Privacy and data

The school is the one who decides what to record about its learners and families. PlanWise stores and processes that information on the school’s behalf and does not use it for anything of its own. We do not sell it, we do not advertise against it, and we do not use it to train models.

Each school’s records are separate. A school can only ever read its own learners, staff and payments.

• Name, date of birth, gender, admission number, class and stream.
• Admission date, and where they came from or went to if the school records it.
• Birth certificate number and home area, where the school collects them.
• Attendance, and any absence the school records.
• Fees owed, invoices, and payments received.

Health information is deliberately not held. PlanWise records food allergies, a preferred hospital, and a doctor’s name and phone number. That is all, and each exists because the school has to act on it: what the kitchen must not serve, where to take a child, and who to ring when no guardian can be reached. Conditions, medication, diagnoses, blood group and immunisation history are not collected and cannot be stored here.

• Name, relationship to the child, and phone numbers.
• Email address and home address, where given.
• Occupation and national ID number, where the school records them.
• Whether they are authorised to collect the child, and whether they have a sign-in to the parent portal.
• Emergency contacts: a name, a relationship and a phone number for someone to call when a parent cannot be reached.

A parent with a sign-in sees their own children and nobody else’s.

Name, contact details, role, employment details the school records, attendance, and requests to be away from work along with who approved them.

Fees are paid to the school’s own M-Pesa paybill. Money never passes through PlanWise and PlanWise never holds a school’s funds. What is stored is the record of a payment: the amount, the method, the M-Pesa transaction code where there is one, and the receipt issued for it.

A school’s M-Pesa API credentials are encrypted before they are stored and are never sent to a browser.

When a school sends an SMS or an email to parents, PlanWise records what was sent, to which number or address, when, and whether it was delivered. That record is what lets a school answer “we did tell you, on this number, at this time” when a payment or a notice is disputed.

Passwords are stored only as a hash and cannot be read back by anyone, including us. Sessions are recorded so that changing a password signs other devices out, and so an administrator can end a session that should not continue.

There is no self-service password reset, deliberately. A password is issued by whoever is above you and replaced when you first use it, because anyone able to guess an address could otherwise lock a school’s administrator out of their own system.

PlanWise runs on Vercel, with the database managed by Prisma. SMS is sent through Africa’s Talking and email through Resend. Payments are handled by Safaricom’s Daraja API, directly between the parent and the school’s paybill. Each of these processes data only so that PlanWise can do what the school asked it to.

A learner who leaves is marked transferred, graduated or withdrawn rather than deleted. Their record stays so that the school can still answer questions about fees paid and attendance in the years they were there, and so that a receipt already given to a parent still means something. They stop counting towards the school’s plan.

A school that leaves PlanWise can ask for its data to be exported and deleted.

If you are a parent or a member of staff, the school holding your records is the first place to ask. They can correct what is wrong, and they can tell you what is held. Write to us at hello@planwise.co.ke if your school cannot help, or if you want to raise something about PlanWise itself.