Privacy policy

Who is responsible for your data

The data controller is Cadi, operating cadi.taifa.ke. ODPC registration number: [ODPC registration number] (placeholder, to be completed before launch). Contact for anything in this policy: cadi@taifa.ke.

We follow the Kenya Data Protection Act, 2019.

What we collect

• Account: your email address, and the name, phone number, language and optional gender you choose to add.
• Your card: the profile, links, photos and theme you put on it. Anything on a public card is visible to anyone with the link.
• Contacts people share: when a visitor uses Exchange or a signup block, the details they type (name, email or phone, a note) are saved for you.
• Analytics events: views, link clicks, saves and scans on your card, with the source (link, QR, NFC), device type, and country and city at a coarse level. We do not store raw IP addresses in analytics events.
• Security data: session records and short-lived rate limit counters, which may include an IP address or browser details while they are active.

Why we use it

To sign you in, show your card, deliver contacts to you, show you how your card is doing, keep the service secure, and answer your questions. Our lawful bases are your consent, the contract to provide the service, and our legitimate interest in running it safely. We do not sell personal data and we do not use it for advertising.

Who processes it for us

• Taifa Mail sends our emails (sign-in codes and notifications).
• Our hosting provider stores the database and uploaded files.
• Google Fonts serves the typefaces used on our pages, which means your browser contacts Google when a page loads.

We will list any new processor here before we start using it.

How long we keep it

• Account, card and contacts: until you delete them or your account.
• Sign-in codes: ten minutes. Sessions: until they expire or you log out.
• Analytics events: kept while your card exists, then deleted with it.
• After you delete your account we remove your data from live systems, and from backups as they rotate out.

Your rights: access, export and deletion

You can see and correct your data in the app. You can download a copy of everything we hold about you from Settings (export), and delete your account there too. You may also object to or restrict processing, withdraw consent, and ask us for a copy of your data in writing at cadi@taifa.ke. We aim to reply within 30 days.

If you share someone else's details with us, you are responsible for having a good reason to do so.

Where data is stored

Data may be processed outside Kenya by our processors. Where that happens we rely on safeguards that the Data Protection Act allows. Details will be completed in the final version of this policy.

Cookies and local storage

We use one cookie to keep you signed in, and your browser's local storage for settings such as your theme and language. We use no advertising or cross-site tracking cookies.

Children

Cadi is not meant for children under 18, and we do not knowingly collect their data.

Complaints

Tell us first at cadi@taifa.ke and we will try to fix it. You also have the right to complain to the Office of the Data Protection Commissioner (ODPC) in Kenya.

Changes to this policy

When this draft is reviewed and finalised we will update the date above and tell signed-in users about material changes.