Data protection terms

These terms form part of the agreement between your shop and Kajama Studios, and apply whenever we handle personal data on your behalf. They sit alongside the terms of service and the privacy notice.

Roles

You are the data controller for your customers' personal data. We are your data processor. We act on your instructions and for no purpose of our own.

What we process, and why

Subject matterAnswering your WhatsApp customers on your behalf

DurationWhile your account is open, then deletion within 30 days

Categories of dataPhone numbers, names, message text, photos, voice notes, documents, and buying signals drawn from them

Data subjectsThe customers who message your shop, and the people in your shop who use Jibu

Our commitments

—Instructions only. We process your customers' data to run Jibu for you, and for nothing else. We do not sell it, and we do not use it to train general AI models.
—Separation. Each shop's data is scoped to that shop. What you teach Jibu is used for your replies only.
—Confidentiality. Anyone with access is bound to keep it confidential, and access is limited to those who need it to run or support the service.
—Security. Data is encrypted in transit. Sign-in codes are stored hashed, never in the clear. Links to files expire. Access to production systems is restricted and logged.
—Deletion. Message text and files are deleted on the retention period you choose, 24 months by default and as little as one month. Backups age out within 14 days.
—Opt-out. A customer who sends STOP, ACHA or TOA is never messaged again. That is enforced where messages are sent, so no setting of yours can override it.

Sub-processors

We use other companies to run Jibu: WhatsApp (Meta) as the messaging channel, an AI provider to write replies, hosting and database providers to store data, a transcription provider where you turn voice notes on, and a payments provider for billing. Each is under contract with terms no weaker than these.

Processing happens outside Kenya, with the transfer safeguards the Act requires written into those contracts. We will tell you before adding or changing a sub-processor, and you may object.

Helping you with requests

If one of your customers asks for their data to be deleted, you can do it yourself: open their chat and choose “Forget this customer”. Their messages, files and sales are deleted at once. A full copy of everything held for your shop is under Settings → Your data. For anything else — a correction, or a request you are unsure about — tell us and we will help within the time the Act allows. If a request reaches us directly, we pass it to you rather than answering for you.

If there is a breach

We will tell you within 72 hours of becoming aware of a personal data breach affecting your customers, with what happened, what data was involved, and what we are doing. We will also notify the Office of the Data Protection Commissioner where the Act requires it, and help you meet any duty you have to tell your customers.

Showing our work

On reasonable request we will give you the information you need to satisfy yourself that we are meeting these commitments.

When we part ways

When you delete your shop in Settings, its data — your customers' conversations, files and sales included — is deleted from the live system at once, and backup copies age out within 14 days, other than anything we must keep by law. Download a copy from Settings first if you want one.

Contact

Kajama Studios. inquiries@kajamastudios.com