Privacy

Privacy policy

Fasal helps parents across Kenya find a checked tutor. To do that we hold information about parents, their children and tutors. This page says exactly what we hold, who can see it, and what you can ask us to do with it.

Effective date: 2 October 2026. Contact: hello@fasal.app

Who is responsible for your information

Fasal decides what information is collected and why, which makes Fasal the data controller for the purposes of Kenya's Data Protection Act 2019. Write to us about anything on this page at hello@fasal.app and a person will answer.

What we collect

If you are a parent

• Your name, email address and password. The password is stored only as a secure hash. Nobody at Fasal can read it.
• A phone number, if you choose to add one. It is optional, and it is not used to sign in.
• The area you are in, and your preferred language.
• The first name and school grade of each child you add.
• Your bookings: the tutor, subject, date and time, whether the lesson is at home or online, and the price.
• Payment details you type in: the M-Pesa confirmation code for a lesson. Fasal records the transaction code it matched against its own M-Pesa statement. We never see or store your M-Pesa PIN, and Fasal does not take money from your phone. You send it.
• Messages you send to tutors and to the Fasal team.
• Any safety concern you report, and reviews you leave.

If you are a tutor

• Your name, email address and password, and an optional phone number.
• Your public profile: subjects, school grades, curricula, languages, the area you teach in, whether you teach online, your hourly price, and what you write about yourself.
• The evidence we check you on: a copy of your national ID, your Certificate of Good Conduct from the DCI, qualification certificates, and your TSC number if you have one.
• The names and phone numbers of the two referees you give us, and a note of what they said when we phoned them.
• Notes from your interview and your scored demo lesson.
• Your M-Pesa number, so we can pay you.
• Your free hours, your bookings, the reports you write after lessons, and your messages.

Everyone

• Notifications we have sent you, and your notification settings.
• A record of actions taken by Fasal staff on your account, for example approving a document or confirming a payment. This log cannot be edited or deleted, including by us.

We do not use advertising, we do not run analytics or tracking scripts, and we do not place advertising or tracking cookies. The app stores a sign-in token in your browser so you stay signed in, and remembers small preferences on your own device.

Children's information

A child never has a Fasal account. We hold only the first name and school grade that you, the parent, type in, so a tutor knows who they are teaching and at what level. A tutor sees that first name and grade only once you have booked them.

Kenya's Data Protection Act 2019 sets extra conditions for handling a child's personal data. In Fasal those conditions are met in the following way: only a parent or guardian, signed in to their own adult account, can add a child, and adding one is what gives us your consent to hold that first name and grade. We collect the minimum a tutor needs to teach the right child at the right level, we do not build a profile of your child, and we never show a child's details to anyone other than you, the tutor you booked, and the Fasal staff who handle safety. You can change or remove a child at any time, and closing your account removes them with it.

Who can see what

These limits are enforced by the database itself, not only by our staff rules, so they hold even if somebody uses the app in a way we did not expect.

• Anyone, signed in or not, can see a live tutor's public card: their name, initials, subjects, area, price, rating and which checks they passed. Nothing private appears there.
• A parent sees only their own account, children, bookings, messages and notifications.
• A tutor sees your first name, your child's first name and grade, and your area, and only for a lesson you have booked with them. A tutor cannot browse parents.
• The Fasal team can see accounts, tutor documents, bookings and payments, in order to run the checks and confirm payments. Every action a staff member takes is written to the log described above.
• Nobody at Fasal can read the messages between a parent and a tutor. Staff can see that a conversation exists, never what is in it. This is enforced in the database.
• Tutor documents (ID, Certificate of Good Conduct, certificates) are kept in private storage that only that tutor and Fasal staff can open.

Where your information is stored

Our database, private document storage and accounts system are hosted with a cloud infrastructure provider in London, United Kingdom. This means your information leaves Kenya and is stored abroad. The website itself is served from Hostinger.

Two font services, Google Fonts and Fontshare, deliver the typefaces used on these pages. When your browser fetches a font, those services receive your IP address. They receive nothing else, and we send them no information about you.

Kenya's Data Protection Act 2019 restricts moving personal data out of the country. We rely on the transfer being necessary to perform the service you asked us for: Fasal cannot show you tutors, hold your bookings or carry your messages without a database, and that database is hosted abroad. Our infrastructure provider processes this information only on our instructions, under its own security and data-protection terms, and it is not used for anything else.

How long we keep it

We keep your account and everything attached to it for as long as you use Fasal. You can ask us to delete your account at any time, from the app or by email. We will delete it after seven days. You can change your mind until then. When we delete it, everything in it goes permanently: your profile, your children's details, your saved tutors, your messages, your lessons and reviews, safety reports made by you or about you, and, for tutors, your photo, documents, references and checks.

Lesson fees are paid by M-Pesa, so the record of each payment is also held by M-Pesa, outside Fasal: on your own M-Pesa statement and on Fasal's. Deleting your Fasal account does not change those statements; they are kept by M-Pesa under its own terms.

The log of actions Fasal staff take is append-only by design, so that nobody, including us, can quietly rewrite what was done to an account. When an account is deleted, its entries stay but your name is removed from them.

A tutor's Certificate of Good Conduct stops counting as current twelve months after we approve it, and the badge comes off their profile until they give us a new one.

Your rights

Under Kenya's Data Protection Act 2019 you can ask to see the personal information we hold about you, ask us to correct it, ask us to delete it, and object to how we use it. You can change your name, phone number, area and notification settings yourself in the app at any time.

To make any of these requests, write to hello@fasal.app from the address on your account. We will reply within 30 days. If we have got something wrong and you are not satisfied with our answer, you can complain to the Office of the Data Protection Commissioner of Kenya.

Keeping it safe

Sign-in is by email and password. Fasal staff accounts additionally require a code from an authenticator app every time. Passwords are stored as secure hashes. Access rules are applied by the database on every single request, rather than by the app asking nicely.

Changes to this policy

If we change how we handle your information we will update this page and, where the change matters to you, tell you in the app.

Contact

Email hello@fasal.app for anything on this page, including a request to see or delete your information.