Privacy Policy

1. Who we are

Brian Wamwea, trading as Tihada, of 456, 00232 Ruiru, Kenya, is responsible for the personal information described in this policy. References to we, us, or our mean Tihada.

This policy covers our websites, creator storefronts, dashboards, checkout, purchase delivery, gifting, and related support services (the Service). Personal information means information that identifies you or can reasonably be linked to you. Our Terms of Service and Refund Policy explain the rules for using the Service.

2. Information we collect

What we collect depends on how you use Tihada:

• Accounts and profiles: your name, email address, phone number, authentication and account identifiers, storefront handle, biography, profile images, links, settings, and onboarding responses you choose to provide. If you continue with Google, we receive the profile information authorized through that sign-in, such as your name, email address, profile image, and provider identifier.
• Products and files: product descriptions, prices, images, uploaded files, and information needed to publish products and deliver access.
• Purchases and payments: your email address where required for delivery, payment phone number, items or gifts selected, amounts, transaction references, payment status, purchase access, refunds, and related correspondence. Payment providers send us confirmations and information needed to reconcile payments. We do not ask for or store your M-Pesa PIN.
• Gifts: payment details and, if you choose to include them, your supporter display name and message to the creator.
• Payouts and verification: payout phone number, account details, payout history, and legal name or identity information, including a national ID or passport number, if requested for verification or compliance.
• Support and safety: messages, reports, complaints, dispute evidence, and records of account or moderation actions.
• Technical and usage information: IP address, browser and device information, request and error logs, timestamps, and storefront or product visits. Our storefront analytics uses randomly generated visitor and session identifiers.

We collect information directly from you, automatically through use of the Service, and from authentication and payment providers. A creator may also give us information when asking us to help set up their storefront. Required fields are identified in the relevant flow. Without necessary contact, payment, login, or verification details, we may be unable to provide access, complete a transaction, or process a payout. Optional profile details, survey answers, gift names, and messages are voluntary.

3. How and why we use information

We use personal information to:

• create accounts, authenticate users, and operate creator storefronts;
• process purchases, gifts, refunds, settlement, and payouts;
• deliver digital products, purchase access, receipts, and transaction updates;
• answer support requests and resolve complaints or disputes;
• measure visits and sales, provide creator reports, and improve reliability;
• detect fraud, investigate misuse, protect accounts, and enforce our terms; and
• maintain financial records and meet applicable legal obligations.

Depending on the purpose, we rely on performance of a contract or steps you request before entering one; compliance with a legal obligation; legitimate interests in running, securing, and improving the Service, balanced against your rights; or your consent where required. Where we rely on consent, you may withdraw it at any time. Withdrawing consent does not affect processing that was lawful before withdrawal.

Service messages, such as receipts, security notices, and payout updates, are part of operating Tihada. If we send optional promotional messages, we will obtain consent where required and provide a way to unsubscribe. We do not sell personal information.

4. What creators can see

Creators receive storefront and product performance reports. Your published creator profile, storefront, links, and product listings are public and may be indexed by search engines. Do not put information in public content or a gift message that you do not want its audience to see.

Creators are responsible for their own use of information they receive, including complying with privacy law and obtaining any permission needed for marketing. A purchase alone does not authorize unrelated promotional messages.

5. Service providers and other sharing

We share information needed to operate the Service with providers of authentication, databases, file storage, hosting, payments, communications, and security. These include:

• Supabase for authentication, database services, and file storage;
• Railway and Cloudflare for hosting, delivery, and infrastructure;
• Palpluss and the relevant M-Pesa services for payment collection and payouts;
• our configured transactional email provider, Resend or Zoho ZeptoMail, for receipts and notifications; and
• Google when you use Google sign-in, and Google Fonts when a page loads hosted fonts.

Information shared depends on the task: for example, an email provider receives your address and message content, while a payment provider receives payment details and a transaction reference. Providers may also handle information for their own legal, fraud-prevention, or account purposes under their privacy policies.

