Jibu is a WhatsApp assistant for Kenyan shops, made by Kajama Studios. This notice is written for two people: the shop owner who uses Jibu, and the customer whose message it answers.
Who is responsible for what
When a customer messages a shop, the shop owns that conversation. They decide what is sold, what is promised and what Jibu is taught. In the words of the Data Protection Act 2019 the shop is the data controller, and Kajama Studios is the data processor: we handle those messages on the shop's instructions and for no purpose of our own.
For the shop owner's own account — their name, their phone number, what they pay — Kajama Studios is the controller.
What is collected
Voice notes are turned into words so they can be answered. Where a shop has not enabled that, the recording is passed to the owner and nothing is transcribed.
What is never done
- —No advertising, no profiling for advertising, and no sale or sharing of data for it.
- —No tracking cookies. The only cookie Jibu sets keeps a shop owner signed in.
- —No using one shop's messages to train a general model.
- —No reading of conversations by our staff, except where a shop asks us for help and we need to look, or where the law requires it.
Saying stop
Jibu only ever replies to someone who messaged the shop first. It does not start conversations, and it does not send marketing.
Opting out does not delete what is already there. To ask for deletion, write to us or to the shop — see your rights below.
How long it is kept
- —Message text and files: 24 months by default. After that the words and files are deleted and only counts remain — how many messages, how many sales — so the shop's history of what happened survives without the conversations themselves.
- —A shop owner can shorten this at any time in Settings, down to one month.
- —Backups are kept for 14 days. Something deleted from the live system can still sit in a backup for up to two weeks before it ages out.
- —When a shop deletes its account, its data is deleted at once, and backup copies age out within 14 days — except what we must keep for tax or legal reasons.
- —Raw copies of incoming messages, kept only so a message WhatsApp delivers twice is recognised, are deleted after 7 days.
Who else handles it
Jibu could not work without a few other companies. Each one only gets what it needs:
Processing happens outside Kenya. The transfer terms are written into the contract with each of these companies, as the Act requires, and into the agreement with each shop. If we change who handles data, the shops using Jibu are told beforehand.
Your rights
Under the Data Protection Act 2019 you may ask to:
- —be told what data is held about you, and get a copy of it;
- —have something wrong about you corrected;
- —have your data deleted;
- —object to how it is being used, or ask that its use be paused;
- —have it sent to you in a form you can take elsewhere.
If you are a customer of a shop, ask the shop: it can delete what it holds about you straight away from inside Jibu, and we help with anything else. Shop owners can download a copy of all their data, or delete their account, from Settings. Otherwise write to inquiries@kajamastudios.com. We answer within 30 days.
If you are not satisfied, you can complain to the Office of the Data Protection Commissioner at odpc.go.ke.
If something goes wrong
If data is lost or exposed, we tell the affected shop within 72 hours of finding out, and the Office of the Data Protection Commissioner as the Act requires. We say what happened, what it means, and what we are doing about it.
Children
Jibu is for businesses. It is not meant for anyone under 18, and we do not knowingly hold a child's data.
Changes
If this notice changes in a way that matters, shops using Jibu are told before it takes effect. The date at the top always says when it last changed.
Contact
Kajama Studios. inquiries@kajamastudios.com