Privacy Policy

Last updated 2 November 2026

This policy explains what personal data BNN LTD ("Vumisha", "we") collects when you use vumisha.com, why, who we share it with, and your rights under Kenya's Data Protection Act, 2019. We are the data controller. Questions: [email protected].

What we collect

Account: your email, a hash of your password (never the password itself), optional name, and, if you turn on two-step login, an encrypted authenticator secret and hashed recovery codes.
Page owners: page name, handle, bio, city, logo and cover image, rate card, and the M-Pesa number and name you want to be paid on.
Connected accounts: when you connect Facebook or Instagram, we receive the Pages and Instagram accounts you choose, their names, pictures and follower counts, and access tokens that let us post the ads you approve and read those posts' statistics, and the account's own reach, engagement and audience figures. Unless you turn it off on Profile, those figures are shown on your public booking page as totals and percentages. If you turn it on for an account on Profile, we also read and show that account's last three posts; their images load from Meta's servers, so Meta can see the visitor's IP address. Tokens are encrypted. For Telegram we store the channel's id, name and subscriber count.
Advertisers: your email, business and contact name, phone number if you give one, and your ads (text, image or video, link).
Payments: amount, payment method, the provider's transaction reference, and the payer phone or email the provider reports. Card numbers and M-Pesa PINs go to the payment provider, never to us.
Help: the messages and screenshots you send us on Help, and our replies. Screenshots are shown only to you and our support team.
Usage and security: IP address and browser for logins and bookings (to stop abuse), login attempts, and actions taken in the admin pages.
Clicks on ad links: when someone clicks a link in an ad, we count the click. We keep a one-way code made from the day, IP address and browser so a visitor is counted once a day; we don't keep the IP address itself for clicks.

Why we use it

To run the service you asked for: bookings, review, posting, payments, payouts, reports and emails about them (contract).
To keep accounts and payments safe and stop fraud (legitimate interest).
To remind you about a booking you didn't finish, and to let a page you booked or started booking with email you about advertising with it again, at most twice per reason. Every one has a link to stop them (legitimate interest). AI may write these emails, and may answer your messages about a booked ad, marked as AI.
To keep financial records as tax and anti-fraud laws require (legal obligation).
Public booking pages show what page owners choose to publish: name, handle, bio, city, images, rate card, follower counts and average ratings.

We don't sell personal data and we don't use it for advertising profiles. Page owners don't get the email address of someone who started booking and hasn't paid: we send their message for them.

Who we share it with

The other side of a booking: page owners see the advertiser's name, business, email and ad; advertisers see the page's public details and their report.
Meta and Telegram, to publish approved ads and read their statistics.
Payment providers (Safaricom M-Pesa, Paystack, Flutterwave, Stripe, PayPal, NOWPayments, Razorpay, Mercado Pago, Xendit), only the one you choose, to take the payment.
OpenAI, which checks ad text and images for prohibited content before review, and powers the assistant that answers Help messages first (it receives your message, any screenshots, and the account details it needs to answer, such as your pages and recent bookings), checks the name and description pages publish about themselves, and translates Help messages for our team when needed. OpenAI doesn't use this data to train its models.
Service providers that host and run Vumisha for us: our servers (DigitalOcean), file storage (Cloudflare), email delivery (Resend), the check that a person (not a bot) is signing up or resetting a password (Cloudflare Turnstile, which sees your IP address and browser), and error reports (Sentry, without your name or email).
Authorities, when the law requires it.

Some of these providers process data outside Kenya. We use them only with safeguards the Data Protection Act allows, such as their data protection terms.

How long we keep it

Account and page data: while your account is open, then deleted within 90 days of closing it.
Ads: kept with the booking for 2 years so disputes and reports can be checked.
Payment, payout and ledger records: at least 5 years, as Kenyan tax law requires.
Login and security logs: 1 year.

Facebook and Instagram data, and deleting it

You can disconnect a Page or Instagram account at any time on the Channels page; we stop using its token straight away. If you remove Vumisha from your Facebook settings (Settings & privacy → Business integrations), Meta tells us and we delete the access tokens we hold for you; you get a confirmation code you can check at vumisha.com/meta/deletion-status. To delete everything else, email [email protected] from your account's address.

Your rights

You can ask to see, correct or delete your personal data, to object to how we use it, or to get a copy. Email [email protected]; we reply within 30 days. Records the law makes us keep can't be deleted early. You can also complain to the Office of the Data Protection Commissioner (odpc.go.ke).

Cookies

We use one cookie to keep you logged in. It's needed for the site to work, so there's no banner. We don't use advertising or analytics cookies.

Security

Passwords are hashed, secrets and access tokens are encrypted, each page owner's data is kept apart at the database level, and all traffic uses HTTPS. No system is perfectly secure; if a breach affects you, we'll tell you and the Data Protection Commissioner as the law requires.

Children

Vumisha is for people aged 18 and over.

Changes

If we change this policy in a way that matters, we'll tell you by email or in the app.