Terms of Service

1. Acceptance and who this agreement is with

These Terms are an agreement between SmartSkuli, of Greenhouse Towers, Ngong Road, Nairobi (Kilimani, Nairobi, Kenya) ("SmartSkuli", "we"), and the school that signs up to use SmartSkuli ("the school", "you"). By creating an account or using the Service, the school agrees to these Terms, including the Data Processing Agreement in Part A and the billing terms in Part B.

2. Definitions

• Service — the SmartSkuli school-management product, web and mobile app, used under a school's account.
• Learner Data — records the school enters or generates about a learner: name, admission number, KNEC assessment number, enrolled learning areas, CBC assessment and school-based assessment rubric records, and attendance.
• Guardian Data — a guardian's contact details (phone, email, WhatsApp) and consent records.
• School Data — Learner Data, Guardian Data, staff account data, timetable data and payment references, taken together.

3. The Service

Under the plan the school has bought, the Service provides:

• the daily register, marked on a phone, and automatic absence messages to guardians;
• CBC assessment records against learning areas, strands and sub-strands, and the CBE Learner Progress Report they produce;
• fee structures, invoices, statements, payment plans, and M-Pesa payments matched to a learner by admission number;
• a completion board and prepared figures for KNEC school-based assessment, formatted in the order the KNEC portal asks for — SmartSkuli has no KNEC integration and holds no KNEC login; the school's own teachers enter scores into the KNEC portal themselves;
• where bought as an add-on: the timetable, the school bus module, and the staff register.

4. The school's responsibilities

• Enter accurate Learner Data and Guardian Data, and keep it up to date.
• Obtain and record any consent the DPA requires before SmartSkuli sends a guardian WhatsApp, SMS or email messages on the school's behalf.
• Keep staff account credentials confidential and report a suspected compromise promptly.
• Use the Service only for lawful school administration, and not to send anything a guardian has not consented to receive.

This Part A is the contract that governs how SmartSkuli processes School Data as a processor on the school's behalf, as required by section 24 (and related provisions) of Kenya's Data Protection Act, 2019. It forms part of these Terms and applies for as long as the school has an account.

A.1 Roles

For Learner Data and Guardian Data, the school is the data controller and SmartSkuli is the data processor. The school determines the purposes and means of processing (who is enrolled, what is recorded, who a learner's guardians are); SmartSkuli processes that data only on the school's documented instructions, which these Terms and the school's configuration of the Service constitute.

A.2 Scope and purpose of processing

SmartSkuli processes School Data solely to provide the Service described in Section 3: running the register and messaging, recording assessment, producing reports, managing fees and matching M-Pesa payments, and running any add-on module the school has bought. SmartSkuli will not use Learner Data or Guardian Data for advertising, for training a general-purpose model, for sale to a third party, or for any purpose outside delivering the Service to the school.

A.3 Instructions and assistance

SmartSkuli will process School Data only on the school's instructions, will inform the school if an instruction appears to breach the DPA, and will reasonably assist the school in responding to a data subject rights request and in carrying out a data protection impact assessment where the school reasonably requests it.

A.4 Confidentiality of personnel

SmartSkuli ensures that any person who processes School Data is bound by confidentiality, and access is limited to staff who need it to operate the Service.

A.5 Security measures

SmartSkuli maintains technical and organisational measures appropriate to the sensitivity of School Data, including encrypted connections, access controls, and separation between schools' data.

A.6 Sub-processors

SmartSkuli may engage sub-processors to deliver parts of the Service: an SMS gateway, WhatsApp / Meta Business Platform, M-Pesa / Safaricom for payment references, and a cloud hosting provider. The sub-processors engaged today are Supabase (database hosting), Fly.io (application hosting), Amazon Web Services (document storage), Resend (email), Africa's Talking (SMS), Meta (WhatsApp) and Paystack (payments). SmartSkuli will give the school 30 days' notice before engaging a new sub-processor, and the school may object on reasonable data-protection grounds . SmartSkuli remains responsible for a sub-processor's compliance with this Part A.

