Privacy

Draft. This page is a draft prepared for review by a Kenyan advocate. It is not legal advice, and it may change once it has been reviewed.

Who we are

Safiri is run by Safiri. We decide what personal data is collected and why, which makes us the data controller under Kenya's Data Protection Act, 2019. Use the Help option in the Safiri app, or the contact details on our Contact page.

What we collect

If you are a traveller

• Your account: name, email, phone number, language, and your password, which we store scrambled so that not even we can read it. Nationality and an emergency contact are optional.
• Your bookings: the places, dates, party size and price, and the messages between you and your guide.
• Where you are during a trip: if you use trip tracking, your phone's location while a trip is in progress, so your guide can find you and so we can help if something goes wrong. You can turn it off.
• Safety check-ins and trusted-contact links: if you schedule a check-in, we keep its time and whether you confirmed you were safe. If you create a trusted-contact link, the person you send it to can see your latest shared position and check-in status for that booking, without your email or phone number. The link works only until it expires (within 24 hours) or you revoke it, and making a new link ends the old one. A missed check-in opens a support case for our staff.
• Reviews and ratings: the rating and the text you write. Travellers cannot upload photographs: a review or a place rating is text only. What you write is shown with your name to the guide and, once we have approved it, to other travellers.
• Your flight: only if you add it, with your agreement, so a pickup can move when a flight is late.
• Payments: the amount, status and reference of each payment. Your M-Pesa or card details are handled by Safaricom or Paystack. We never see or keep a card number.
• Your phone: a notification token so we can send you updates, and technical error reports with personal details removed.

If you are a guide, driver or host

• Everything above that applies to you, plus the licences, certificates and insurance you upload so we can check them, your M-Pesa number for payouts, your profile, and the reviews you receive.
• Photographs of places: guides can send photographs of a place, with an optional caption. Each one is checked by our staff before anyone else can see it. Once approved, it is shown to everyone who views that place in the app or on the website, and it carries your name as the photographer. A photograph you send is deleted from our storage, including the public copy, when you delete your account.

If you sign in with Google, Facebook or Apple

Sign-in with these services is only available if we have switched it on. If it is on and you use it, the service shares your name, your email address and a stable identifier for your account with Safiri. Safiri stores the name of the service, that identifier and the email address it gave us, so that the same sign-in finds your account next time. We do not receive your password for that service, your contacts or your activity there. The link is removed when you delete your account or unlink it in the app.

Why we use it

• To run the service: matching you with a guide, taking and confirming bookings, sending you updates.
• To check that guides are who they say they are and hold the licences they claim.
• To take payments, give refunds and pay guides.
• For safety, and to deal with complaints and disputes.
• To keep Safiri secure, and to meet the law.

We do not sell your personal data, and we do not use it to advertise to you.

Who can see it

• Your guide sees what they need to do your trip: your name, the booking, your shared position during the trip, and messages you send them. A traveller sees a guide's profile and verified documents' status, not the documents themselves.
• Safiri staff can see an account, a booking or a conversation when they are helping with a problem or a dispute. What they look at is recorded.
• Your trusted contact, if you create a link, as described above.
• Companies that help us run Safiri (our processors). They may only use your data to do that job for us:
  • Safaricom (M-Pesa) and Paystack, for payments and guide payouts: amount, reference and the phone number being paid.
  • Our hosting provider, which stores the database and uploaded files (guide documents and place photographs).
  • Africa's Talking, which sends text messages: your phone number and the text of the message.
  • Our email provider, which sends email: your email address and the message.
  • Vercel, which hosts this website.
  • Cloudflare, for our domain name and for storing encrypted database backups.
  • Google (Firebase), which with Expo delivers notifications to Android phones.
  • TomTom, for maps and routes.
  • Expo's push notification service, which delivers notifications to your phone using your notification token and the message.
  • AviationStack, which checks flight status, only if you add a flight: the flight number and date.
  • Sentry, which receives technical error reports, only if we have switched it on. Personal details are removed before sending.
  • Google, Facebook or Apple, only if you choose to sign in with them, as described above.
• The authorities, when the law requires it.

Where it is kept

Our servers and some of the companies above are outside Kenya. When your data leaves the country we make sure it is protected to the standard the Data Protection Act expects.

