Privacy policy

What this covers

This policy explains how we handle personal data when you create a page, send chai, or visit chaipointke.vercel.app. We follow Kenya’s Data Protection Act, 2019.

What we collect

• Creators: name, username, email, phone, bio, optional website, cover and profile photos, and payout details (M-Pesa number, bank account, or till).
• Supporters: the M-Pesa number used for STK Push, optional name, and optional message.
• Technical: session cookies so you stay signed in, and basic server logs to keep the product running.

Why we use it

To run your page, send magic-link and payout emails, process M-Pesa STK Push, pay you to the bank or till you chose, and keep the service secure. We do not sell your data. We do not email your supporters.

Who else sees it

Payments go through M-Pesa. Emails go through our email provider. Sign-in with Google uses Google OAuth. Hosting and storage are with our cloud providers. Public pages show your name, username, bio, photos, website, and supporter notes you allow on the page — not your email, full account number, or till.

How long we keep it

We keep account and payment records while your page exists and as long as we need them for payouts, fraud, and the law. You can ask us to close an account and we will delete or anonymise what we no longer need.

Your rights

You can access, correct, or request deletion of your data, and object to processing that is not required to run the service. Write to us from the email on your ChaiPoint account, or use the Help page. You may also contact Kenya’s Office of the Data Protection Commissioner.

Cookies

We use an HttpOnly session cookie to keep you logged in, plus a short-lived cookie for Google sign-up. We do not run advertising trackers.