Privacy Policy

Effective 11 October 2026

This policy explains how Infosencia (“we” or “us”) collects, uses and protects your personal data when you use NurseMasomo. We handle personal data under the Kenya Data Protection Act, 2019. Infosencia is the data controller.

1. What we collect

Account details: your name, email, phone number if you give it, profession or cadre, and anything you add to your profile, such as school, county, exam date and photo.
What you upload: notes, past papers and photos of notes.
Study activity: quizzes, answers, scores, flashcards and progress.
Payments: amount, plan, date, status and the M-Pesa and IntaSend references. We never see or store your M-Pesa PIN.
Messages: what you send us through the contact form, feedback or support.
Technical data: IP address, browser and device details, and a security log of sign-ins and important account actions.
How you found us: the link or website that first brought you here, for example a Facebook group post or a classmate’s invite link, saved with your account when you sign up.
Your agreement: when you sign up, which version of our Terms and this policy you agreed to, and when.

2. How we use it

To run your account, make questions from your uploads, mark written answers, plan your revision and show your progress, take payments and give you access, send sign-in codes, reminders and replies, keep the service secure, and improve it.

If you write a testimonial, we publish it only with your consent, using the name style, cadre and county you chose, exactly as you wrote it. You can edit or withdraw it in Settings at any time.

3. Legal basis

We process your data because it is needed to give you the service you signed up for, because you consented (for example to analytics cookies or a testimonial), because the law requires it (for example keeping payment records), or because we have a legitimate interest in keeping the service secure and working. You can withdraw consent at any time.

4. Who we share it with

We do not sell your personal data. These services process it for us, only as far as each one needs:

Supabase

What they get: Everything in your account: name, email, phone, profession and school, the files you upload, your quizzes, answers, cards and progress, and your payment records.
Why: Our database, sign-in and file storage.
Where: Outside Kenya.

Vercel

What they get: Every page request passes through it, with your IP address and browser details.
Why: Hosts the website and runs our server code.
Where: Outside Kenya.

IntaSend

What they get: The phone number you pay from, the amount and the plan.
Why: Sends the M-Pesa prompt to your phone and tells us when the payment is done.
Where: A Kenyan company. We have not confirmed where it stores data.

Safaricom (M-Pesa)

What they get: Your payment. You enter your M-Pesa PIN with Safaricom, never with us.
Why: M-Pesa payments.
Where: A Kenyan company.

Resend

What they get: Your email address, your name and the email itself, including sign-in codes.
Why: Sends our emails.
Where: Outside Kenya.

Africa's Talking

What they get: Your phone number and the text message.
Why: Sends SMS sign-in codes and reminders.
Where: A Kenyan company. We have not confirmed where it stores data.

OpenAI and Anthropic

What they get: The text and images of notes and past papers you upload, and written answers you send for marking. We do not send your name, email or phone.
Why: Make questions and flashcards from your notes, read photos of notes, and mark written answers.
Where: Outside Kenya.

Google Analytics

What they get: Only if you accept analytics cookies: pages you visit, your browser and device, and a rough location from your IP address.
Why: Shows us which pages help students.
Where: Outside Kenya.

Cloudflare Turnstile

What they get: Your IP address and browser details.
Why: Checks that sign-up, sign-in and contact forms are used by a person, not a bot.
Where: Outside Kenya.

Inngest

What they get: Record numbers for our background jobs, such as your account ID and document IDs. No names or content.
Why: Runs slow jobs, like making cards from your notes, in the background.
Where: Outside Kenya.

Your browser's push service (Google, Apple or Mozilla)

What they get: Only if you turn on notifications: a push address for your browser and the notification text.
Why: Delivers study reminders to your phone or computer.
Where: Outside Kenya.

WhatsApp (Meta)

What they get: Only if you choose to message us there: what you send.
Why: Support chat.
Where: Outside Kenya.

We may also share data when the law requires it.

5. Data sent outside Kenya

Most of the services above store or process data outside Kenya. We use them because the service cannot run without them, and each is bound by its terms with us to protect the data and use it only to serve us.

6. How long we keep it

Your account, uploads, study activity and messages: for as long as your account is open. When you delete your account, they are deleted. Backup copies expire on their own a short time later.
Payment records: at least 5 years, because Kenyan tax law requires it. If you delete your account, we keep them without your name or account linked.
Free trial check: when you delete your account we keep a scrambled code of your verified email address and phone number for 12 months. It cannot be turned back into your email or phone. We use it only so the free trial cannot be started again with the same email or phone; we have a legitimate interest in preventing that abuse. Nothing else is kept, and the code is deleted after 12 months.
Marking checks: when we check that answers are marked correctly, we may note that a particular answer was marked differently by two methods. The note holds the question and an answer reference only, never your name or contact details, and is deleted after 180 days.
Security log: we keep it to protect the service. When you delete your account, we remove your email, phone, IP address and device details from it.
Analytics: only if you accepted. Google keeps it for the period set in our Google Analytics account.
Messages from people without an account: we keep them so we can follow up. Ask us and we will delete them.

7. Cookies

We use cookies that keep you signed in, and one that remembers your analytics choice for 6 months. These are needed for the site to work. One more cookie of our own remembers, for 90 days, the link or website that first brought you here, so we can tell which posts help students find us; no one else can read it. Google Analytics cookies are set only if you choose “Accept analytics”. If you decline, Google Analytics does not load at all.

8. Your rights

Under the Data Protection Act, 2019 you have the right to:

Be informed about how we use your data. This policy is that notice.
Access the personal data we hold about you and get a copy.
Correct data that is wrong. You can change most of your details yourself in Account settings.
Delete your data. You can delete your account yourself (see below).
Object to processing, or ask us to restrict it, including turning off analytics and reminders.
Move your data: ask us for a copy in a common format.

To use any of these rights, email info@infosencia.com from the address on your account, or use our contact page. We may ask you to confirm who you are. If you are not happy with our answer, you can complain to the Office of the Data Protection Commissioner (odpc.go.ke).

9. Deleting your account

Go to Account settings and choose “Delete my account”. For your safety you must have signed in within the last 15 minutes. We delete your account, your study activity and your messages straight away, and your uploaded files with them. If an uploaded file cannot be removed at that moment, we remove it by hand. We keep payment records, without your name or account linked, for tax purposes, as section 6 explains.

Our database provider keeps backup copies for a limited time so the service can be recovered after a failure. Your data stays in those copies until they expire. We do not use them for anything else.

If you write or review content for us, email us instead and we will close the account by hand.

10. Security

We use encrypted connections, restricted access and sign-in codes instead of passwords. Your M-Pesa PIN is entered with Safaricom and never reaches us.

11. Children

The service is for students aged 18 and above. A younger student may use it only with the consent of a parent or guardian, who is then responsible for the data shared. We do not knowingly collect data from children without that consent.

12. Changes to this policy

If we change this policy in a way that matters, we will tell you, and the date at the top will change. New accounts agree to the version shown at sign-up.

13. Contact

Privacy questions: info@infosencia.com.