How Taarifa handles school, learner, and parent data.

Taarifa is a school management platform operated in Nairobi, Kenya and built by The Tech Band Originals. For learner records, the partner school is the data controller and Taarifa acts as the data processor under its instructions.

• School and staff details: institution name, county, staff names, roles, phone numbers, and login credentials.
• Learner records: names, admission numbers, class and stream, CBC assessment entries, attendance, and teacher remarks.
• Guardian contacts: parent or guardian names and mobile numbers used for SMS notifications and portal access.
• Financial records: fee structures, invoices, and payment references recorded by the school. Taarifa does not process or hold school fees.
• Technical data: device type, browser, IP address, and access timestamps used to secure accounts.

To generate CBC assessments and report cards, deliver SMS notifications, maintain the school’s fee ledger and statements, host the school website, and provide the Taarifa Assistant AI features requested by staff.

To support and secure accounts, investigate incidents, and produce anonymised, aggregate usage statistics.

We do not sell personal data, and we do not use learner data for advertising.

We share data only with processors necessary to run the service: licensed bulk SMS aggregators for message delivery, and our hosting and infrastructure providers. Each is bound by contract to protect the data.

We disclose information to authorities only where required by Kenyan law.

Learner and financial records are retained for as long as the school remains a partner, and thereafter for the period the school is legally required to keep academic and accounting records. On written instruction from the school we export and then delete its data.

Parents, guardians, and staff may request access to their data, correction of inaccurate records, deletion where retention is not legally required, and objection to specific processing. Requests should be made through the school, or directly to us at info@taarifa.co.ke; we respond within 14 days.

Data is encrypted in transit and at rest, access is role-based and logged, and backups are taken daily. Staff accounts are limited to the records their role requires.

Learner records are processed on the instruction of the school under its own consent arrangements with guardians. We do not market to learners and we do not create profiles of learners for any purpose outside school reporting.