Legal
Privacy Policy
Last updated: 8 July 2026. PitchKambi Limited is registered as a Data Controller and Data Processor with the Office of the Data Protection Commissioner (ODPC), Kenya. This policy reflects our referral-only intake model, receivers (Jiranis) are always introduced by a trusted community member and never sign themselves up, so we hold minimum personal data by design.
1. Who controls your data
2. What data we collect
| Data type | Who it applies to | Why |
|---|---|---|
| Name, email, phone | Mfadhili, Kituo | Account creation and communication |
| M-Pesa reference | Mfadhili, Kituo | Transaction records (KRA 7yr requirement) |
| First name, area, need description | Jirani | Platform functionality (anonymised publicly) |
| PPB licence, business permit | Chemist Kituos | Regulatory verification |
| Business permit / ID | Food Kituos | Identity verification |
| IP address, device type | All users | Security and fraud detection |
| Session cookies | All users | Platform functionality |
3. How we use your data
- To operate the Wemaflows platform.
- To process M-Pesa payments and issue receipts.
- To verify Kituo identities and licences.
- To display Jirani profiles in a privacy-protected form.
- To send transaction notifications via SMS and email.
- To comply with KRA, ODPC, and other regulatory requirements.
We never sell your data. We never use it for advertising.
4. Data anonymisation, Jirani profiles
Jirani profiles are designed for maximum privacy.
Shown publicly
- First name only (e.g. "Grace")
- Sub-county only, never street
- Need category, medicine or food
- Admin-edited dignity story (no medical specifics)
- Illustrated avatar (not a real photo)
Never shown publicly
- Last name
- Phone number
- National ID
- Medical details / diagnosis
- Who introduced them
- Total amount received
- Real photographs (unless admin-approved with consent)
5. Name display, all users
- Jirani, first name only on the browse page (e.g. "Grace"). Pickup code (e.g. GW001) is shown only to a Mfadhili who has purchased for them.
- Mfadhili, shown to a Jirani only as "Anonymous" or first name plus last initial (e.g. "James M."), never full name.
- Kituo, shop name is shown; the owner's personal name is never shown publicly.
6. Data sharing
We share data only with:
- Africa's Talking (SMS delivery), phone numbers only.
- Resend (email delivery), email address and message content.
- Our infrastructure provider, encrypted at rest, access-controlled.
- Kenya Revenue Authority, anonymised transaction records as legally required.
- Office of the Data Protection Commissioner, as required by KDPA.
7. Data retention
| Data type | Retention period | Action at expiry |
|---|---|---|
| Active user profiles | While account is active | Anonymised within 72hrs of deletion request |
| Jirani profiles | While active | Anonymised / deleted on deactivation |
| Transaction records | 7 years (KRA) | PII anonymised, transaction data retained |
| Pickup photos | 90 days | Auto-deleted by scheduled job |
| SMS logs | 6 months | Purged |
| Admin messages | 24 months | Content anonymised, thread structure retained |
| Audit trail | 36 months | Purged |
| Abandoned signups | 24 hours | Hard deleted |
| Session / analytics cookies | 12 months | Expired |
8. Account deletion, hard delete protocol
When an account deletion is confirmed (after the 72-hour freeze), we permanently anonymise your personal information: name is replaced with "Deleted User", email is replaced with a non-routable anonymous token, phone is removed, and all message contents linked to the account are replaced with "[Message removed]". Anonymised payment records are retained for 7 years per KRA requirements, but they no longer identify you.
9. Your rights under the KDPA 2019
You have the right to:
- Access, request a copy of your personal data.
- Correction, request correction of inaccurate data.
- Deletion, request deletion of your account and data.
- Restriction, request that we stop processing your data.
- Objection, object to processing for direct marketing.
Submit requests via Settings → Privacy → My Data or email privacy@wemaflows.co.ke. Response time: 21 days (KDPA requirement). A countdown is shown in your account.
10. Cookies
11. Security
- All data encrypted at rest (AES-256) and in transit (TLS 1.3).
- Row-level security enforced on all database tables.
- Admin access requires 2FA (TOTP).
- Document URLs are signed and expire after 15 minutes.
- Every admin data access is logged in the audit trail.
12. PII scanner
13. Children's data
14. Cross-border transfers
15. Data Protection Officer
Address: PitchKambi Limited, Nairobi, Kenya