VUKA
Log inStart free

Privacy Policy

Last updated: 1 August 2026 · Version 1.1

1. Who we are

Vuka OS is operated by Cogitus OS Limited ("Company", "we", "us"), a technology company incorporated in Kenya under the Companies Act, 2015. This policy is made under Kenya's Data Protection Act, 2019 ("DPA 2019") and the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021. Cogitus OS Limited is registered with the Office of the Data Protection Commissioner (ODPC) as a Data Processor, registration no. 659-2062-E512.

For artist accounts and the operation of Vuka OS itself we act as a Data Controller. For fan contact data that artists collect through their public pages, the artist is the Data Controller and we act as a Data Processor on their behalf.

2. Who this covers

Two groups of people interact with Vuka OS: artists who hold accounts, and fans whose contact details artists collect through Vuka OS's public pages (link-in-bio sites, pre-save pages, RSVP forms). This policy covers both.

3. What we collect

  • Artists: name, email, phone (optional), stage profile, connected social account data (see Section 4), billing records (M-Pesa transaction references, never your PIN), and activity within the platform.
  • Fans: only what a fan submits on a capture form (typically a name and a phone number or email), together with a record of exactly what they consented to and when.
  • Technical: logs needed to run and secure the service (IP addresses, timestamps, device basics). We do not run third-party advertising trackers on public pages.

4. Connected social accounts (Meta and TikTok)

Artists may connect their Instagram and Facebook accounts (operated by Meta Platforms, Inc.) and their TikTok account (operated by TikTok Pte. Ltd.) to Vuka OS. Connection happens only through each platform's official authorisation (OAuth) flow — we never ask for, see, or store your social media passwords.

  • What we receive: your platform user ID, username and display name, profile picture, follower/following/post counts, the permissions you granted, and the access tokens the platform issues to act on your behalf.
  • What we use it for: solely to provide the service you request — showing your connected accounts, publishing content you create or schedule, and retrieving analytics for your own posts. We do not sell platform data, use it for advertising, or process it for any purpose beyond operating your workspace.
  • How tokens are protected: access and refresh tokens are encrypted at rest (AES-256-GCM, with per-workspace encryption keys), are never included in API responses, and are never written to logs.
  • Disconnecting: you can disconnect any account at any time from Settings → Connections. On disconnection we request revocation from the platform where its API supports it and delete the stored tokens. You can also revoke Vuka's access from the platform side (Facebook: Settings → Business integrations; Instagram: Settings → Apps and websites; TikTok: Settings → Security → Apps).
  • Deletion: see our data deletion instructions for how to have all platform data we hold about you deleted.

5. How we use personal data

  • To provide the workspace: publishing, messaging, analytics, billing.
  • Fan contact details are used solely to deliver the messaging the fan opted into, on behalf of the artist who collected them. Vuka OS does not sell personal data or use fan lists for its own marketing.
  • AI features process your content to generate drafts and proposals for your approval.

6. Consent and withdrawal (fans)

Every fan capture records the consent given. Every message a fan receives links to a personal preferences page where they can withdraw consent or update their choices at any time, without needing an account. Withdrawal takes effect immediately for future sends.

7. Who can see your data

  • Your workspace content (posts, fans, messages, AI conversations) is yours. Platform operators do not browse it. Support access happens only through a time-limited, recorded session that appears in your own activity feed with the operator's identity and reason.
  • Service providers we rely on to operate, each receiving only what its function requires: Google Cloud Platform (hosting and databases), Upstash (queue infrastructure), Safaricom (M-Pesa payments), messaging carriers (WhatsApp/SMS delivery), Meta Platforms and TikTok (the accounts you choose to connect), and AI model providers (content you submit for generation). Each is bound by appropriate data processing arrangements.
  • We disclose data to authorities only where Kenyan law requires it.

8. International data transfers

Some of our cloud infrastructure stores or processes data outside Kenya. Where such transfers occur we apply the safeguards required by Section 48 of the DPA 2019, including data processing agreements and recognised contractual clauses with recipient providers.

9. Security

  • Passwords are stored hashed; sessions use httpOnly cookies, never client-readable tokens.
  • Social platform credentials are encrypted at rest and held server-side only — never exposed in API responses or logs.
  • Money movements are recorded against provider evidence, with every operator action audited.
  • In the event of a personal data breach we will notify the ODPC within 72 hours of becoming aware of it, in accordance with Section 43 of the DPA 2019, and affected individuals without undue delay where the breach presents a high risk to them.

10. Retention

Account data is kept while your account exists. Social platform tokens are deleted when you disconnect the account or delete your Vuka OS account. Financial records are retained as Kenyan tax law requires (a minimum of seven years). Access logs are kept for 90 days. Fan contacts are deleted when the collecting artist deletes them or when consent is withdrawn and no other lawful basis remains. After the applicable retention period, personal data is securely deleted or anonymised.

11. Your rights

Under Sections 26 to 38 of the DPA 2019 you may request access to, correction of, or deletion of your personal data, object to processing, request restriction or portability, and complain to the ODPC (Britam Towers, 12th Floor, Hospital Road, Upperhill, Nairobi; info@odpc.go.ke; www.odpc.go.ke). Artists can exercise these rights from their account; fans can start from their preferences page or by contacting us. We respond to verified requests within 21 days.

12. Changes and contact

We will announce material changes to this policy before they take effect. For data questions and rights requests contact Cogitus OS Limited: privacy enquiries privacy@cogitusoslimited.co.ke, general enquiries info@cogitusoslimited.co.ke, phone +254 707 211 241, Nairobi, Kenya. Corporate privacy policy: cogitusoslimited.co.ke/privacy.