Privacy Policy

Last updated: 24 September 2026

This Privacy Policy describes how Wencreatives Limited (“we”, “us”, “our”) collects, uses, and protects personal information when you use VunaFlow(the “Service”), including the VunaFlow Operator mobile app, our website at vunaflow.co.ke, and all associated dashboards, captive portals, and APIs.

We are committed to the principles of the Kenya Data Protection Act, 2019, and where applicable, the GDPR. This policy explains what data we hold, why we hold it, and how you can exercise your rights.

1. Who we are

2. Information we collect

2.1 ISP account holders (our direct customers)

• Name, email address, and phone number used to register your ISP account
• Business name and address of your ISP
• Payment and billing records (we do not store full card details — payments are processed by third-party processors such as Safaricom M-Pesa)
• Authentication metadata (login timestamps, IP address, browser/device user-agent)
• Mobile authentication tokens stored in the device operating system's protected credential storage
• Device platform and push-notification token used to deliver operational alerts you allow
• Configuration data you enter (routers, packages, vouchers, captive portal design)
• Support tickets, feedback messages, and an optional screenshot when you choose to attach one
• SMS recipients and message content for communications you choose to send through the Service

2.2 End-user subscribers (your customers, processed on your behalf)

• Phone number used to purchase a hotspot voucher or PPPoE plan
• Session data: connection start/stop times, MAC address, IP allocation, data usage
• Payment transaction references (M-Pesa receipt numbers, amounts, timestamps)
• Voucher codes and plan assignments

For end-user subscribers, the ISP using VunaFlow is the data controller and Wencreatives Limited is the data processor. Each ISP is responsible for providing its own privacy notice to its subscribers.

2.3 Website visitors

When you visit vunaflow.co.ke, we use minimal first-party analytics to understand aggregate traffic patterns. We do not use third-party advertising cookies.

2.4 Mobile files, images, and sharing

The mobile app opens the operating system's image picker only when you choose to attach an image. The selected screenshot is uploaded only if you submit that feedback report. The app can also create CSV files, receipts, print views, voucher sheets, and router setup files when you request them. Those files are passed to the system file, print, or share interface and only go to an app or person you choose. Copies held by the receiving service are governed by that service's own privacy terms.

3. How we use information

• To provide and maintain the Service
• To process payments and issue invoices
• To send service-related communications (security alerts, billing notices, downtime updates)
• To register an authorised device for push notifications and route a notification to the relevant operator screen
• To provide customer support
• To detect and prevent abuse, fraud, and security threats
• To comply with legal obligations under Kenyan law
• With your explicit consent, to send product updates and marketing

4. Legal basis for processing

We process personal information on these legal bases:

• Contract: to deliver the Service you have signed up for
• Legitimate interest: to secure the platform and prevent fraud
• Legal obligation: to comply with tax, accounting, and lawful-disclosure requirements
• Consent: for optional marketing communications, which you can withdraw at any time

5. Sharing of information

We do not sell personal information. We share it only with carefully chosen processors who help us run the Service:

• Hosting and infrastructure: our cloud and on-premise hosts in Kenya
• Payment processors: Safaricom M-Pesa and other mobile money providers, for processing transactions
• Mobile delivery services: Expo Application Services and Google Firebase Cloud Messaging, for app updates and push-notification delivery using the required technical device and push identifiers
• Communication services: Meta Platforms (WhatsApp, Instagram, Facebook Messenger) for business messaging, where you have initiated contact with us through those channels
• Services you choose: an app, printer, cloud drive, or person you select through the device's system share interface
• Government authorities: when required by Kenyan law, including the Kenya Revenue Authority, the Office of the Data Protection Commissioner, or a competent court order

6. International transfers

Some of our processors operate outside Kenya. When we transfer personal data internationally, we rely on contractual safeguards and only work with processors that meet recognized data-protection standards.

7. Data retention

• ISP account data: retained for as long as the account is active, plus 7 years to meet Kenyan tax and accounting obligations after account closure
• Subscriber connection sessions (device address, IP address, data used): deleted automatically 90 days after the session was last seen
• Subscriber purchase and payment records: retained for as long as the ISP's account is active and for the period Kenyan tax law requires afterwards, because they are the ISP's sales records
• Server access and system logs: deleted automatically after 90 days
• Device push tokens: retained while needed to deliver operator alerts; invalid tokens are removed when the delivery service reports them unusable
• Support feedback and optional screenshots: retained while needed to investigate and document the request, subject to applicable account, legal, and data-rights requirements
• Marketing-list email addresses: retained until you unsubscribe

8. Your rights

Under the Kenya Data Protection Act, 2019, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data (subject to legal retention requirements)
• Object to or restrict certain processing
• Withdraw consent at any time for processing based on consent
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya

To exercise any of these rights, email wencreatives254@gmail.com with the subject line “Data Rights Request”. We will respond within 30 days.

9. Security

We use industry-standard safeguards, including TLS encryption for all data in transit, encrypted storage for sensitive credentials, role-based access controls inside the dashboard, and audit logging of administrative actions. The mobile app keeps its authentication token in operating-system protected credential storage and does not request broad access to your photo library or shared storage. No system is perfectly secure; if you suspect your account has been compromised, contact us immediately.

If we become aware of a personal data breach that is likely to put data subjects at risk, we notify the Office of the Data Protection Commissioner within 72 hours, tell every affected ISP without undue delay so they can inform their subscribers, and record what happened and what we changed.

10. Children

VunaFlow is a B2B service for ISPs and is not directed at children under 18. We do not knowingly collect personal data from children. If you believe a child has provided personal data to us, contact us so we can delete it.

11. Changes to this policy

We may update this policy from time to time. Material changes will be announced in the dashboard and on this page; the “Last updated” date will reflect the most recent revision.

12. Contact

Questions, complaints, or data requests should be sent to wencreatives254@gmail.com or by post to: Wencreatives Limited, P.O. Box 20100, Nakuru, 20100, Kenya. The company's data protection contact is its Director. Wencreatives Limited (company number PVT-J615KJ93) has applied to the Office of the Data Protection Commissioner for registration as a data controller and data processor.