Privacy

Privacy policy

Fasal helps parents across Kenya find a checked tutor. To do that we hold information about parents, their children and tutors. This page says exactly what we hold, who can see it, and what you can ask us to do with it.

Effective date: 19 September 2026. Contact: hello@fasal.app

Who is responsible for your information

Fasal decides what information is collected and why, which makes Fasal the data controller for the purposes of Kenya's Data Protection Act 2019. Write to us about anything on this page at hello@fasal.app and a person will answer.

Still to be added by the owner: the registered company name, registration number and registered address in Kenya, and Fasal's registration number with the Office of the Data Protection Commissioner (ODPC). A data controller handling children's data is required to register.

What we collect

If you are a parent

• Your name, email address and password. The password is stored only as a secure hash. Nobody at Fasal can read it.
• A phone number, if you choose to add one. It is optional, and it is not used to sign in.
• The area you are in, and your preferred language.
• The first name and school grade of each child you add.
• Your bookings: the tutor, subject, date and time, whether the lesson is at home or online, and the price.
• Payment details you type in: the M-Pesa confirmation code for a lesson. Fasal records the transaction code it matched against its own M-Pesa statement. We never see or store your M-Pesa PIN, and Fasal does not take money from your phone. You send it.
• Messages you send to tutors and to the Fasal team.
• Any safety concern you report, and reviews you leave.

If you are a tutor

• Your name, email address and password, and an optional phone number.
• Your public profile: subjects, school grades, curricula, languages, the area you teach in, whether you teach online, your hourly price, and what you write about yourself.
• The evidence we check you on: a copy of your national ID, your Certificate of Good Conduct from the DCI, qualification certificates, and your TSC number if you have one.
• The names and phone numbers of the two referees you give us, and a note of what they said when we phoned them.
• Notes from your interview and your scored demo lesson.
• Your M-Pesa number, so we can pay you.
• Your free hours, your bookings, the reports you write after lessons, and your messages.

Everyone

• Notifications we have sent you, and your notification settings.
• A record of actions taken by Fasal staff on your account, for example approving a document or confirming a payment. This log cannot be edited or deleted, including by us.

We do not use advertising, we do not run analytics or tracking scripts, and we do not place advertising or tracking cookies. The app stores a sign-in token in your browser so you stay signed in, and remembers small preferences on your own device.

Children's information

A child never has a Fasal account. We hold only the first name and school grade that you, the parent, type in, so a tutor knows who they are teaching and at what level. A tutor sees that first name and grade only once you have booked them.

Kenya's Data Protection Act 2019 sets extra conditions for handling a child's personal data. In Fasal those conditions are met in the following way: only a parent or guardian, signed in to their own adult account, can add a child, and adding one is what gives us your consent to hold that first name and grade. We collect the minimum a tutor needs to teach the right child at the right level, we do not build a profile of your child, and we never show a child's details to anyone other than you, the tutor you booked, and the Fasal staff who handle safety. You can change or remove a child at any time, and closing your account removes them with it.

Who can see what

These limits are enforced by the database itself, not only by our staff rules, so they hold even if somebody uses the app in a way we did not expect.

• Anyone, signed in or not, can see a live tutor's public card: their name, initials, subjects, area, price, rating and which checks they passed. Nothing private appears there.
• A parent sees only their own account, children, bookings, messages and notifications.
• A tutor sees your first name, your child's first name and grade, and your area, and only for a lesson you have booked with them. A tutor cannot browse parents.
• The Fasal team can see accounts, tutor documents, bookings and payments, in order to run the checks and confirm payments. Every action a staff member takes is written to the log described above.
• Nobody at Fasal can read the messages between a parent and a tutor. Staff can see that a conversation exists, never what is in it. This is enforced in the database.
• Tutor documents (ID, Certificate of Good Conduct, certificates) are kept in private storage that only that tutor and Fasal staff can open.

Where your information is stored

Fasal runs on Supabase. The database, the private document storage and the accounts system are hosted in Mumbai, India (ap-south-1). This means your information leaves Kenya and is stored abroad. The website itself is served from Hostinger.

Two font services, Google Fonts and Fontshare, deliver the typefaces used on these pages. When your browser fetches a font, those services receive your IP address. They receive nothing else, and we send them no information about you.

The Data Protection Act 2019 restricts moving personal data out of Kenya. We rely on the transfer being necessary to perform the service you asked us for: Fasal cannot show you tutors, hold your bookings or carry your messages without a database, and that database is hosted by Supabase in Mumbai. Supabase processes this information only on our instructions, under its own security and data-protection terms, and it is not used for anything else.

For a lawyer to confirm before real families sign up: whether performance of the contract is the right basis to rely on here, or whether Fasal should instead ask for explicit consent, add standard contractual clauses with Supabase, or move to a region inside Kenya.

How long we keep it

We keep your account and everything attached to it for as long as you use Fasal. When you ask us to close your account we remove your profile, your children's details, your saved tutors and your messages.

Some things outlive the account, and we keep those only for as long as we have a reason to: records of lessons and payments, because we are required to keep financial records; the evidence behind a tutor's checks, because a parent who booked them may raise something later; and safety reports, because a concern about a child must remain readable by the people who handle it. The log of actions Fasal staff take is append-only by design and is never deleted, so that nobody, including us, can quietly rewrite what was done to an account.

A tutor's Certificate of Good Conduct stops counting as current twelve months after we approve it, and the badge comes off their profile until they give us a new one.

For the owner to set with a lawyer: the exact number of years for financial records (Kenyan tax rules), for tutor check evidence, and for safety reports.

Your rights

Under Kenya's Data Protection Act 2019 you can ask to see the personal information we hold about you, ask us to correct it, ask us to delete it, and object to how we use it. You can change your name, phone number, area and notification settings yourself in the app at any time.

To make any of these requests, write to hello@fasal.app from the address on your account. We will reply within 30 days. If we have got something wrong and you are not satisfied with our answer, you can complain to the Office of the Data Protection Commissioner of Kenya.

Keeping it safe

Sign-in is by email and password. Fasal staff accounts additionally require a code from an authenticator app every time. Passwords are stored as secure hashes. Access rules are applied by the database on every single request, rather than by the app asking nicely.

Changes to this policy

If we change how we handle your information we will update this page and, where the change matters to you, tell you in the app.

Contact

Email hello@fasal.app for anything on this page, including a request to see or delete your information.