SPStudy Point
Back to home

Privacy Policy

How Study Point collects, uses, stores, and protects the personal data of every school, staff member, student, and parent on the platform.

Last updated: July 11, 2026

1. Overview

This Privacy Policy explains how Study Point Ltd ("Study Point", "we", "us", or "our") collects, uses, stores, and protects personal data when a School and its Staff, Student, and Parent Users use the Study Point platform at studypoint.app.

This policy is a summary for everyday reading. It is governed by, and should be read alongside, our Terms and Conditions — in particular Section 7 (Student Data and Child Protection) and Section 8 (Data Protection and Privacy), which contain the full legal detail of our data protection obligations under Kenya's Data Protection Act 2019. Where this summary and the Terms differ, the Terms govern.

2. Data We Collect

  • Registration data — school details, and names, emails, and phone numbers of Administrators and Staff Users.
  • Student data — name, date of birth, grade level, attendance, exam results, limited health information, behavioral records, and transport records, entered by the School.
  • Usage data — how the Platform is used, to help us maintain and improve it.
  • Payment data — tokenized only; full card and mobile money details are handled directly by our payment processors, never stored by us.
  • Device data — device type, browser, and IP address, for security and troubleshooting.
  • Communication logs — records of messages, notifications, and support requests sent through the Platform.

3. How We Use Data

We use the data described above solely to:

  • Provide, operate, and maintain the Platform's Services for the School that controls the data;
  • Process payments and manage billing;
  • Send transactional communications (such as payment reminders and system notifications);
  • Maintain the security and integrity of the Platform; and
  • Improve the Platform, using anonymized or aggregated data wherever possible.

We do not sell personal data, and we do not use Student Data for advertising or any commercial purpose unrelated to providing the Services.

4. How We Store and Protect Data

  • Each School's data is isolated in its own database schema — there is no cross-school data access.
  • Data is encrypted with AES-256 at rest and TLS 1.3 in transit.
  • We conduct regular security audits and periodic penetration testing.
  • Data is stored on servers located in Africa (primary) and the EU (backup), with EU storage complying with GDPR adequacy standards.
  • Student Data is retained for 7 years after a student's last active enrollment, in line with Kenya education records requirements, then securely deleted. Full detail is in Terms Section 7.

5. Your Rights

Under Kenya's Data Protection Act 2019, you have the right to:

  • Access the personal data we hold about you or, for a Parent User, your child;
  • Request correction of inaccurate data;
  • Request deletion of data, subject to our legal retention requirements (see Section 4 above); and
  • Lodge a complaint with the Office of the Data Protection Commissioner of Kenya.

To exercise any of these rights, contact your School's Administrator (as the Data Controller) or reach our Data Protection Officer directly at dpo@studypoint.app.

6. Cookies

The Platform uses session cookies solely to keep you signed in securely. We do not use tracking or advertising cookies, and we do not sell or share cookie data with advertisers.

7. Third-Party Processors

We work with the following third-party processors, each bound by a data processing agreement:

  • Anthropic — AI-assisted features;
  • Safaricom — M-Pesa payments;
  • Stripe — card payments;
  • Resend and Brevo — transactional email delivery;
  • Africa's Talking — SMS delivery; and
  • Cloudflare — content delivery and security.

8. Children's Data

Student accounts are created and managed by School Administrators, not directly by students. We treat all Student Data with the highest level of care, as set out in full in Terms Section 7 (Student Data and Child Protection), including never selling Student Data and never using it for advertising.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified at least 30 days in advance via email and an in-platform notification, consistent with the notice provisions in Terms Section 15.

10. Contact Us

Study Point Ltd
Nairobi, Kenya