Authorized personnel and professional advisers may access information where needed for support, operations, accounting, or legal advice. We may disclose information when required by law or reasonably necessary to investigate fraud, resolve a dispute, or protect people's rights and safety. If the business is transferred, relevant records may be transferred subject to applicable privacy requirements and notice where required.

6. Cookies and browser storage

Tihada and its providers use cookies or similar browser storage to maintain login sessions, remember settings, and support security. Blocking or clearing this storage can sign you out or prevent parts of the Service from working.

Storefront analytics records storefront visits and product views using identifiers stored in your browser's local storage for each creator storefront. These identifiers are pseudonymous, rather than anonymous: they distinguish repeat visits without using your name or email. A session expires after 30 minutes of inactivity, and a visitor identifier expires after 90 days of inactivity. An analytics session identifier may also be associated with checkout to measure conversion from visits to purchases.

You can manage cookies and site storage through your browser. Clearing storage resets stored identifiers and preferences; it does not prevent new identifiers on later visits. Contact us to object to analytics processing or ask about your privacy choices.

7. International transfers

We operate from Kenya and use infrastructure providers that may process or store information in other countries. Where information is transferred outside Kenya, we must meet applicable transfer requirements, including appropriate safeguards or another lawful basis. Depending on the transfer, safeguards may include contractual protections, access restrictions, and assessment of the recipient's protections. Contact us for information about safeguards relevant to your data.

8. How long we keep information

We keep information for as long as reasonably needed for its purpose. Account and storefront information is generally needed while you use the Service. Transaction, payout, refund, and verification records may need to be retained after account closure to meet legal or accounting requirements, resolve disputes, prevent fraud, or establish and defend legal claims. Support records are kept as needed to resolve and document the issue.

Our raw storefront visit and product-view records are scheduled for deletion after 90 days. Financial records and aggregated reporting have separate retention needs. When information is no longer needed, we delete it or anonymize it. Backup copies may remain until the relevant backup cycle expires, with access restricted in the meantime.

9. Security

We use technical and organizational measures designed to protect personal information, including encrypted connections, authentication, role-based access, restricted access to private product files, and operational logging. No internet service or storage system can guarantee complete security. Keep your login credentials and purchase access links private, and report suspected unauthorized access promptly. Where a personal data breach requires notification, we will notify the relevant authority and affected people as required by law.

10. Your rights and choices

Under Kenya's Data Protection Act and other applicable laws, you may have rights to be informed about use of your information, access it, correct inaccurate information, object to processing, request deletion or restriction, and receive a portable copy where applicable. These rights are subject to legal conditions and exceptions.

You can update available profile settings in your dashboard. For access, correction, deletion, account closure, an objection, or withdrawal of consent, email [email protected]. Include enough information to identify the relevant account or transaction. We may need to verify your identity before acting; do not send passwords or an M-Pesa PIN. We will respond within the period required by applicable law and explain if we must retain information or cannot fully fulfil a request.

If the GDPR applies to our processing of your information, its rights of access, rectification, erasure, restriction, portability, consent withdrawal, and objection also apply subject to its conditions. You may object to direct marketing at any time and complain to the competent supervisory authority, including where you live or work.

11. Children

Creator accounts are for people aged 18 or older. Buyers who lack legal capacity must act with a parent or legal guardian's permission and supervision, as described in our Terms. Where processing a child's information requires parental or guardian consent, we require that consent and applicable safeguards. If you believe a child has supplied information without the required authorization, contact us so we can investigate and take appropriate action.

12. Creator content and external services

Creator products and storefront links may take you to services operated by others. Their handling of information is governed by their own privacy notices. Review those notices before submitting information or using an external service. Contact the relevant creator about information collected independently through their products, forms, mailing lists, or external links.

13. Changes to this policy

We may update this policy as the Service or legal requirements change. We will publish the revised policy here and update its effective date. For material changes, we will provide additional notice where required and obtain fresh consent where necessary.

14. Contact and complaints

Send privacy questions or requests to [email protected].

Operator: Brian Wamwea, trading as Tihada
Postal address: 456, 00232 Ruiru, Kenya
Phone: +254 769 547 220

You may also lodge a complaint with Kenya's Office of the Data Protection Commissioner , without first contacting us.