Privacy Policy

Overview

Telpen Edu is a school management platform used by adult users — school administrators, directors, teachers (facilitators), and office staff — to manage school operations. This policy explains what information we collect, how we use it, and the choices you have. The service is not directed to, or intended for use by, children.

Who we are

Telpen Edu (operated by Telpen Systems) is the controller of account and operational data. Where a school uses Telpen Edu to process records about its students, staff, or parents, the school is the controller of those records and Telpen Edu acts as a processor on the school's behalf and under its instructions. Contact: bucrepinfo@gmail.com.

Information we collect

• Account details you provide (name, email, role, and profile information).
• School records that authorised staff enter or that are entered about learners (classes, subjects, lessons, exams, assignments, results, attendance, fees, payments, and messages).
• Authentication data handled by our sign-in provider (Supabase), such as the school-registered phone used to sign in, the enlisted username or learner admission number used to verify a device, and session information. Date of birth is stored as school biodata and is not used to sign in or verify.
• Usage and device data needed to operate and secure the service (request logs, app/version, device and browser type, approximate location from IP address, and diagnostic/crash data).
• Cookies and local storage used for sign-in sessions and essential functionality.
• Learner profile details a school enters: residence, next of kin, previous school and reason for transfer, Senior School pathway and Religious Education option.
• Sensitive learner information a school may choose to record: health status and disability or special needs (optional). Only the school administrator and the learner's own grade facilitator can see it; other facilitators, other parents and learners cannot.
• Facilitator (teacher) employment records a school enters: responsibilities, date joined, TSC number and registration status, uploaded certificates and documents, and disciplinary records. Disciplinary records and their attachments are visible only to the school administrator, head and deputy.
• Parent / guardian contact details: phone numbers, email, occupation, residence and a next of kin to call when the parent cannot be reached.

Sensitive data and uploaded documents

Health, disability and disciplinary information and uploaded documents are stored in our database in the EU (Frankfurt), are encrypted in transit, are never shared with third parties or used for advertising, and are shown only to the roles named above. A school can edit or clear these fields at any time, and they are removed with the school's records on request.

Payments

When fees are collected (for example via M-Pesa), payment is processed by the relevant payment or mobile-money provider. We receive transaction confirmations and references, but we do not store full payment credentials.

How we use information

We use your information solely to provide and operate the school management service: authenticating users and enforcing role-based access, displaying and managing academic and administrative records, sending service-related and staff-initiated notifications (in-app messages and optional web push), maintaining security and an audit trail, and complying with legal obligations. We do not sell your personal information, and we do not use it for advertising.

What this app is

Telpen Edu is used by adult school users — parents, teachers, bursars / accounts staff, and admins. It does not include AI sales or legal agents. Sign-in uses the phone number your school registered; there is no SMS one-time code.

Service providers

We do not sell personal data. We share information only with service providers (sub-processors) who process it on our behalf under appropriate contractual protections:

• Supabase (authentication) — User sign-in, sessions, and identity
• Neon PostgreSQL (database) — Storage of application and school records
• Fly.io (hosting) — Running and serving the application
• Africa's Talking — M-Pesa fee collection (STK push)
• M-Pesa / Safaricom — Fee collection and payment reconciliation

We may also disclose information where required by law, to protect rights and safety, or in connection with a business transfer.

International data transfers

The service is operated with primary hosting in the European Union (Frankfurt, Germany). If you access the service from Kenya or elsewhere, your information may be transferred to and processed there. Where data is transferred internationally, we rely on appropriate safeguards as required by applicable law.

Data storage, security & retention

Data is stored in a managed PostgreSQL database (Neon) and the application is hosted on Fly.io. We protect information with encryption in transit (HTTPS/TLS), role-based access control (each school's data is isolated from every other school), and append-only audit logging of sensitive actions. We retain records for as long as your school account is active or as needed to provide the service; on request from your school administrator, records can be exported or deleted, subject to applicable legal and record-keeping requirements.

Children's data

The Telpen Edu application is intended for adult school staff and is not directed to children. Schools may enter records that relate to learners (who may be minors) for legitimate school-administration purposes; in that case the school is the controller of those records and is responsible for the appropriate legal basis and any required parental consent. Telpen Edu processes such records only on the school's instructions.

Your rights & choices

Subject to applicable law (including the Kenya Data Protection Act, 2019), you may have the right to access, correct, delete, or restrict processing of your personal data, to object to processing, and to data portability. You can review and update your profile within the app. You can delete your login without writing to us: delete your account. The steps are on that page before you sign in. To exercise other rights, contact your school administrator or us at bucrepinfo@gmail.com. You may also lodge a complaint with the Office of the Data Protection Commissioner (Kenya) or your local supervisory authority.

Changes & contact

We may update this policy from time to time; material changes will be posted on this page with a revised “Last updated” date. Questions about this policy or your data? Email bucrepinfo@gmail.com.