Privacy Policy

1. Introduction

Gilowinc Investment operates VibeSchool and is committed to protecting the privacy of all users, with particular care for children, in compliance with the Kenya Data Protection Act 2019.

2. Data We Collect

Account Data: full name, email, phone, role, country, date of birth, profile photo, Google account details.

School Data: school name, location, staff lists, timetable and class configurations.

Student Data (parent-managed): name, admission number, gender, class, attendance, CBC results, homework, photos, claim codes.

Usage Data: login timestamps, device info, pages visited, error logs.

Communications Data: VibeConnect messages, circulars, notifications.

3. How We Use Your Data

• Providing and operating the Platform
• Authenticating users and securing accounts
• Displaying student progress to authorised users only
• Sending service notifications
• Processing Subscription payments
• Improving the Platform through anonymised analytics
• Complying with Kenyan legal obligations
• Responding to support requests

We do not use Student Data for advertising, profiling, or any commercial purpose unrelated to the educational management of that student.

4. Legal Basis for Processing

Consent (student registration, optional features); Contract (Subscription obligations); Legitimate interests (security, fraud prevention); Legal obligation (Kenyan law).

5. Children's Data

All student accounts are parent-managed with explicit parental consent at registration. We do not knowingly collect data from children under 18 without verifiable parental consent. Student Data is only accessible to the linked parent, assigned teachers, the School Administrator, and Gilowinc Investment staff where necessary for support. Student Data is never shared with other schools, advertisers, or any commercial entity.

6. Data Storage and Security

Data is stored on Supabase (SOC 2 Type II, US servers) and hosted on Vercel (US infrastructure). By using VibeSchool you consent to this cross-border transfer. We implement Row-Level Security on all database tables, HTTPS encryption in transit, Google OAuth 2.0, and two-factor authentication on administrative accounts. In the event of a breach we will notify affected users within 72 hours per the Kenya Data Protection Act 2019.

7. Data Retention

8. Data Sharing

We do not sell your data. We share only with: Service providers (Supabase, Vercel, Google — bound by data processing agreements); Legal authorities where compelled by Kenyan law; School administrators for users within their school only.

9. Your Rights

Under the Kenya Data Protection Act 2019 you may access, correct, delete, object to, or port your data, and withdraw consent at any time. Contact gilowincinvestment@gmail.com — we respond within 21 days. Complaints may be lodged with the Office of the Data Protection Commissioner at www.odpc.go.ke.

10. Cookies

Essential session cookies for authentication only. No advertising or third-party tracking cookies.

11. Changes

Material changes notified by email at least 14 days before taking effect. Continued use constitutes acceptance.

12. Contact