Data processing agreement

1. What this agreement covers

This agreement is part of the Stavore terms of service. It is between you, the business that uses Stavore (the controller), and Stavore (the processor). It covers personal data that you or your team put into Stavore about other people ("host data"), and follows Kenya's Data Protection Act, 2019 (the Act) and its regulations on data processors.

2. The processing

• Purpose: to provide Stavore: storing, organising and showing your records, working out your dashboard and reports, exporting and emailing them, and on Plus, reading messages to the assistant into drafts and writing report summaries.
• People concerned: your guests, the owners of units you manage, your team, and anyone who messages the assistant for your business.
• Types of data: names, phone numbers, email addresses, home town or country, ID or passport numbers (optional), stay dates and details, amounts and payment details, M-Pesa codes, ratings, notes, marketing consent, and messages sent to the assistant.
• Sensitive data: Stavore isn't designed for sensitive personal data, such as health details. Please don't record it in notes.
• How long: while your account is open, then until deletion as in section 10.

3. Your instructions

We process host data only on your instructions, which you give by using Stavore and its settings, unless the law requires otherwise (we'll tell you first if we can). If we think an instruction breaks the Act, we'll tell you.

4. People with access

Only people who need to, to run and support Stavore, can reach host data, and they are bound to keep it confidential.

5. Security

We protect host data with measures that fit the risk, including:

• each business's records kept apart in the database by row-level security, with automated tests on every change;
• encryption in transit (HTTPS) and at rest;
• roles: staff can't see money or ID numbers; ID numbers are masked in lists and erased on the schedule you set;
• sign-in with one-time codes or links (no passwords), and secrets kept on servers;
• checked and repeat-safe payment and messaging webhooks;
• a record of who changed what, and regular backups.

6. Sub-processors

You agree that we may use these sub-processors. Each is bound by written terms that protect host data at least as well as this agreement:

• Supabase

  What they do:

  Database, sign-in and file storage

  Data:

  All account and business records

  Where:

  Outside Kenya (the region chosen for our project)

• Vercel

  What they do:

  Hosts the website and runs the app

  Data:

  Everything that passes through the app, and access logs

  Where:

  United States, with servers worldwide

• Anthropic

  What they do:

  The AI assistant and the written summaries in AI reports (Plus)

  Data:

  Messages sent to the assistant, the names of your units and lists, and report figures

  Where:

  United States

• Meta (WhatsApp)

  What they do:

  Carries messages to and from the assistant on WhatsApp, if you use it

  Data:

  Your WhatsApp number, your messages and the assistant's replies

  Where:

  Worldwide

• Telegram

  What they do:

  Carries messages to and from the assistant on Telegram, if you use it

  Data:

  Your Telegram account, your messages and the assistant's replies

  Where:

  Worldwide

• Sentry

  What they do:

  Error reports, so we can find and fix problems

  Data:

  What went wrong and where in the app; we remove names, email addresses and phone numbers first

  Where:

  European Union (Germany)

• Resend

  What they do:

  Sends Stavore's emails

  Data:

  Email addresses and the emails' content (receipts, reminders, reports, invitations)

  Where:

  United States

• Paystack

  What they do:

  Takes M-Pesa and card payments for Plus

  Data:

  The payer's name, email, phone number and payment details

  Where:

  Kenya, and other countries where Paystack (part of Stripe) runs its service

We give account owners at least 14 days' notice by email before adding or replacing a sub-processor. If you object and we can't resolve it, you may close your account. We remain responsible for our sub-processors' work.

7. Helping you meet the law

• Requests from people about their data: you can see, correct, export and delete (or anonymise) guests' details in Stavore. If a request comes to us, we pass it to you and help where we can.
• We give you the information you reasonably need for a data protection impact assessment or a consultation with the ODPC.

8. Personal data breaches

If we become aware of a breach affecting host data, we tell you without delay, and within 48 hours, with what we know, so you can notify the ODPC within 72 hours as the Act requires. We then keep you updated and take steps to limit the harm.

9. Transfers outside Kenya

Some sub-processors store or process host data outside Kenya. We only allow this with safeguards that meet the Act's rules on transfers, such as written data protection terms with each sub-processor.

10. When the agreement ends

You can export host data at any time. When you delete a business (Settings → Data), we delete its host data 7 days later; when you delete your account (More → Delete my account), at once. Copies in backups are overwritten within a further 30 days, unless the law requires us to keep something (such as payment records for tax). Messages to the assistant and their drafts are deleted after 30 days in any case.

11. Information and audits

We give you the information you reasonably need to show that this agreement is being followed. If that isn't enough, you may audit it with 30 days' notice, at your cost, in a way that protects other customers' data.

12. Your responsibilities

You make sure you have a lawful reason to process host data, tell guests how you use their details, collect consent before sending offers, keep details accurate, and register with the ODPC where the law requires. Our terms list these too.

13. Contact us

• WhatsApp: +254 728 718 945
• Where we are: Stavore, Voi, Kenya