Privacy Policy

1. Who this covers

Two groups of people interact with Vuka OS: artists who hold accounts, and fans whose contact details artists collect through Vuka OS's public pages (link-in-bio sites, pre-save pages, RSVP forms). This policy covers both, under Kenya's Data Protection Act, 2019.

2. What we collect

• Artists: name, email, phone (optional), stage profile, connected social account tokens, billing records (M-Pesa transaction references, never your PIN), and activity within the platform.
• Fans: only what a fan submits on a capture form (typically a name and a phone number or email), together with a record of exactly what they consented to and when.
• Technical: logs needed to run and secure the service (IP addresses, timestamps, device basics). We do not run third-party advertising trackers on public pages.

3. How we use it

• To provide the workspace: publishing, messaging, analytics, billing.
• Fan contact details are used solely to deliver the messaging the fan opted into, on behalf of the artist who collected them. Vuka OS does not sell personal data or use fan lists for its own marketing.
• AI features process your content to generate drafts and proposals for your approval.

4. Consent and withdrawal (fans)

Every fan capture records the consent given. Every message a fan receives links to a personal preferences page where they can withdraw consent or update their choices at any time, without needing an account. Withdrawal takes effect immediately for future sends.

5. Who can see your data

• Your workspace content (posts, fans, messages, AI conversations) is yours. Platform operators do not browse it. Support access happens only through a time-limited, recorded session that appears in your own activity feed with the operator's identity and reason.
• Service providers we rely on to operate: Safaricom (M-Pesa payments), messaging carriers (WhatsApp/SMS delivery), social platforms you connect, AI model providers (content you submit for generation), and hosting infrastructure. Each receives only what its function requires.
• We disclose data to authorities only where Kenyan law requires it.

6. Security

• Passwords are stored hashed; sessions use httpOnly cookies, never client-readable tokens.
• Social platform credentials are held server-side and never exposed in API responses.
• Money movements are recorded against provider evidence, with every operator action audited.

7. Retention

Account data is kept while your account exists. Financial records are retained as Kenyan tax law requires. Security and audit records are kept long enough to serve their protective purpose. Fan contacts are deleted when the collecting artist deletes them or when consent is withdrawn and no other lawful basis remains.

8. Your rights

Under the Data Protection Act 2019 you may request access to, correction of, or deletion of your personal data, object to processing, and complain to the Office of the Data Protection Commissioner (ODPC). Artists can exercise these rights from their account; fans can start from their preferences page or by contacting us.

9. Changes and contact

We will announce material changes to this policy before they take effect. Data questions and rights requests: contact the platform operator through your account, or via the contact details published when Vuka OS reaches general availability.