations
No significant legal effectWhat the AI does
AI suggests STEM, Social Sciences, or Arts & Sports based on scores
Human oversight
Advisory only — the student and parent choose the actual pathway
Learning Compass sessions
No significant legal effectWhat the AI does
AI adapts question difficulty based on student responses in real time
Human oversight
Students can end a session at any time; no grades are produced
Career recommendations
No significant legal effectWhat the AI does
AI matches student strengths to career paths from a curated KICD-aligned list
Human oversight
Informational only — no institutional decision is made
None of our automated systems produce legally binding or significant decisions (such as grade allocation, school placement, or financial decisions). All AI outputs are advisory.
We use essential cookies only — no advertising, tracking, or third-party analytics cookies.
sb-auth-token
RequiredAuthentication
Keeps you securely logged in. Expires on logout or 7 days.
sb-session
RequiredSession
Manages your active session state. Cleared when you close the browser.
theme
OptionalPreference
Remembers your display preference (dark/light mode).
You may disable cookies in your browser settings. Disabling the authentication cookie will log you out and prevent access to authenticated features.
Changes to This Policy
We will notify users of material changes — such as new data categories, new processors, or changes to your rights — via in-app notification and email at least 14 days before the change takes effect.
Minor updates (typo fixes, clarifications) will be made without advance notice but with an updated "Last updated" date at the top of this page.
Version history
29 Jun 2026 — Added: EduNexus Core section (school learner registry, guardian national ID, UPI/NEMIS pupil number, special needs as sensitive data, school as data controller, intelligence bridge disclosure, report card and transfer data, expanded retention table and legal basis table)
25 Jun 2026 — Added: student self-login, study groups, WhatsApp processor, retention schedule, legal basis table, automated decisions disclosure, cross-border transfer details
4 Jun 2026 — Initial publication
Contact Us & How to Complain
Jashor Technologies — trading as EduNexus Kenya
Right to Lodge a Complaint
If you believe we have processed your personal data in a manner inconsistent with the Kenya Data Protection Act 2019, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) — Kenya's data protection regulator.
Office: Office of the Data Protection Commissioner
Website: www.odpc.go.ke
Address: Teleposta Towers, Kenyatta Avenue, Nairobi
Email: info@odpc.go.ke
Phone: +254 20 428 5000
We encourage you to contact us first at support@edunexus.co.ke so we can try to resolve your concern before escalating to the ODPC.