How long we keep it

These are the periods the service applies today. They are our own policy, not statements of what the law requires.

• Your account details: while your account is open.
• Location during a trip: deleted after 7 days.
• Messages between you and a guide: deleted after 365 days.
• Notification history (sent, skipped and failed notifications): deleted after 90 days.
• Sign-in sessions: a traveller or guide stays signed in while they keep using Safiri, and is signed out after 30 days without use; operator accounts are signed out after 8 hours without activity; no session lasts more than 90 days. For each signed-in device we keep a short label (such as "Chrome on Windows" or the phone's name), which app it is and when it was last used, so you can see and sign out your devices; we do not keep its IP address or location. Expired or revoked sessions are cleared within about a month. One-time codes are cleared a day after they expire.
• Safety check-ins: kept while your account is open. Trusted-contact links stop working within 24 hours, or sooner if you revoke them.
• Support cases: kept as our record of a complaint or dispute, until you delete your account (and, for an open case, until it is resolved).
• People we talk to about joining as a guide: name, number and notes are removed 30 days after they decline, 90 days after they apply and 180 days after the last contact, by default. For someone who declined we keep only a one-way fingerprint of their number so that we do not contact them again.
• Payments, payouts, refunds and audit records: we do not delete these automatically. We have not yet set a retention period for them; we will set one with our advisers and update this page. They are kept in the meantime because the guide, our payment partners and accounting rules need them.
• Backups: overwritten on a cycle of up to 14 days, so deleted data can remain in a backup for that long and is not restored.

If a support case about a booking is still open when these periods end, or when you delete your account, we keep that booking's messages and location records until the case is resolved, and then delete them.

Cookies

Safiri uses only strictly necessary cookies: the ones that keep you signed in and protect your account. We set no tracking, analytics or advertising cookies, so there is nothing to ask your consent for. Both cookies are HttpOnly (page scripts cannot read them), sent only over a secure connection, and limited to our own site.

• safiri_access: Proves you are signed in on this website. HttpOnly, so page scripts cannot read it. Lasts: 15 minutes, renewed while you use the site.
• safiri_refresh: Renews your sign-in without asking for your password, and lets us end it from your signed-in devices list. Single use: each renewal replaces it. Lasts: Up to 30 days; ends after 30 days without use, when you sign out, or when you sign that device out.

The Safiri app and the operator console use the same pair under their own names (safiri_traveler_…, safiri_provider_… and safiri_operator_…) when used in a browser. Your display preferences and whether you closed the cookie notice are kept in your browser's local storage, not in a cookie, and never sent to us. You can see every device signed in to your account, and sign any of them out, from your account page.

When you delete your account

• Deleted straight away: your name, email, phone number, nationality and emergency contact; your location history; flight details; notifications and notification tokens; saved places; trip notes and shared links; safety check-ins and trusted-contact links (they stop working immediately); two-step sign-in secrets and recovery codes; the link to a Google, Facebook or Apple sign-in; and every signed-in session on every device. For guides: licence documents and photographs you uploaded (from our storage, including the public copy), your profile text and your payout number. You also come out of search.
• Kept, without your name: the contents of your messages are replaced with a removal notice. Bookings, payments, payouts and refunds stay (the name of anyone who paid a share is cleared, and a guide's payout number is removed). Reviews and place ratings you wrote stay and are shown as from "Deleted user".
• Held for a while: messages, location records and check-ins for a booking with an open support case, until it is resolved.

Your rights

You can ask us to:

• show you the personal data we hold about you, and give you a copy;
• correct anything that is wrong. Most of it you can change yourself in the app;
• delete your account and data. See how to delete your account;
• stop or restrict how we use it, or object to a particular use.

Use the Help option in the Safiri app, or the contact details on our Contact page. We will answer within the time the law allows. If you are not happy with how we handle a request or your data, you can complain to the Office of the Data Protection Commissioner of Kenya (odpc.go.ke).

Children

Safiri is for people aged 18 and over. If we learn that someone younger has an account, we will close it.

Changes

If we change this page in a way that matters, we will tell you in the app or by email before it takes effect. The date at the top shows when it last changed.