The CBC App is a school records and reporting service made by Verb Education Ltd ("Verb Education", "we", "us"). This policy explains what personal data we handle when you visit cbcapp.co.ke or when a school uses the CBC App, what we do with it, who receives it, how long we keep it, and how you can control it.
It applies in addition to the End User License Agreement. It follows the Kenya Data Protection Act, 2019.
1. Who is responsible for your data
Our role depends on the data.
- Website visitors and people who contact us. We are the data controller. We decide why and how this data is used.
- Data a school puts into the CBC App. The school is the data controller. We are its data processor. We handle learner, parent, teacher and fee data only on the school's instructions and for the school's purposes. A parent or learner who wants to use a data right over school records should contact the school first. We help the school respond.
Verb Education is registered with the Office of the Data Protection Commissioner (ODPC) of Kenya, registration number 875-3756-5B2B.
2. Data from this website
The website has no accounts, no advertising and no analytics or tracking scripts. We collect the following.
| Data | Why we use it | Basis |
|---|---|---|
| Server logs: IP address, date and time, page requested, browser type. | To keep the site secure and working, and to find faults. | Our legitimate interest in running a secure service. |
| What you send when you request a demo or a quote through our Microsoft Forms page: name, school, role, phone number, email address, message. | To reply to you and arrange a demo or quote. | Your request. Steps taken at your request before an agreement. |
| What you send when you contact us by email, phone or WhatsApp. | To answer you and keep a record of the conversation. | Your request. Our legitimate interest in handling enquiries. |
The Microsoft Forms page is run by Microsoft, which handles what you enter under its own privacy statement. A video on this site loads from YouTube (youtube-nocookie.com) only after you press play. Before that, no request goes to YouTube.
We keep server logs for up to 90 days. We keep enquiry records for up to 24 months after the last contact, unless you become a customer.
3. Data in the CBC App
A school decides what goes into its CBC App account. Typically it includes the following.
| Whose data | What |
|---|---|
| Teachers and school staff | Name, work email address, phone number, role, login details, and the schemes of work, lesson plans and assessment records they create. |
| Learners | Name, admission number, class, attendance, assessment results, progress reports and recorded behaviour or disciplinary incidents. |
| Parents and guardians | Name, phone number and email address, used to send reports and notices. |
| Fee information (only if the school connects QuickBooks) | See section 5. |
We use this data to do the following, and for nothing else:
- provide the CBC App to the school: store records, produce analytics and reports, and show school leaders what teachers have submitted;
- send learner reports and notices to parents by SMS or email when the school asks us to;
- give the school support, fix faults and keep the service secure;
- meet legal duties.
We do not sell personal data. We do not show advertising. We do not use school data to build marketing profiles. We use school data in aggregated form only to measure how the service performs, with no learner, parent or teacher identifiable in the result.
4. Learners and children
Most learner records are about children. The school, as controller, is responsible for having a lawful basis to process them and for giving parents and guardians the notices and obtaining the consent that the Data Protection Act requires. We process children's data only for the school's educational and administrative purposes. We never contact a learner directly, and we never use a learner's data for advertising or profiling.
If you are a parent or guardian and want to see, correct or delete a learner's record, contact the school. If you cannot reach the school, write to us at the address in section 14 and we will pass your request to the school and tell you we did.
5. QuickBooks Online and Intuit
A school can connect its QuickBooks Online company to the CBC App so that fee status shows next to learner records. This section describes that connection. The connection is optional and off until a school administrator turns it on.
What we ask Intuit for
When an administrator connects QuickBooks, Intuit shows a consent screen. If the administrator accepts, Intuit gives the CBC App a limited access token through OAuth 2.0. We never see or store the administrator's QuickBooks password. We use the token only to read data. The CBC App does not create, change or delete anything in QuickBooks.
We read these records from the connected company:
- customer records: name, contact details and the customer reference;
- invoices: number, date, due date, amount and balance;
- payments: date, amount and the invoice each payment applies to;
- the company name and QuickBooks company ID, to label the connection.
We do not read bank account numbers, card numbers, payroll data, tax filings or any other part of the company file.
How we use QuickBooks data
- We use it only to show that school's administrators the fee status of that school's learners inside the CBC App.
- We do not sell it, rent it, or share it with third parties, except the infrastructure providers in section 7 that store it for us under contract.
