Privacy Policy

Data we collect

Account data: your email address and sign-in details if you create an account (handled by our authentication provider, Supabase).

Data you choose to sync: your profile (display name, avatar, risk profile), Guardian limits, tracked bets, practice-trading history, price alerts and settings. Without an account these stay on your device only.

Purchases: your plan, its expiry, the payment provider's reference and the email you paid with. Card and mobile-money details are handled by Stripe, Paystack or Google Play; we never see or store full card numbers or M-Pesa PINs.

Demo, sales and support requests: the name, email, phone number, organisation and message you send us, and (for support) your plan, so Elite and Business requests can be answered first.

KairoCast Business: the organisation's name, branding, billing contact, webhook address and API usage counts. If you join an organisation, its owner and admins can see your email and the date you joined — nothing else about your activity.

Usage and security data: IP address, device and browser information, and pages or features used, to run the Service, prevent abuse and enforce daily allowances. We use aggregate counts (for example, how many AI messages were sent today), not advertising profiles.

AI conversations: questions you send to Kairo AI, together with the related market or match data, are sent to our AI providers to generate the answer.

Exchange keys: verified, then encrypted with AES-256-GCM and returned to your device as a sealed token kept for the browser session only. We do not store your keys in our database unless you turn on server auto-trading; then the encrypted key (the encryption key is held separately, in Google Secret Manager) and your bot's activity log are stored until you disconnect or delete your account (the log for up to 12 months).

Why we use it (legal bases)

To provide the Service you asked for, including accounts, sync, plans and support (performance of a contract); to keep the Service secure, prevent fraud and abuse, and improve it (legitimate interests); to meet legal, tax and accounting duties (legal obligation); and, where required, with your consent, which you can withdraw at any time.

Who we share it with

Service providers acting for us: hosting (Google Cloud / Firebase), database and sign-in (Supabase), AI (Google Gemini and, where enabled, Anthropic Claude), email delivery (Resend, for receipts, confirmations and reminders), and payments (Stripe, Paystack, Google Play). Market, football and news data come from public sources (for example Binance, ESPN and news feeds) and do not receive your personal data.

We do not sell your personal data and do not share it for advertising. We may disclose data if required by law or to protect rights and safety.

International transfers

Our providers may process data outside Kenya, including in the European Union and the United States. Where the law requires it, transfers are protected by appropriate safeguards such as standard contractual clauses.

How long we keep it

Account and synced data: until you delete your account. Purchase records: as long as needed for tax and accounting law (usually up to 7 years), with your email removed when you delete your account. Demo requests and support messages: up to 2 years, and deleted with your account. Security logs and usage counts: up to 12 months. These periods are applied automatically every day.

Your rights

Under the Kenya Data Protection Act 2019 and, where it applies, the GDPR, you can ask to access, correct, delete or export your data, object to or restrict certain processing, and withdraw consent. Download a copy of everything our servers hold about your account in Settings → Download my account data; delete your account at kairocast.com/delete-account or from the app; or write to us. You may also complain to the Office of the Data Protection Commissioner (Kenya) or your local data-protection authority.

Security

We use encryption in transit, encrypted exchange keys, row-level access controls on synced data and the principle of least access. No system is perfectly secure; tell us at once if you suspect a problem.

Children

The Service is for adults (18+). We do not knowingly collect data from children; if you believe a child has used the Service, contact us and we will delete their data.

Changes

We may update this policy and will say so in the app or by email for material changes.

Contact

Privacy questions and requests: [email protected]. General support: [email protected].