A.7 International transfers

The Service runs on encrypted cloud infrastructure. This is a transfer of School Data outside Kenya, made subject to appropriate safeguards as the DPA requires (for example, contractual data-protection clauses with the hosting provider). School Data is held in Ireland with Supabase and Amazon Web Services; each transfer relies on the standard contractual clauses in that provider's data processing agreement .

A.8 Breach notification

If SmartSkuli becomes aware of a personal data breach affecting School Data, it will notify the school without undue delay, and in any case within 48 hours, with enough information for the school to meet its own duty to notify the ODPC and affected data subjects.

A.9 Return and deletion of data on exit

On termination of the school's account, and consistent with Section B.4 below, SmartSkuli will make all School Data available to the school for export, and will delete or anonymise it from active systems within 90 days, except where retention is required by law.

A.10 Audit

SmartSkuli will make available to the school information reasonably necessary to demonstrate compliance with this Part A, and will permit an audit by the school or its auditor on reasonable notice, on 30 days' written notice and no more than once in any twelve-month period, unless a breach or a regulator requires otherwise.

SmartSkuli is a business tool sold to schools, not a consumer product, so this Part B — not a consumer-style refund policy — governs how a school is charged and what happens if it stops paying or wants to leave.

B.1 Pricing

SmartSkuli charges per learner, per term. As published at the time these Terms were drafted: the Essential plan is KES 75 per learner per term, and the Standard plan is KES 140 per learner per term. Add-on modules (The timetable, The school bus, The staff register) are charged at a flat rate per school per term regardless of roll. The current rates for a specific school are the ones stated in that school's order form or invoice, which take precedence over this page.

B.2 Billing cycle

Billed termly, in the weeks your own fees land — nine billed months a year, not twelve.

A school may instead pay for a full year in advance at a discounted per-learner rate, as offered on the pricing page at the time of payment.

B.3 Non-payment

If an invoice goes unpaid, messaging pauses. Your records, your exports and your read access never do.

SmartSkuli will not withhold a school's own records, its ability to export them, or read access to them as leverage for an unpaid invoice. Fee changes take effect no earlier than one full term after notice to the school.

B.4 Cancellation and data on exit

Your school owns its data and can export all of it on 30 days’ notice.

Amounts already paid for the current term are not refunded on cancellation, except at SmartSkuli's discretion or as required by law. Where SmartSkuli ends the agreement for a reason other than the school's breach, the school is refunded the unused part of the term on a pro-rata basis.

5. Ownership

SmartSkuli and its licensors own the Service, its software and its design. The school owns School Data. Nothing in these Terms transfers ownership of School Data to SmartSkuli; SmartSkuli's rights over it are limited to what Part A permits.

6. Confidentiality

Each party will keep the other's confidential information confidential and use it only to perform this agreement. School Data is always the school's confidential information.

7. Warranty and limitation of liability

The Service is provided on an "as available" basis. To the extent permitted by Kenyan law, SmartSkuli's total liability arising from these Terms is limited to the fees the school paid to SmartSkuli in the twelve months before the claim arose, and neither party is liable for indirect or consequential loss. This limitation does not apply to a breach of the Data Processing Agreement in Part A, to either party's confidentiality obligations, or to liability that cannot lawfully be limited.

8. Term and termination

These Terms run for as long as the school has an active account. Either party may terminate on notice as described in Part B.4. SmartSkuli may suspend the Service for non-payment as described in Part B.3, or immediately if the school's use breaches the DPA or these Terms in a way that puts other schools' or guardians' data at risk.

9. Governing law and disputes

These Terms are governed by the laws of Kenya. Any dispute will be resolved in the courts of Kenya, sitting in Nairobi . This does not affect a data subject's right to complain to the Office of the Data Protection Commissioner (ODPC).

10. Contact and changes

Legal notices under these Terms should be sent to SmartSkuli, Kilimani, Nairobi, Kenya. General questions can be sent to [email protected]. We will post any change to these Terms on this page and update the date at the top; a change to Part A that reduces a school's rights as controller will be notified to the school directly before it takes effect.