Privacy Policy
Effective: 4 October 2026 · Version 2026-10-04
This policy explains what personal data Thamanisha (the website, web app, mobile app and API — the "Service") processes, why, who else processes it and where, how long it is kept, and the rights you have under the Kenya Data Protection Act, 2019 (the "DPA") and its Regulations.
1. Who is responsible for your data
The data controller is Thamanisha. The registered legal entity that operates Thamanisha will be named here once incorporated. Contact for anything in this policy: privacy@thamanisha.com.
2. What we process, why, on what basis, and for how long
Balances, holdings and similar figures you give us are property details, which the DPA treats as sensitive personal data. We process them only with your consent and only to show them back to you.
| Purpose | Data | Lawful basis (DPA s.30) | Kept for |
|---|---|---|---|
| Your account and sign-in | Email and/or phone number, sign-in identifiers, sign-in method. We never see your password — sign-in is handled by Firebase Authentication. | Contract | Until you delete your account |
| Your money records | Accounts and balances you add, goals, budgets and spending, sweep rules, holdings, Chama records, notifications | Consent (sensitive data) and contract | Until you delete them or your account. A revoked account's name and balance are deleted within 48 hours; a consent receipt (provider, permissions, dates granted and revoked) is kept as proof until you delete your account. |
| Accounting connections (QuickBooks, Zoho Books) | Read-only ledger data fetched on demand; an OAuth access token, encrypted with AES-256-GCM on top of database encryption | Consent | Token deleted the moment you revoke; book name and sync time within 48 hours; consent receipt until you delete your account |
| Financial Coach | The messages you send (see section 3) | Consent | We do not store conversation content on our servers. We keep a daily count of questions asked, to apply plan limits. |
| Document analysis (uploads) | The file you upload (statement, payslip, receipt) and the figures read from it | Consent | We do not store the file. It is sent to the AI provider, the result is returned to your browser and kept only on your device. |
| Payments, subscriptions and receipts | Plan, payment reference, amount, currency, payment method, email, provider customer reference. Card and M-Pesa credentials are held by the payment provider, never by us. | Contract; legal obligation (tax records) | Plan and provider link until your subscription is cancelled. When you delete your account, your payment events are deleted, but first a pseudonymised tax record of each payment and refund is kept (see "Tax records" below). The payment provider keeps its own transaction records under its legal obligations. Chargeback fraud-prevention entries are kept. |
| Emails and alerts you ask for | Email address, alert preferences, push-device token | Consent | Until you unsubscribe or delete your account |
| Support | What you write to us and your contact details | Contract; legitimate interest | As long as needed to resolve your request, then deleted on request |
| WhatsApp and USSD coach channels | Your phone number and the messages / menu choices you send | Consent (you start the conversation) | Not stored by us beyond answering; message IDs are held in memory for about 10 minutes to avoid double replies |
| Security and abuse prevention | IP address, request metadata, bot-detection signals, rate-limit counters | Legitimate interest | Short-lived counters; hosting logs per our host's log retention |
| Fixing errors (where enabled) | Error message, stack trace, browser/device version — not your financial data | Legitimate interest | Per our error-monitoring retention setting |
| Product analytics (where enabled) | Curated usage events and a pseudonymous account ID. No email, phone, financial values or raw URLs; no session recording or automatic click capture. | Legitimate interest | Per our analytics retention setting; email us to have them deleted |
| Proof of what you agreed to | Which version of these terms / this policy you accepted or withdrew, and when (server time) | Legal obligation (to demonstrate consent, DPA s.32) | Until you delete your account |
| Tax records (after you delete your account) | Per payment or refund: receipt number, date, amount, currency, plan or product, payment provider and its reference, and the KRA eTIMS invoice number if one was issued. No name, email, phone number or user ID — filed under a keyed one-way hash of your user ID, so we can find them if you ask, and no one can tell whose they are from the records alone. | Legal obligation (DPA s.30(1)(b)(ii); Tax Procedures Act, 2015 s.23) | 5 years from the end of the tax year of the payment, then deleted automatically |
| Proof of erasure | A one-way hash of your user ID, the deletion date and the categories erased | Legal obligation; legitimate interest | Kept after deletion; it cannot be used to recover your data |
3. AI processing
- The Financial Coach and document analysis use large language models from Google (Gemini), with Anthropic (Claude) as a fallback, reached through the Vercel AI Gateway. All three operate outside Kenya (see section 5).
- What is sent: the messages you type to the coach, or the file you upload for analysis. Nothing else from your account is attached.
- Your personal finances are not sent to the coach. A personalised snapshot of your balances and goals would turn education into personalised advice, which requires a Capital Markets Authority licence. Until Thamanisha holds one, the coach gives general education only and receives no account data.
- Under the providers' commercial API terms, what we send is not used to train their models. Where zero-data-retention routing is enabled on our gateway, providers do not retain it; otherwise they may keep it for a limited period solely for abuse and safety monitoring.
- AI output can be wrong. It is educational, not advice, and no decision about you — credit, eligibility or otherwise — is made by automated means.
