Privacy policy
Last updated 21 September 2026
Zaroda Books is run by Zaroda Solutions. This policy says what we collect, why we hold it, who else can see it, and what you can require of us. It is written to be read, not to be got past.
Who is responsible for what
There are two kinds of information here, and they are not ours in the same way.
Your account. Your name, email address, telephone number and the county you work in. We decide what to do with these, so for this information we are the data controller.
A school’s books. The receipts, payments, vote heads, enrolment figures and balances you enter. These belong to the school. We hold and process them on your instruction and do not use them for anything of our own, so for this information we are a data processor and the school — or the person keeping its books — is the controller.
What we collect, and why
| What | Why |
|---|---|
| Name, email, telephone number | To give you an account, reach you about it, and send an M-Pesa request |
| Password | Stored only as a scrypt hash. We cannot read it and neither can anyone else |
| County and sub-county | To show a school its own books, and to let a Ministry auditor see their area |
| School name, level, accounts, vote heads | To produce the books of accounts you came here for |
| Receipts, payments, balances, enrolment | The books themselves. Entered by you, derived into the reports |
| M-Pesa number and receipt number | To take the subscription and issue you a receipt for it |
| Sign-in device, IP address, browser | To show you your signed-in devices and let you sign one out |
| Failed sign-in attempts | To stop password guessing. Kept fifteen minutes, then deleted |
| An audit log of changes | So a school can see who changed what, which is what a book of account requires |
We do not collect anything about learners beyond an enrolment count, and we hold no learner names, no parent details and no fee records per child.
We do not sell anything, or advertise
We do not sell, rent or trade any of it. We do not advertise, we run no advertising trackers, and we do not build profiles. Zaroda Books earns its money from subscriptions and from nothing else.
Who else sees it
Only those who have to, and only what they need:
- People you invite. You decide their role and whether they see every school on your account or only one.
- Ministry internal auditors. An auditor granted a sub-county or county by us can read the books of schools in that area. They can change nothing, every school they open is recorded, and you can see who holds that access on your book settings page.
- Zaroda Solutions staff. We can open your books to help you, read only, and every such session is written to your audit log.
- Our suppliers, listed below.
Suppliers who process data for us
| Who | What they handle | Where |
|---|---|---|
| Neon | The database — everything above | Outside Kenya |
| Vercel | Runs the website | Outside Kenya |
| Tuma | M-Pesa subscription payments | Kenya |
| Safaricom | M-Pesa itself | Kenya |
| Resend | Sends our email | Outside Kenya |
Some of your information is stored outside Kenya. The Data Protection Act 2019 permits this where appropriate safeguards are in place, and our suppliers are bound by contract to protect it and to process it only on our instruction.
How long we keep it
A school’s books are kept for as long as you keep the account, and afterwards for as long as you may need them: books of account are records an auditor can ask for years later, and deleting them on the day a subscription lapses would do you harm. A closed year stays readable at no further cost.
Failed sign-in attempts are deleted after fifteen minutes. Password reset links expire after an hour. Invitations expire after fourteen days.
If you ask us to delete your account, we will — but tell us plainly, because for books of account it is not always the right thing, and it cannot be undone.
What you can require of us
Under the Data Protection Act 2019 you may ask us to:
- tell you what we hold about you, and give you a copy
- correct anything that is wrong
- delete what we hold, where we are not required to keep it
- stop processing it, or object to how we do
- hand it over in a form you can take elsewhere
Write to support@zarodasolutions.app. We will answer within thirty days. If you are not satisfied you may complain to the Office of the Data Protection Commissioner at odpc.go.ke.
Keeping it safe
- Everything travels over HTTPS
- Passwords are stored as scrypt hashes, never in a readable form
- Sign-in tokens and password reset links are stored hashed too
- Each account reaches only its own books; the boundary is enforced on the server
- You can see and sign out every device on your account
- Password attempts are limited, to stop guessing
No system is perfect. If something goes wrong that puts your information at risk, we will tell you and the Data Protection Commissioner, as the Act requires.
Cookies
One cookie, to keep you signed in, and a second short-lived one when a Zaroda administrator or an auditor is viewing books read-only. No advertising or analytics cookies of any kind.
Children
Zaroda Books is for school staff and accountants, not learners. We do not knowingly create accounts for anyone under eighteen.
Changes
If we change this policy we will change the date at the top, and tell you by email where the change matters.
Contact
Zaroda Solutions
support@zarodasolutions.app
0724 282 065 · WhatsApp 0781 230 805