Privacy policy

1. Who we are

Stavore is a logbook and dashboard for short-stay hosts and agents, run by its founder from Voi, Kenya. In this policy, "we" and "us" mean Stavore, and "you" means a person who uses Stavore. It explains what personal data we handle, why, and your rights under Kenya's Data Protection Act, 2019 (the Act).

2. Your data and your guests' data

• Your account (your email address, name, business details and payments): we decide how this is used, so for this data we are the data controller.
• Your business records (the stays, guests, owners, expenses and other records you and your team enter): you decide what to record and why, so you are the data controller and Stavore is your data processor. We use these records only to run Stavore for you, as our data processing agreement sets out.

3. What we collect

• Account: your email address, and your name and phone number if you add them; the businesses you belong to and your role in each.
• Business: your business name and town, your units, owners' names and contact details, targets and settings.
• Guests and stays (entered by you or your team): guests' names, phone numbers, email addresses, where they live, how many people stayed, why they visited, ratings, notes, and whether they agreed to receive offers (with the date). An ID or passport number only if you choose to record one. Stay dates, amounts, payment status and M-Pesa codes.
• Expenses, other income and assets: amounts, dates, who was paid, receipt numbers, M-Pesa codes and eTIMS invoice numbers.
• Payments for Plus: plan, amount, date, method, the phone number used for M-Pesa and the M-Pesa receipt number. Card details go straight to our payment partner; we never see or store them.
• Messages to the AI assistant (Plus): what you send, your WhatsApp number or Telegram account, and the draft the assistant prepared.
• Emails: who we emailed, what about and when, so the same email is never sent twice.
• A record of changes: who added, changed or deleted a record, and when.
• Technical: the cookies that keep you signed in (see our cookie notice), the logs our hosting providers keep for security, such as IP addresses and times, and error reports (what went wrong and where in the app, with names, email addresses and phone numbers removed).
• Attempt counts: to stop abuse we count sign-in emails, payment requests and invitations. For this we keep a scrambled (one-way) copy of the email address, phone number or IP address for 1 day.

4. How we use it, and why

The Act needs a lawful reason for each use. Ours are:

• To run Stavore for you (to perform our contract with you): signing you in, saving and showing your records, working out your dashboard, sending the emails you ask for, and running the AI assistant and AI reports on Plus.
• To bill you and keep accounts (contract, and our legal duty to keep tax records).
• To keep Stavore safe and working (our legitimate interest): preventing abuse, fixing errors and protecting accounts.
• To tell you about your account and changes to Stavore (contract and legitimate interest). We don't send you marketing unless you agree. The daily summary and AI reports are optional, and every report email has an unsubscribe link.

We never sell personal data. We don't show ads, and we don't use your records or messages to train AI models.

5. The AI assistant and AI reports

• When you message the assistant, we send our AI provider, Anthropic, the message, today's date, the names of your units, booking sources, payment methods and expense categories, and for a follow-up, the draft so far. That is all it needs to turn the message into a draft. We don't send other guests' details.
• For an AI report, we send your business name, the period and the report's figures (totals, not guests' details), so it can write a short summary.
• Anthropic processes this for us under its commercial terms, which don't allow it to train its models on this data.
• The AI never saves anything by itself. A stay or expense is saved only when you reply YES or tap Save, and it goes through the same checks as the form.
• We delete the text of messages, and the drafts made from them, after 30 days. Records you saved stay with your business like any other.

