Privacy Policy

1. Data controller and contact

The registered data controller/operating entity and a monitored privacy contact address must be identified before production launch. This draft does not assert completed registration or certification under Kenya's Data Protection Act, 2019.

2. Information collected

• For professional accounts: name, email, password hash, business profile, phone/WhatsApp number, service areas, service pricing and verification records when required.
• For customer enquiries: voluntarily provided name, phone number, service interest, message, time of consent and selected professional.
• For anonymous visitors: aggregated provider profile view counts without disclosing or storing named visitor identities through that feature.
• For billing: subscription plan, transaction references, payment status and reconciliation records. We do not request or store M-Pesa PINs.
• Technical operational information, such as security logs needed to detect abuse or safeguard the platform.

3. How information is used

To create and protect professional accounts, display eligible professional profiles, process consented enquiries, enable WhatsApp handoffs, maintain appointment requests, administer subscriptions, provide support, prevent fraud and meet applicable legal obligations.

We may analyze aggregated usage to improve geographic availability and discovery. Anonymous profile view counts are not a list of identifiable customers.

4. Contact consent and professional follow-up

A customer must actively opt in before their contact details are shared with a particular professional for follow-up. The professional receives only the details the customer chose to submit. Consent is limited to that enquiry; professionals must not convert it into permission for promotional campaigns.

Customers may withdraw future contact permission by informing the professional or contacting TABASAMU through the published support channel. Withdrawal does not invalidate lawful processing already carried out.

5. Legal grounds and sharing

Processing relies on consent where required, contractual necessity for accounts and subscriptions, legitimate operational/security interests where lawful, and legal obligations. We share enquiry details with the selected professional, payment details only with necessary payment processors, and service data with contracted infrastructure or email providers under appropriate safeguards.

WhatsApp is operated by a third party and may process information under its own terms and privacy policy when a customer chooses to open it. We do not sell customer phone numbers or anonymous visitor identities to professionals or advertisers.

6. Local storage and cookies

The customer app may store favourites, selected search preferences and swipe progress on the device. Secure, HTTP-only session cookies protect logged-in professional accounts. The current visit counter uses browser session storage to limit repeat counts during a visit, not to identify a named visitor.

7. Retention

Enquiry contact details are scheduled for deletion or anonymization after 90 days following the final relevant interaction, unless an active complaint, legal hold or lawful requirement makes longer retention necessary. A production retention job and rights-request workflow must be verified before launch.

Professional information remains while an account is maintained and as necessary for legitimate service, safety or statutory obligations. Financial records may be held for legally required periods. Session tokens expire after seven days.

8. Security and international transfers

TABASAMU uses access restrictions, encrypted transport, password hashing, private document storage and audit practices where deployed. No security measure is infallible. Cross-border hosting and subprocessor arrangements will be evaluated against applicable Kenyan data transfer requirements before production.

9. Your privacy rights

Subject to applicable law, people may request information about processing, access their data, seek correction, object to certain processing, withdraw consent and request deletion where appropriate. A usable, monitored contact method and request-handling procedure must be published prior to launch.

Individuals may contact Kenya's Office of the Data Protection Commissioner where applicable.

10. Children and policy changes

TABASAMU is intended for adults. We do not knowingly solicit children to submit direct booking enquiries without appropriate safeguards. Material privacy policy changes will be published with an updated date.