Legal

Privacy Policy

Last updated: 12 November 2026.

This Privacy Policy explains what personal data DISAMBI World Ltd (“DISAMBI”, “we”) collects when you use the DISAMBI platform at disambi.world, why we collect it, where it is kept, how long we keep it, and the rights you have over it under the Data Protection Act, 2019 of Kenya. It is referred to by our Terms of Service, the DISAMBI–Brand Service Level Agreement and the Creator–Brand Collaboration Agreement, and forms part of each.

The short version

A summary to help you find your way. The sections below are the policy.

We collect what the platform needs, and no more. No ID documents, no biometrics, no payment credentials (sections 2 and 3).
We don’t sell your data or use it for advertising. We do not profile you automatically either (section 4).
Agreements are kept as evidence. Signed agreements and their records are kept for six years after the agreement ends, even if you close your account, because the other party may rely on them (section 7).
Your data is processed outside Kenya, mainly in Germany, with safeguards (section 6).
Only essential cookies. No advertising or analytics cookies (section 9).
You have rights over your data and can use them by emailing us, or complain to the Data Protection Commissioner (sections 8 and 13).

1. Who is responsible for your data?

DISAMBI World Ltd, a company incorporated in Kenya, is the data controller for the personal data described here. Where we hold campaign records on a brand’s instructions under a Service Level Agreement, we act as that brand’s data processor for those records and on its documented instructions. Contact details are in section 13.

2. What don’t we collect?

We do not collect government identity documents, photographs of identity cards, or biometric data (no selfies, no face or liveness verification), and we never ask for them. Creators and brands identify themselves on agreements by KRA PIN or business registration number. We do not receive, hold or transmit payments between brands and creators, so we never collect card, bank or mobile-money credentials for those payments.

3. What do we collect?

Account: email address, name, password (stored only as a salted hash), phone number and date of birth if you give them, display preferences, and whether you are a creator or a brand. If you sign in with Google, Google sends us your Google account identifier, name, email address and profile picture link, and we keep them with your account.
Profile: for creators — handle, display name, short bio, country and city, content categories, social platform handles, starting price, avatar and cover image, portfolio items and service packages. For brands — brand name, country, description, website and logo. Profile information you mark as public is shown to other users of the platform.
Campaigns and collaborations: campaign briefs, attachments, messages exchanged between a brand and a creator, content submitted for review, and approval decisions.
Agreements and evidence: when an agreement is signed on the platform we record each party’s legal name, KRA PIN or business registration number, trading name, the exact terms agreed, the time of each signature, the IP address it was made from, and a SHA-256 hash of the terms. Later events — content submission, approval, a creator’s confirmation that a payment was received, and a reminder that a licence is about to end — are recorded the same way. Deemed approval is not a separate entry: it follows from the recorded submission time and the agreed approval window. These records are append-only: they are never edited, and are not deleted before the period in section 7 ends, because both parties may rely on them as evidence. Each party enters its own name and identification number, and a payment confirmation is the creator’s own statement. We do not verify them. Where a document is signed through DocuSign, we also hold the completed document, DocuSign’s Certificate of Completion (which names each signer and their email address and the time they signed), and their hashes.
Deals you record from outside the platform: if you are a creator and upload an agreement made elsewhere, such as a PDF or screenshot from WhatsApp, we keep the file and its name as uploaded, the details you type about it (the brand or client, what was agreed, the date, the fee, when usage rights end, and a note if you add one), its SHA-256 hash and when you uploaded it. The file may contain the other party’s personal data, such as their name, phone number or payment details. We do not read, check or verify it.
WhatsApp: if you are a creator and link a WhatsApp number to record deals, we keep the number and when you linked it. When you send the Disambi WhatsApp number a file, we keep the file, its name and your answers to the bot’s questions until the deal is recorded (then as above) or you cancel. We keep the ID of each message, without its content, so that a message delivered twice is acted on once. We do not keep the chat itself.
Fees: for brands, a record of coordination fees invoiced and paid.
Technical: server logs with IP address, request path, timestamp and browser identifier; error reports that may include the request that failed; rate-limiting counters keyed to IP address.
Waitlist: email address, whether you signed up as a creator or a brand, and, if you tell us, what you make.

4. How do we use it, and on what legal basis?

To operate your account and the platform — performance of a contract with you.
To generate, record and evidence agreements between creators and brands, including signature, approval and payment-confirmation records — performance of a contract, and our and both parties’ legitimate interest in reliable evidence of what was agreed.
To keep deals you record from outside the platform, so that you can find them and show they are unchanged — performance of a contract with you; for the other party’s data in the file, your and our legitimate interest in keeping a record of a deal they made with you. The same applies when you send the deal through WhatsApp; we use your linked number only to know which account it belongs to and to reply to you.
To send transactional email such as verification, password reset, invitations, notice of new messages and reminders that a licence is about to end — performance of a contract.
To keep the platform secure, limit abuse and diagnose faults — legitimate interest.
To comply with tax, company and record-keeping law — legal obligation.
To send waitlist invites and decide who to invite first — your consent, given when you join. An invite is direct marketing. Each one has an unsubscribe link, and you can also ask us by email to remove you.

We do not sell personal data, use it for advertising, or profile users automatically.

Other users: a brand sees the profile, messages and submitted content of creators it works with, and vice versa; the parties to an agreement see the full agreement and its records. Public profile fields are visible to anyone browsing the platform. Deals a creator records from outside the platform are seen only by that creator.

