Privacy policy

Merisa Kiddo / Merisa Kiddo Cloud · Web and Android · Updated 12 October 2026

Who is responsible for your information

Merisa Kiddo supports school administration and communication with families. The school decides why learner and school records are collected and how they are used, and acts as their data controller. The Merisa platform, supported by Afrionex Solutions, processes those records on the school’s instructions. Contact your school to identify the controller responsible for your records.

Information processed

• Account and contact details: names, email addresses, phone numbers, roles, guardian relationships and authorised pickup contacts.
• School records: admissions, classes, attendance, learning activities, homework, assessments, reports, daily care notes, health and incident information, clubs, transport assignments and pickup events.
• Financial records: fee statements, invoices, payment records and receipts entered or received by the school.
• Communications and content: messages, announcements, resources, photographs, portfolio evidence and files uploaded or shared by authorised users.
• Security and device information: sign-in sessions, registered devices, notification tokens, device details, access logs and audit records.
• Transport location: location supplied by authorised van crew during an active tracking session, together with timing and accuracy information. Parents can view an authorised trip without sharing their own location.

Why information is used

Information supports education, learner care and safeguarding, attendance, school transport, fee administration, family communication, account security and school reporting. The school must identify an appropriate lawful basis for each use, such as a legal obligation, provision of agreed services, a legitimate purpose permitted by law, or consent where required. Permission to use the app does not provide blanket consent for every use of a child’s data.

Children and sensitive information

The app is intended for parents, guardians and authorised staff managing school services. Adults enter and access learner records. Schools must provide appropriate notices, verify guardian authority, obtain consent where required, and protect children’s best interests. Health information and photographs require particular care; avoid including information that is unnecessary for the school’s purpose.

Access and service providers

Access depends on school-assigned roles and permissions. Parents access linked learners and the records the school shares with them. Staff access is limited by their assigned duties and permissions. Authorised administrators and platform support may access information needed to administer or support the service.

Providers used to operate the service may process relevant data: hosting and backups, configured SMS delivery (including TalkSasa), email delivery, and Firebase Cloud Messaging for push notifications. External map tiles and learning links may receive network information, such as your IP address, when opened. Information may also be disclosed where required by law or necessary for an authorised safeguarding response. The app does not contain advertising SDKs or sell personal information.

International processing

Hosting, notification and other providers may process information outside Kenya. The school and platform must assess these transfers and apply the safeguards required by Kenyan data protection law. Contact us for details about the providers and safeguards applicable to your school.

Phone permissions, storage and cookies

Location permission supports crew transport tracking. An active tracking session can continue while the app is minimised and displays a foreground notification; end the tracking session when it is no longer needed. Notification permission controls alerts. File selection uses documents you choose. You can manage permissions in Android settings.

Sign-in credentials and session information use protected storage. The web app and in-app staff workspace use session cookies and local storage for authentication and preferences. Downloaded files may be stored temporarily or opened in another app at your request. Copies you save or share outside Merisa remain under your control. Signing out clears the app’s session information; it does not delete school records or copies saved elsewhere.

Security and retention

The service uses HTTPS, authenticated access, permission checks and audit logging for supported actions. These measures reduce risk but cannot guarantee that every device or system is free from compromise. Protect your phone and report a lost device or suspected unauthorised access promptly.

School records are retained according to the school’s purpose, legal obligations and approved retention schedule. Account, security, backup and financial records can have different retention periods. GPS retention is configurable and requires the school to approve a period; ending a trip does not immediately erase its history. Backup copies may remain until the applicable backup cycle expires. Contact the school for the periods that apply to your records.

Your rights and deletion

You may request information about processing, access, correction, objection or restriction where applicable, and deletion of information that need not be retained. Identity and guardian authority may need verification. Withdrawing consent does not invalidate earlier lawful processing, and may affect an optional service.

See account and data deletion for how to submit a request. Deleting access does not automatically erase records the school lawfully needs to retain. You can also raise a complaint with Kenya’s Office of the Data Protection Commissioner.

Policy updates

We update this notice when processing or services change. Material changes requiring a new notice or consent must be communicated through the school or service before the relevant new use begins.

Contact

Contact your school office about learner records, access permissions or school services. For privacy, account deletion or platform support, email merisakiddocloud@gmail.com. Please do not send passwords, identity documents or a child’s medical records in your first message.