6. Who we share it with

We use these providers (sub-processors) to run Stavore. Each handles only what it needs and is bound by written data protection terms:

• Supabase

  What they do:

  Database, sign-in and file storage

  Data:

  All account and business records

  Where:

  Outside Kenya (the region chosen for our project)

• Vercel

  What they do:

  Hosts the website and runs the app

  Data:

  Everything that passes through the app, and access logs

  Where:

  United States, with servers worldwide

• Anthropic

  What they do:

  The AI assistant and the written summaries in AI reports (Plus)

  Data:

  Messages sent to the assistant, the names of your units and lists, and report figures

  Where:

  United States

• Meta (WhatsApp)

  What they do:

  Carries messages to and from the assistant on WhatsApp, if you use it

  Data:

  Your WhatsApp number, your messages and the assistant's replies

  Where:

  Worldwide

• Telegram

  What they do:

  Carries messages to and from the assistant on Telegram, if you use it

  Data:

  Your Telegram account, your messages and the assistant's replies

  Where:

  Worldwide

• Sentry

  What they do:

  Error reports, so we can find and fix problems

  Data:

  What went wrong and where in the app; we remove names, email addresses and phone numbers first

  Where:

  European Union (Germany)

• Resend

  What they do:

  Sends Stavore's emails

  Data:

  Email addresses and the emails' content (receipts, reminders, reports, invitations)

  Where:

  United States

• Paystack

  What they do:

  Takes M-Pesa and card payments for Plus

  Data:

  The payer's name, email, phone number and payment details

  Where:

  Kenya, and other countries where Paystack (part of Stripe) runs its service

If you choose to sign in with Google, Google shares your name and email address with us. We also share data when the law requires it, for example with a court order. We give account owners 14 days' notice before adding or replacing a provider.

7. Data stored outside Kenya

Most of our providers store or process data outside Kenya, for example in the European Union or the United States. We only transfer data to providers that protect it under written terms, with safeguards that meet the Act's rules on transfers out of Kenya.

8. How long we keep it

• Your account and business records: for as long as your account is open.
• When an owner deletes a business (Settings → Data): its records are deleted 7 days later, and until then any owner can keep it. Copies in backups are overwritten within a further 30 days. Export your records first if you want to keep a copy.
• When you delete your account (More → Delete my account): your sign-in is deleted at once, with the businesses you own and everything in them (unless another owner still runs one). In businesses you only joined, the records you logged stay with that business but no longer show who you are, and your email address is removed from their invitations, report lists and email log. Copies in backups are overwritten within a further 30 days. Payment receipts are kept as below, without your phone number.
• Payment records: as long as Kenyan tax law requires us to keep them (currently five years).
• Messages to the assistant and the drafts made from them: 30 days.
• Guests' ID numbers: erased automatically after the number of days you set in Settings → Business.

9. Your rights

Under the Act you have the right to:

• be told how your personal data is used (this policy);
• see the personal data we hold about you;
• have wrong or out-of-date data corrected;
• have data deleted when we no longer need it or shouldn't have it;
• object to a use, and withdraw consent you gave;
• get your data in a format you can use elsewhere.

You can export your records yourself at any time (More → Reports and export), and correct most details in the app. For anything else, contact us (section 15). You can also complain to the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke.

10. If you stayed with a Stavore host

Your host decides what they record about you and why. Please contact your host first: they can see, correct, export or delete your details in Stavore. If you can't reach them, contact us and we'll pass your request on and help them answer it.

11. How we protect it

• Each business's records are kept apart in the database, and only that business's team can reach them. Automated tests check this on every change.
• Data travels encrypted (HTTPS) and is stored encrypted.
• Staff accounts can't see money or ID numbers, and ID numbers are masked in lists.
• Sign-in uses one-time codes and links, so there are no passwords to steal.
• If a breach puts personal data at risk, we tell the ODPC within 72 hours of finding out (for data we control), and tell affected hosts within 48 hours so they can do the same for their guests.

12. Children

Stavore is for adults running a business, so you must be 18 or over to use it. We don't knowingly collect children's data, apart from the number of people in a stay.

13. Cookies

We only use the cookies Stavore needs to work, such as the one that keeps you signed in. No advertising or tracking cookies. See our cookie notice.

14. Changes to this policy

We'll post any change on this page with a new date. For an important change, we email account owners at least 14 days before it applies.

15. Contact us

For questions or requests about your personal data, contact us. Our registration with the ODPC is in progress.

• WhatsApp: +254 728 718 945
• Where we are: Stavore, Voi, Kenya