Service providers (processors), acting on our instructions:

DigitalOcean — hosting and database, Frankfurt, Germany.
Backblaze — encrypted off-site backups of the database and uploaded media, stored in the United States; the backups are encrypted before they are uploaded, so Backblaze cannot read them.
Cloudflare — network security, TLS and traffic filtering in front of the platform; sees IP addresses and request metadata. It also hides email addresses shown on our pages from spam bots, and measures how fast pages load in your browser.
Brevo — delivery of our email; sees recipient email addresses and message content. Brevo also records whether and when an email was opened, by means of a small image in the message, together with the IP address and device that opened it.
DocuSign — electronic signature for documents signed outside the platform’s own sign-off; sees signer names, email addresses and the documents.
Meta Platforms (WhatsApp Business Platform) — carries messages between creators and the Disambi WhatsApp number; sees the creator’s number, the files and messages they send it, and our replies. Your use of WhatsApp itself is under WhatsApp’s own terms and privacy policy.
Sentry — error monitoring, on its EU region in Germany; configured not to receive personal identifiers by default, but a report may include data from the request that failed.

Google: if you choose to sign in with Google, Google confirms who you are and sends us the details listed in section 3. Google acts under its own privacy policy, not on our instructions, and we do not send it anything about your use of the platform.

Others: professional advisers under confidentiality; regulators, courts or law enforcement where required by law; a successor to our business, on notice to you.

6. Where is it kept, and does it leave Kenya?

The platform and its database run in Frankfurt, Germany. Encrypted backups, transactional email, signature, WhatsApp messaging, error-monitoring and sign-in-with-Google services are provided from outside Kenya, including the United States and the European Union. Your data therefore leaves Kenya.

We transfer it on the basis of appropriate safeguards (section 48 of the Data Protection Act, 2019): every provider acting on our instructions is bound by contractual data-processing terms, data is encrypted in transit, backups are encrypted before they leave our server, and processing in Germany and France is additionally subject to the EU General Data Protection Regulation. If you do not want your data processed outside Kenya, you should not use the platform.

7. How long do we keep it?

Signed agreements, signature records, approval and payment-confirmation records, signed documents and certificates: six years after the agreement ends — the limitation period for contract claims in Kenya — or longer where the law requires. These are not deleted on account closure, because the other party may still need them as evidence.
Fee records: seven years, for tax purposes.
Deals you record from outside the platform: until you delete them, or until your account closes. The other party never relied on our copy, so the six-year rule above does not apply. Deleting one removes the file and its details. Our records keep a dated note of its hash and size, with nothing that names the deal, and include it in a copy of your data if you ask for one.
WhatsApp: your linked number until you unlink it (on the website, or by sending “unlink” to the bot) or close your account. A deal you start on WhatsApp and don’t finish: deleted within an hour of passing 24 hours since your last answer. Message IDs: 8 days. A link code works for 15 minutes and is deleted within the hour after; we keep only its hash.
Account, profile, campaign and messaging data: while your account is open, then deleted or anonymised within 30 days of closure, except as above. You can close your account in Settings. The records above keep the email address that took each action. Messages you sent are deleted; messages the other party sent stay with them.
Encrypted backups: rotated after 30 days, so deleted data disappears from backups within that period.
Server logs and error reports: up to 90 days.
Copies of emails we send you: 30 days, whether or not they were delivered. They hold your address and the message, including any sign-up or password-reset link, which by then has expired.
Waitlist entries: until you register — deleted within an hour of signing up — or until you ask to be removed. If you never sign up, they are deleted after 12 months.

This is the retention period referred to in clause 16.2 of the Service Level Agreement.

8. What are your rights?

Under the Data Protection Act, 2019 you may ask us to:

tell you what personal data we hold about you, and give you a copy;
correct it;
delete it;
restrict or object to how we use it; and
give you the data you gave us in a portable form.

Ask by email at [email protected]. We will respond within 7 days to a request for a copy of your data, 14 days to a request to correct, delete, restrict or object, and 30 days to a request for a portable copy, and will not charge for a reasonable request. Deletion cannot extend to the agreement and evidence records in section 7, which we must keep for both parties. You may also complain to the Office of the Data Protection Commissioner (odpc.go.ke).

9. Cookies and similar technologies

We set only the cookies the platform needs to work:

a session cookie that keeps you signed in;
a CSRF token that protects forms; and
a short-lived cookie that carries a one-off notice (such as confirmation that a change was saved) to the next page you open.

We do not use advertising or analytics cookies.

Your display theme is saved on your account when you are signed in. When you are not, your browser keeps the choice in its own local storage on your device; it is never sent to us.

We serve the platform’s fonts, icons and scripts from our own servers, so viewing a page does not send your IP address to a font or script provider. Cloudflare, which already sits in front of the platform (section 5), adds two small scripts of its own: one that decodes the email address on pages that show it, and one that measures page speed. Neither sets a cookie.

10. How do we keep it secure?

Traffic is encrypted in transit. Passwords are hashed and never stored in clear. The server accepts web traffic only through Cloudflare. Uploaded files are served with headers that prevent them executing in the browser. Signed documents are held in the database, not on a public path. Backups are encrypted before they leave the server and restore procedures are tested automatically.

11. Children

The platform is for people aged 18 and over. We do not knowingly collect data from anyone younger, and will delete it if we learn we have.

12. How will you know if this policy changes?

We will post any change here with a new “last updated” date and, where a change materially affects how we use your data, tell you by email before it takes effect.

13. How to contact us

For any question about this policy, or to use your rights under section 8, email [email protected]. If you are not satisfied with our response, you may complain to the Office of the Data Protection Commissioner (odpc.go.ke).