Kly and Beyond Limited, a company incorporated in the Republic of Kenya, is the Data Controller responsible for personal data processed through the Somea Online application. This Policy explains how we collect, use, disclose, and protect personal data in accordance with the Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021.
This Policy applies to all personal data processed in connection with the Service, including data relating to the registering parent or guardian (the Parent) and the child learner (the Child).
Parent data: full name, telephone number, and account password. Child data: first name and school grade only. Usage data: homework questions submitted, quiz and flashcard activity, and learning progress. Payment data: M-PESA transaction records processed by IntaSend; we do not receive or store your M-PESA PIN. Technical data: an authentication token stored in your device's browser local storage to maintain your session. We do not employ tracking or advertising cookies. We apply data minimisation and collect only what is necessary; we do not retain a Child's photograph as stored personal data, nor collect a Child's location or other sensitive personal data.
We process personal data to provide homework assistance and track progress; to send SMS notifications and receipts to the Parent; and to process subscription payments. The processing of a Child's personal data is undertaken on the basis of the Parent's consent, obtained at registration prior to any such processing.
The Service is registered and controlled by a Parent. At registration, the Parent confirms their status as parent or legal guardian and provides consent to the processing of the Child's data; such consent and its timestamp are recorded. We store only the Child's first name and grade. The Parent may access, rectify, or request deletion of the Child's data at any time.
We do not sell personal data or disclose it for advertising. We engage the following data processors solely to deliver the Service: CockroachDB (database storage), Anthropic (AI processing of question content), IntaSend (payment processing), Africa's Talking (SMS delivery), and Vercel (hosting). Each processes personal data only on our instructions.
Certain processors process data outside Kenya. Where personal data is transferred outside Kenya, such transfer is effected in reliance upon the safeguards of the relevant processor and the conditions permitted under the Act.
We retain personal data for the duration of the Account. Upon deletion of the Account, personal data is deleted within fourteen (14) days, save for limited payment records retained as required by law.
Under the Act, you have the right to be informed; to access your data; to rectification; to erasure; to object to processing; and to data portability. You may exercise these rights by contacting ops@someaonline.com or by deleting your Account in the Service. You may also lodge a complaint with the Office of the Data Protection Commissioner.
We implement appropriate technical and organisational measures to protect personal data, including encryption in transit, hashing of passwords and PINs, and access controls. No system is entirely secure, and we do not warrant absolute security.
We may amend this Policy from time to time. Material amendments will be notified within the Service or by SMS.
Kly and Beyond Limited — ops@someaonline.com