Last updated: 10 July 2026
This policy explains how Tafiti, operated by RJS Studios Ltd in Nairobi, Kenya, handles personal data under Kenya’s Data Protection Act, 2019. It covers two groups differently: business owners and their teams who create Tafiti accounts, for whom we are the data controller; and guests of venues that use Tafiti, whose data we process on the venue’s instructions, with the venue as controller. It also covers visitors to this website. Our Terms & Conditions sit alongside this policy.
Your email address, your WhatsApp number, your business details (venue names, locations, Google listing, venue type), your billing history and tax details you give us such as a KRA PIN, and your choices in the product. Payments are handled by PesaPal; we never see or store your card number, M-Pesa PIN or bank credentials. At sign-up we record whether you accepted the terms and whether you consented to marketing from us.
To run the service (sign-in links, alerts, weekly reports, invoices and other transactional messages), to bill you, to keep the platform safe, and, only if you opted in, to send you Tafiti product news and offers by email or WhatsApp. You can withdraw marketing consent at any time from your settings or by replying STOP or unsubscribe, and transactional messages continue unaffected. We do not sell personal data to anyone.
When a guest uses a venue’s Tafiti QR code we process, on the venue’s behalf: the guest’s phone number, name if they share it, ratings and feedback text, marketing consent choices, and where the venue enables it, preference notes and loyalty check-ins. The venue decides why this data is collected; we use it only to provide the service to that venue. Guests who want their data corrected or deleted can ask the venue, or write to us and we will act on the venue’s instructions and the law.
Only the service providers needed to run Tafiti: Supabase (database and authentication, hosted in the EU), Meta Platforms and our WhatsApp Business API provider 360dialog (to deliver WhatsApp messages), Google (when a guest chooses to publish a review), PesaPal (payments), Resend (email), Vercel (hosting) and Anthropic (generating suggested review text from feedback). Each receives only what its role requires. We may disclose data where the law compels us to.
Owner account data is kept while the account exists and for as long afterwards as tax and accounting law requires. Guest feedback is retained for 24 months and then anonymised; raw WhatsApp conversation transcripts are purged after 90 days. A lapsed subscription does not delete your data; a written deletion request does, subject to legal retention duties.
Under the Data Protection Act, 2019 you may ask for access to your data, correction, deletion, or restriction of processing, and you may withdraw consent at any time. Write to hello@tafitipro.co.ke and we will respond within the time the law sets. If you are unhappy with our answer you may complain to the Office of the Data Protection Commissioner of Kenya.
Data is encrypted in transit, access inside Tafiti is scoped so each business can only see its own data, and administrative access is limited and logged. No system is perfectly secure; if a breach affects your data we will notify you and the regulator as the law requires.
Essential cookies run the site and remember choices such as your theme; these are always on. We also keep a first-party count of page visits (which pages, how many times) with no personal data and no tracking across other websites. With your consent, given through the cookie banner, we load the Meta Pixelso we can measure our advertising and show Tafiti offers to relevant audiences on Meta’s platforms; this sets cookies and shares limited event data with Meta Platforms. Decline and no advertising cookies are set. You can change your choice at any time by clearing the site’s cookies, and this affects only marketing measurement, never your ability to use the service.
Tafiti is a business tool and is not directed at children.
We will post updates here and, for material changes, tell account holders by email or in the dashboard before they take effect.