- We do not use it for advertising, marketing, credit scoring or profiling.
- We do not use it to train or improve any machine learning or AI model, ours or anyone else's.
- We do not combine one school's QuickBooks data with another school's data.
- We do not write QuickBooks data into application logs.
How long we keep it, and how to disconnect
A school can disconnect QuickBooks at any time, in either of two ways: in the CBC App settings under Integrations, or in QuickBooks from the connected apps page. On disconnect we revoke the access token and stop all syncing at once. We delete the stored copy of that school's QuickBooks data within 30 days. Backups that contain it are overwritten within a further 60 days. A school can ask us to delete it sooner by writing to the address in section 14.
If Intuit tells us that a school has revoked our access, or the token expires and the school does not renew it, we treat that as a disconnect.
Intuit's own privacy practices
QuickBooks is a product of Intuit Inc. Intuit handles the data in QuickBooks under the Intuit Privacy Statement. This policy covers only the copy that reaches the CBC App.
6. AI features
The CBC App can suggest schemes of work, lesson plans and assessment ideas. To produce a suggestion we send the teacher's lesson-planning inputs (subject, grade, topic and similar text) to Google. We do not send learner names, learner records, parent details or QuickBooks data to an AI provider. The provider may not use what we send to train its models. A teacher must review every suggestion before using it.
7. Who receives data
We share personal data only with these groups.
| Recipient | Purpose |
|---|---|
| Alphabet Inc. (Google), Ireland | Hosts the CBC App and its database, delivers email reports and notices, and produces lesson-plan suggestions (section 6). |
| Africa's Talking, Kenya | Delivers SMS reports and notices to parents. |
| Microsoft | Runs the demo and quote request form on this site. |
| Intuit | Provides QuickBooks Online, only when a school connects it. |
| Professional advisers, courts and authorities | When the law requires it, or to protect our legal rights. |
Each provider that handles school data for us is bound by a written contract that limits its use to the service we buy and requires it to protect the data. If Verb Education is sold or merged, school data stays under this policy and the buyer must honour it, or we tell the school first and the school may export and delete its data.
8. Where data is stored
School data is stored by Alphabet Inc. (Google) in Ireland. Ireland is outside Kenya, so we transfer the data under the safeguards the Data Protection Act allows: a written contract with the provider and, where the Act requires it, consent. Google may also handle email and AI requests in other countries where it operates, under the same safeguards. SMS messages are delivered by Africa's Talking in Kenya.
9. How long we keep data
| Data | How long |
|---|---|
| School records in the CBC App | While the school's subscription is active. After it ends, the school can export its data for 30 days. We then delete it within a further 60 days, unless the law requires us to keep it. |
| QuickBooks data | Until the school disconnects, then deleted within 30 days (section 5). |
| Server logs | Up to 90 days. |
| Enquiries and demo requests | Up to 24 months after the last contact. |
| Invoices and payment records for our own accounts | Seven years, as Kenyan tax law requires. |
10. Security
- All traffic to the website and the CBC App uses HTTPS.
- Access to school data is limited by role: each user sees only what the school allows.
- QuickBooks access tokens are encrypted when stored.
- Our staff can reach school data only when needed to support that school, and the access is logged.
- We tell the school, and the ODPC where the law requires, if a breach affects personal data. We do this within 72 hours of becoming aware of it.
No system is free of risk. If you believe your account is compromised, write to us at once.
11. Your rights
Under the Data Protection Act you can ask to be told what data we hold about you, get a copy, correct it, delete it, object to its use, and in some cases receive it in a portable format. To use a right over data we hold as controller (section 2), write to the address in section 14. We reply within seven days and finish within the time the Act allows. To use a right over school records (section 3), contact the school.
If you are not satisfied, you can complain to the Office of the Data Protection Commissioner of Kenya.
12. Cookies
This website sets no cookies. The CBC App at cloud.cbcapp.co.ke sets one session cookie, needed to keep you logged in. It holds no advertising or tracking data and is deleted when the session ends.
13. Changes to this policy
We change this policy when our practices or the law change. The date at the top shows the latest version. For a material change we email each school's administrator at least 30 days before it takes effect.
14. Contact us
Verb Education Ltd
D2 Muguku House, Kikuyu, Kenya
Email, for privacy requests and support: support@cbcapp.co.ke
Phone and WhatsApp: 0718 593 059