Privacy Policy

Introduction and Scope

MasomoFiti is a Kenyan educational platform for students, teachers, parents, and schools. Our services include KCSE, KJSEA, and KCBE papers, marking schemes, revision notes, topical and substrand revision, schemes of work, predictions, and related educational resources.

This Privacy Policy applies when you visit MasomoFiti, create or use an account, make a payment, download or view a resource, submit a rating or request, or contact us. MasomoFiti is responsible for the personal information it determines how and why to process. Our service providers process some information on our behalf or under their own privacy terms.

Information We Collect

Depending on the features you use, we may collect:

• Account and profile information, such as your name, email address, profile image, and authentication identifier when you sign in with Google. We do not receive your Google password.
• Payment and access information, including the M-Pesa phone number you enter, checkout and transaction references, payment status, receipt number, amount, time, and the resource purchased.
• Information you submit, such as resource requests, support messages, ratings, review details, school information, and other form responses.
• Technical and usage information, such as IP address, browser and device type, operating system, referring page, pages viewed, resource interactions, download activity, approximate location derived from technical signals, and error or security logs.
• Cookie, local-storage, advertising, and preference information used to keep sessions working, remember choices, measure use, prevent abuse, and support advertising where enabled.
• Teacher name, TSC number, and school name entered for a personalised scheme download. These details are used to generate that PDF response and are not intentionally retained in our database after generation.

How We Collect Information

• Directly from you when you enter a phone number, sign in, submit a request or rating, make a payment, or contact us.
• Automatically from your browser or device when you use the website.
• From service providers, including Google authentication and Safaricom M-Pesa, when they return account, payment, or transaction status information needed to provide the service.

How and Why We Use Information

We process personal information only where we have a lawful and appropriate reason, including providing a requested service or purchase, pursuing legitimate interests such as security and service improvement, complying with legal obligations, or relying on consent where consent is required.

• To authenticate users, display profiles, and maintain account sessions.
• To initiate M-Pesa payments, confirm successful transactions, grant paid access, and recognise eligible re-downloads.
• To deliver, personalise, and improve free and paid educational resources.
• To record verified ratings and maintain trustworthy resource information.
• To answer support enquiries and resource requests and send service-related messages.
• To measure traffic, resource use, downloads, and website performance.
• To enforce download limits, detect bots, fraud, piracy, payment abuse, and other misuse, and protect users and the platform.
• To maintain records required for accounting, dispute handling, security, and compliance.

Cookies and Advertising

MasomoFiti may use cookies, local storage, pixels, web beacons, IP addresses, and similar technologies. Essential technologies support sign-in, security, payment state, and user preferences. See our Cookie Policy for more information and available controls.

Where Google AdSense is enabled, Google and its advertising partners may place or read cookies, use web beacons, IP addresses, or other identifiers, and receive information such as the page URL, general location, browser or device information, and ad interactions. This may be used to deliver, limit, personalise, and measure ads and to prevent advertising fraud, depending on your settings, consent, and applicable law. You can manage Google ad personalisation through Google's ad settings.

Service Providers and Data Sharing

We do not sell personal information. We disclose only what is reasonably necessary to operate MasomoFiti, process payments, deliver resources, communicate with users, measure performance, protect the service, comply with law, or respond to valid legal requests.

• Safaricom M-Pesa for STK Push, payment processing, and transaction confirmation.
• Supabase for authentication, database services, file storage, and secure access workflows.
• Cloudinary for hosting and delivering eligible educational files and media.
• Vercel for website hosting, deployment, content delivery, and technical logs.
• Google for account authentication and, where enabled, AdSense advertising and measurement.
• Email and monitoring providers, where configured, for service messages, operational reports, error monitoring, and support.
• Professional advisers, regulators, courts, or law-enforcement bodies where disclosure is legally required or reasonably necessary to protect legal rights and safety.

Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this policy. Account information is generally kept while the account remains active. Payment and access records may be retained beyond the 30-day re-download period for accounting, dispute resolution, fraud prevention, and legal compliance. Security and usage logs are retained only as needed for operations and protection of the service.

When information is no longer required, we take reasonable steps to delete, anonymise, or securely isolate it. Residual copies may remain temporarily in backups or where retention is required by law.

International Processing

Some service providers may process or store information outside Kenya. Where this occurs, we take reasonable steps to use providers and safeguards intended to protect the information in accordance with applicable data-protection requirements.

Security and Abuse Prevention

We use reasonable technical and organisational safeguards designed to protect personal information from unauthorised access, loss, alteration, misuse, and disclosure. These include access controls, signed resource links, payment verification, monitoring, rate limits, and other anti-abuse measures. No online system is completely secure.

Automated security checks may temporarily limit requests or downloads that appear suspicious. Contact us if you believe a legitimate action was blocked in error.

Your Rights

Subject to the Kenya Data Protection Act and applicable exceptions, you may ask to exercise rights relating to your personal information, including:

• To be informed about how your information is used.
• To access personal information held about you.
• To object to all or part of the processing of your information.
• To correct false, misleading, incomplete, or outdated information.
• To request deletion where the legal requirements for deletion are met.
• To withdraw consent for future processing where processing relies on your consent.
• To make a complaint to Kenya's Office of the Data Protection Commissioner.

Exercising Your Rights

Send a request to info@masomofiti.co.ke. Describe the right you wish to exercise and the information concerned. We may ask for reasonable information to verify your identity and protect your account. Some records may need to be retained where required by law or for legitimate payment, security, fraud-prevention, or dispute purposes.

Children and Students

MasomoFiti provides educational resources that may be used by students. Children should use account, payment, and communication features with appropriate parent or guardian involvement. We do not knowingly seek more information from children than is reasonably necessary to provide the educational service. A parent or guardian may contact us about a child's personal information or exercise applicable rights on the child's behalf.

Changes to This Policy

We may update this Privacy Policy when our services, providers, or legal obligations change. The current version and its last-updated date will be published on this page. Material changes may also be communicated through the website where appropriate.

Contact

For privacy questions, requests, or complaints, contact info@masomofiti.co.ke.

Legal Notice

This policy describes MasomoFiti's current data practices and is not a substitute for independent legal advice. Nothing in this policy limits rights that cannot lawfully be limited.