Privacy policy

1. Who we are

Nuru is a product of Databit Limited, a technology company registered in Kenya. When this policy says "we" or "us", it means Databit Limited.

This policy explains how we handle personal data under Kenya's Data Protection Act, 2019 and its regulations. It covers the Nuru website, the Nuru apps for owners, educators and parents, and any email you send us.

2. Nurseries decide, we look after

For the records a nursery keeps in Nuru, such as children's details, attendance, daily diaries, messages and photos, the nursery is the data controller and we are its data processor. The nursery decides what is collected and why. We handle it only on the nursery's instructions, under our data processing agreement.

If you are a parent with a question about your child's records, the nursery is the first place to ask. We will help them answer.

3. What we collect ourselves

For running Nuru as a business, we are the data controller for:

• Account details: name, email address, phone number and role (owner, educator or parent).
• Nursery details: the nursery's name, country, time zone, approximate number of children and educators, and its billing contact.
• How the service is used: sign-in times, device and browser type, and error reports, so we can keep Nuru secure and working.
• Anything you send us, such as an email or a support request.

4. Children's records

A nursery can keep these records about each child in Nuru:

• Name, date of birth, gender, room and a profile photo.
• Allergies, medication given and other notes needed to keep the child safe.
• Attendance: when the child was checked in and out, and by whom.
• The daily diary: meals, naps, nappies, mood and photos.
• Contacts: names, phone numbers, relationships and who may collect the child.
• Messages between the child's parents and the nursery, and posts the nursery shares.

Only the nursery's owner and educators, and the parents linked to that child, can see a child's records. Each nursery's records are kept separate from every other nursery's, and parents only ever see their own children.

Allergies and medication are health information, which the law treats as sensitive. Nurseries must have a parent's consent before adding a child to Nuru. We give nurseries a parent consent form they can use.

5. How we use information

• To run Nuru: showing the right records to the right people, sending sign-in links and invitations, and keeping messages and diaries in order.
• To keep Nuru secure: checking sign-ins, stopping automated abuse and investigating problems.
• To support you when you ask for help.
• To manage your nursery's subscription and send service emails, such as a trial ending or a change to these terms.

We never sell personal data, never show adverts and never build profiles of children or parents. We never use children's records for marketing, and we never use them to train artificial intelligence models.

We rely on the contract with the nursery to run the service, our legitimate interest in keeping it secure and working, and our legal obligations. Where the law requires consent, the nursery collects it.

6. Who else handles data

We use a small number of service providers to run Nuru:

• Supabase: our database, sign-in and file storage, and the emails that carry sign-in links. Data is stored in the European Union (Ireland).
• Cloudflare: serves the Nuru website and apps from its worldwide network, and runs Turnstile, which checks that the person signing in or signing up is not an automated program. Requests pass through Cloudflare, but it does not store your records.
• Google Fonts: supplies the typefaces the website uses, so Google receives your device's internet address when a page loads.

Each provider may only use the data to provide its service to us. The data processing agreement lists the providers who handle nursery records.

We will share data with the police, a court or a regulator only when the law requires us to. If Nuru is ever sold or merged, records would move to the new owner under the same promises, and we would tell nurseries first.

7. Where data is stored

Nuru's database and files are stored in the European Union (Ireland). That is a transfer of data outside Kenya, which the Data Protection Act allows when there are appropriate safeguards. Our provider protects the data under European Union data protection law, and our agreements with it require the same standard of care.

Because health information is sensitive, the parent consent form asks parents to agree to their child's records being stored outside Kenya.

8. How long we keep it

• While a nursery uses Nuru, its records are kept until the nursery deletes them.
• When a child leaves, the nursery decides how long to keep their records, in line with the law and its own policies.
• When a nursery closes its account, it has 30 days to ask us for a copy of its records. We then delete them within 90 days.
• Security logs are kept only as long as we need them to keep Nuru safe.

9. Your rights

Under Kenya's Data Protection Act, you have the right to:

• Be told how your personal data is used.
• Get a copy of your personal data.
• Have wrong or incomplete data corrected.
• Have data deleted when it is no longer needed or was collected unlawfully.
• Object to how your data is used.
• Receive your data in a form you can take elsewhere.

Parents can use these rights for their children. For records the nursery keeps, start with the nursery. For anything else, email hello@nurucare.app. We may ask you to prove who you are before we act.

If you are unhappy with how we handle your data, you can complain to the Office of the Data Protection Commissioner at odpc.go.ke.

10. Security and breaches

Records are encrypted in transit and at rest, photos are kept in private storage, and every request is checked against who is asking. The data security page explains how.

If a breach affects a nursery's records, we tell the nursery without delay. Together we tell the Office of the Data Protection Commissioner within 72 hours, and the people affected where the law requires it.

11. Nuru accounts are for adults

Children do not use Nuru. Accounts are for nursery owners, educators and parents or guardians.

12. Changes and contact

If we change this policy in a way that matters, we will tell nurseries by email before the change takes effect. The date at the top shows when it last changed.

Questions or requests: hello@nurucare.app.