Privacy Policy

Last updated: August 2026

Tush Inventory ("we", "our", "the platform") is a school inventory, fee, and clearance management system used by schools in Kenya. This policy explains what information we collect through the platform, why, and how it's protected. It applies to school staff using the system and, through them, to the student and guardian information schools enter into it.

1. What Information We Collect

Depending on how a school uses the platform, we may process:

• Staff accounts: name, username, email, phone number, role/department.
• Student records: name, admission number, class/stream, an optional photo, and clearance status entered by the school.
• Guardian contact details: name and phone number, entered by the school for fee-balance and general communication purposes.
• Financial records: fee balances and payment history entered by school Bursars/Secretaries — we do not process payments directly; this is a record of transactions the school has already handled elsewhere (e.g. M-Pesa, bank).
• Technical data: login timestamps and basic session information needed to keep accounts secure.

2. A Note on Children's Data

Because this platform is used by schools, some of the information stored (student records) relates to minors. This data is entered and controlled entirely by the school itself — we do not collect it directly from children, and access to it is restricted to authorized school staff based on their role (e.g. a Subject Teacher only sees items tied to their subject; fee data is restricted to the Principal, Bursar, and staff explicitly granted access).

3. How Information Is Used

• To let schools track inventory items, issue and clear them to students.
• To let schools record and track fee payments and balances.
• To generate clearance certificates and printable statements.
• To let school staff message parents/guardians about fee balances or school matters.
• To keep the platform secure (login throttling, session management).

We do not sell, rent, or share this data with advertisers or third parties for marketing.

4. Who Can See What

Access is role-based and scoped by school: one school can never see another school's data. Within a school, staff only see what their role permits — for example, a Subject Teacher cannot see fee data unless specifically granted, and a Bursar cannot edit inventory items unless specifically granted. School administrators (Principal, and anyone the Principal grants admin rights to) can see more broadly within their own school only.

5. Data Storage & Security

Data is stored on Render's managed PostgreSQL infrastructure. Passwords are hashed and never stored in plain text. All traffic to the platform is encrypted (HTTPS). Login attempts are rate-limited to reduce the risk of brute-force attacks.

6. Data Retention & Deletion

A school's data remains in the platform for as long as the school continues using it. A school administrator or Tush Inventory's system administrator can remove records on request. To request deletion of specific data, contact us using the details below.

7. Cookies

We use only the cookies necessary for the platform to function — keeping you logged in and protecting forms from cross-site attacks (CSRF). We do not use third-party advertising or tracking cookies.

8. Your Rights

Under Kenya's Data Protection Act, 2019, individuals have rights to access, correct, or request deletion of their personal data. If you are a parent, guardian, staff member, or student and want to exercise these rights, please contact your school directly (as the primary data controller for their own records) or reach us using the details below.

9. Contact Us

Questions about this policy or a specific data request can be sent to info.tushinventory@gmail.com or through our contact form.