Draft. This text is waiting for a lawyer's review and may change before launch.
StatusReach — Privacy Policy
DRAFT — pending review by a Kenyan lawyer. Not for publication. Version 0.1 · Effective date: [EFFECTIVE DATE]
1. Who we are
StatusReach is run by Hekima Labs, S.L., a Spanish company (tax ID B26960278), contact: contacto@hekimalabs.com. We are the data controller for the personal data described here. We follow the Data Protection Act, 2019 of Kenya and, as a European company, the EU General Data Protection Regulation where it applies.
2. Whose data we use
- Publishers: people who join to post campaigns.
- Visitors: people who tap a campaign link on someone's WhatsApp status.
- Advertisers and agencies: the people who contact us or run campaigns for a business.
3. What we collect and why
Publishers
| Data | Why | Legal basis |
|---|---|---|
| First name, country, region, age range, university or college (optional), interests | To create your account and send you campaigns that fit you | Contract |
| WhatsApp number, verified by a code you send us from your WhatsApp | To make sure one person has one account and to contact you about your account | Contract |
| Mobile money number and the account holder's name returned by the payment provider | To pay you | Contract |
| Identity details asked before your first payment | To prevent fraud and meet payment rules | Legal obligation and legitimate interest in preventing fraud |
| Campaigns taken, links, visit counts, payments | To count visits, pay you and handle complaints | Contract |
| Devices you use with StatusReach | So your own taps never count | Legitimate interest in preventing fraud |
| Your agreement to these terms and the text version you saw | To prove what you accepted | Legal obligation |
| Browser notification permission | To tell you about new campaigns, only if you allow it | Consent |
Visitors
When you open a campaign link we record the visit: the campaign and publisher it belongs to, the time, a cookie set by us, technical device characteristics and your IP address. We use this only to count unique visits and filter fraud. IP addresses and device characteristics are stored only in an irreversibly scrambled ("hashed") form. We do not ask for your name or number, we do not build a profile of you and we do not use advertising or analytics trackers on that page. See our Visit Measurement notice.
Advertisers and agencies
Name, company, work email, phone, country, campaign details and billing data: to answer you, run campaigns and invoice (contract and legal obligation).
4. What we never do
- We never access a publisher's WhatsApp account, messages, contacts or status.
- We never give advertisers personal data about publishers or visitors. They receive aggregated figures only.
- We never sell personal data.
- We do not knowingly accept anyone under 18.
5. Who processes data for us
We use service providers that process data on our behalf, under contract: hosting and database (Vercel, Supabase), WhatsApp messaging (Twilio, for verification codes you send us), mobile money payments ([MOBILE MONEY PROVIDER]), email, and artificial intelligence for reviewing ads (Anthropic), which receives advertiser briefs and ad content, not publisher or visitor data.
6. Where data is stored
Our database is in the European Union (Ireland). Some providers may process data in other countries, including the United States. When data leaves Kenya, we rely on the safeguards allowed by the Data Protection Act, 2019, such as contractual protections with each provider.
7. How long we keep it
- Publisher accounts: while the account is open, and 24 months after the last payment, for complaints and tax records.
- Individual visit records: 90 days; after that, only aggregated figures.
- Advertiser enquiries that do not become a campaign: 12 months.
- Invoices and payment records: as long as tax law requires.
8. Your rights
You can ask to access, correct or delete your data, to object to or restrict its use, to receive a copy, and to withdraw consent at any time (for example, turning off notifications). Write to contacto@hekimalabs.com. We reply within the time the law sets. You can also complain to the Office of the Data Protection Commissioner of Kenya (odpc.go.ke) or to the data protection authority of your country.
You can close your account from your profile; we delete or anonymise your data as described in section 7.
9. Security
We use encryption in transit, access control and the minimum data needed for each purpose. No system is completely secure; if a breach affects you, we will tell you and the authority as the law requires.
10. Changes
We will publish any change here, and tell publishers in the app if it is important.