4. Who processes your data for us
We never sell your personal data. We share it only with the service providers below, who process it on our instructions under their data-processing terms, and with authorities where the law requires.
| Provider | What for | Data | Where | When |
|---|---|---|---|---|
| Vercel Inc. | Hosting of the website, web app and API; AI Gateway routing | All requests in transit, IP address, server logs | USA (global edge network) | Always |
| Google LLC — Firebase Authentication & Cloud Firestore | Sign-in identity and the database that holds your account data | Email / phone number, sign-in identifiers, everything you save in the app | USA / EU (Google Cloud region of our Firebase project) | Always |
| Google LLC — Gemini models (via Vercel AI Gateway) | Financial Coach answers; reading documents you upload | Your coach messages; the contents of files you upload for analysis | USA / global | Only if you use that feature |
| Anthropic PBC — Claude models (via Vercel AI Gateway) | Fallback AI provider when the primary model is unavailable | Same as above, only when the fallback is used | USA | Only if you use that feature |
| Stripe, Inc. / Stripe Payments Europe | Card payments and subscription billing | Name, email, card details (held by Stripe, never by us), payment history | USA / Ireland | Only if you use that feature |
| Paystack (a Stripe company) | M-Pesa, bank-transfer and card payments | Email, phone number, payment reference and amount | Nigeria / Kenya | Only if you use that feature |
| Flutterwave, Whop, Coda Payments | Alternative checkouts offered in some regions / for digital products | Email, payment reference and amount | Nigeria / USA / Singapore | Only if you use that feature |
| Cloudflare, Inc. (our content-delivery worker) | Delivering download links for digital products you buy | Email address, product purchased | Global edge network | Only if you use that feature |
| Resend, Inc. | Transactional email: receipts, support replies, alerts you subscribe to | Email address, the message content | USA | Only where enabled |
| Google LLC — Gmail | Our support mailboxes, which receive the tickets you send | Your email address and what you write to support | USA | Only if you use that feature |
| Meta Platforms — WhatsApp Cloud API | The WhatsApp version of the Financial Coach | Your WhatsApp number and messages | USA / global | Only if you use that feature |
| Africa's Talking | USSD coach channel; SMS to business contacts | Phone number, USSD inputs, SMS content | Kenya | Only if you use that feature |
| Intuit (QuickBooks) / Zoho (Zoho Books) | Reading your accounting books, only if you connect them | Read-only ledger data via OAuth; we hold an encrypted access token | USA / your Zoho data-centre region | Only if you use that feature |
| Expo (650 Industries, Inc.) | Delivering mobile push notifications | Device push token, notification text | USA | Only if you use that feature |
| Functional Software, Inc. (Sentry) | Error and crash reports | Error message, stack trace, browser/device version | USA | Only where enabled |
| PostHog, Inc. | Product analytics | Curated usage events keyed to a pseudonymous account ID | EU | Only where enabled |
5. Transfers outside Kenya
Most of the providers above store or process data outside Kenya — mainly in the USA and the EU. We transfer personal data abroad only as the DPA (ss.48–50) and the Data Protection (General) Regulations, 2021 allow: to providers bound by data-processing terms that require them to protect it to a standard at least equivalent to the DPA, including contractual safeguards. Because your financial figures are sensitive personal data, we also rely on your consent, given when you accept this policy, for those transfers. You can ask us for details of the safeguard that applies to any provider.
6. Security
- All traffic is encrypted in transit (HTTPS/TLS); the database is encrypted at rest by Google Cloud.
- Accounting-connection tokens carry a second layer of encryption (AES-256-GCM) and are never sent to your browser.
- Connections are read-only: we cannot move money, and we never receive bank, M-Pesa or brokerage passwords.
- Every account request is checked against your signed-in identity; one user cannot read another's records.
- If a breach puts your data at risk we will notify the Data Protection Commissioner within 72 hours of becoming aware of it (DPA s.43) and tell you without undue delay.
7. Your rights and how to use them
- Access and portability — Settings → "Download my data" downloads everything our servers hold about you as one JSON file.
- Erasure — Settings → "Delete my account" erases your data and your sign-in identity, and shows you what is kept and why (the tax, fraud-prevention and erasure records in section 2, shared Chama records that belong to other members too, and the billing link of a subscription you have not yet cancelled — cancel it in Billing first).
- Withdraw consent — revoke any connection in one tap (Connected accounts or Settings → "Manage consents"), unsubscribe from any email, or stop using the coach. Withdrawal does not affect processing that already happened.
- Correction — edit your details in the app, or ask us.
- Object or restrict — ask us to stop or limit processing based on legitimate interest, including analytics.
- To be informed — this policy; ask us anything it does not answer.
For anything the in-app controls do not cover, email privacy@thamanisha.com from the address on your account. We may ask you to confirm your identity, and we respond within the time limits set by the Data Protection (General) Regulations, 2021.
8. Complaints
Please contact us first so we can put it right. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner at odpc.go.ke.
9. Cookies and local storage
- The app keeps your preferences, session hints, a short analytics buffer and any upload result in your browser's local storage. Deleting your account clears them on that device.
- Firebase Authentication keeps your signed-in session in browser storage.
- Where analytics is enabled, it stores its identifier in local storage only — no cookies.
- Checkout pages load the payment provider's script (e.g. Stripe), which may set its own cookies for fraud prevention.
- We do not use advertising cookies or cross-site advertising trackers.
10. Children
The Service is for adults (18+). We do not knowingly process children's data.
11. Changes
This is version 2026-10-04. When we make a material change we publish a new version, and the app asks you to review and accept it before you continue. The Terms of Service explain what the Service is and is not.