Privacy Policy

1. Who we are and how to reach us

Wahy is a “bookable website in minutes” service for Kenyan service businesses — lash studios, barbers, nail salons and similar. Each business (a “tenant”) gets a public booking website and an admin dashboard on its own subdomain of wahylabs.com.

This service is operated by Wahy Labs (“Wahy”, “we”, “us”, “our”), based in Nairobi, Kenya.

• Contact for privacy questions and data requests: contact@wahylabs.com

We follow Kenya’s Data Protection Act, 2019 and the regulations made under it. Because your data is stored and processed in the European Union (see Section 6), it is also handled by providers who are themselves subject to the EU General Data Protection Regulation (GDPR), and we rely on that equivalent level of protection.

2. The two kinds of relationship — please read this first

Wahy is a platform used by many independent businesses. Your relationship with us depends on who you are:

• If you are a business using Wahy (a tenant admin) — for your own account (your login, name, email, billing), Wahy is the “data controller”: we decide how that information is used.
• If you are a customer booking with a business that uses Wahy (for example, you booked a lash appointment with a studio) — the business you booked with is the data controller of your booking information, and Wahy acts as a “data processor” on that business’s behalf. We only handle your information to run the booking service for that business, on its instructions. For questions about how a specific business uses your data — or to exercise your rights against it — contact that business directly. We will help you reach them, and we honour deletion/export requests the business makes on your behalf.

3. Information we collect

3.1 Business owners / tenant admins (Wahy is the controller)

• Sign-up details: your name, email address, business name, web address, and the optional phone number and KRA PIN you enter when you start creating a site.
• Account and identity: your name and email address.
• Google sign-in (if you choose it): your Google profile — name, email address and profile picture.
• Authentication: sign-in is passwordless — an email magic link or Google sign-in. We do not create or store passwords. We store a session record so you stay logged in.
• Billing: your subscription plan, payment status, the phone number used for M-Pesa, the amount, and the M-Pesa transaction/receipt reference. We never see or store card numbers or bank credentials — M-Pesa is mobile money.
• Content you create: your business name, city, country, gallery images, journal posts, FAQs, services and prices, Google Business URL, WhatsApp number and other site settings.

3.2 Customers of a business using Wahy (Wahy is the processor for the tenant)

• Booking details: your name, phone number, WhatsApp number, the service, date and time, and — for a house-call — the address you provide.
• WhatsApp messages: if the business uses our WhatsApp booking/messaging feature, we process your WhatsApp contact details, the content of messages between you and the business, and your opt-in/opt-out status.
• Payments: if you pay through the platform, your M-Pesa phone number, the amount, and the M-Pesa receipt reference (again — no card or bank data).

3.3 Everyone (technical)

• A session cookie to keep you signed in.
• Cloudflare Turnstile — a privacy-friendly bot check on sign-up forms to prevent abuse.
• Basic security logs and error diagnostics (see Section 8). We do not run advertising trackers or sell profiles.

4. Why we use your information, and our lawful basis

Under the Kenya Data Protection Act (s.30) and equivalent GDPR bases, we rely on:

• Performance of a contract — to create and run tenant accounts, authenticate sign-in, take subscription payments via M-Pesa, and deliver the booking service. The reminder emails we send about a sign-up you started are part of this: if you don’t confirm your email, we send up to two reminders.
• Consent — for WhatsApp marketing/re-engagement messages (opt-in, with STOP/START). You can withdraw it at any time: reply STOP to opt out, START to opt back in. We send offers and promotions by email only if you ticked the optional box when you signed up. You can withdraw that consent at any time through the unsubscribe link in any offers email, or by emailing contact@wahylabs.com.
• Legitimate interests — bot-checking, security logging, error tracking and backups to keep the platform safe and reliable.
• Legal obligation — to comply with legal, tax and regulatory duties.

5. Who we share information with (sub-processors)

We do not sell your personal data. We share it only with the service providers we need to run Wahy, each bound by its own data-processing terms to protect it and to use it only for the service it provides to us:

We may also disclose information if required by law, to protect our rights or users’ safety, or as part of a business transfer (merger/acquisition), in which case we will tell you.

6. Where your data is stored, and international transfers

Please note: although Wahy, the businesses on it, and their customers are in Kenya, we store and process personal data on infrastructure located in the European Union — our servers, database and cache run on OVHcloud infrastructure in Gravelines, France, and images and backups are stored on Cloudflare’s storage in Western Europe. Some WhatsApp messaging data is processed by Meta on US/global infrastructure.

This means your data is transferred outside Kenya. Kenya’s Data Protection Act (s.48) allows this where there are appropriate safeguards. Our safeguard is that the data is processed in the EU under the GDPR — a data-protection regime at least as strong as Kenya’s — by providers who are bound by their data-processing terms to protect it. We do not claim the GDPR governs Wahy itself; we rely on it as the protective standard applied by our EU providers. We do not treat your continued use of the service as your consent to this transfer — we rely on the safeguards above.

7. How long we keep your data (retention)

• Active accounts and their content: kept while the account is active.
• Sign-ups you don’t finish: we send up to two reminder emails, then delete the details you entered about 11 days after you start. If you use “Delete my details”, we delete them sooner.
• Sign-ups you finish: the sign-up request record is deleted 30 days after you confirm. Your account keeps what it needs to run.
• After a business deletes its account: your site goes offline straight away. After a 30-day grace period we permanently delete the site, bookings, customers, messages and media. Three things are kept:
  • A copy of each paid Wahy invoice (the invoice number, dates, amounts, the M-Pesa receipt and the KRA PIN printed on it) until 1 January seven years after the year of payment, because Kenyan tax law requires it. It doesn’t include the phone number or business name. Wahy’s own accounts also keep an entry for each of those payments and any refund (the amount, date and M-Pesa receipt), likewise without your phone number or business name.
  • Our security log of the account: the record that it existed and was deleted, and the history of changes made to it, including its business name and web address. When the account is erased, we remove every email address from this log.
  • A login (name, email and, if used, the profile picture from Google) that you or someone on your team also uses with another business on Wahy, because it belongs to that business too. Logins used only for the deleted business are deleted with it, including any Google sign-in link. To ask about them, email contact@wahylabs.com.
• Bookings and WhatsApp messages: bookings are kept while your account is active. The text of each WhatsApp message is erased 90 days after it was sent or received; a record that the message existed (its date, direction and delivery status), any reactions, and any photo or file sent with it are kept while your account is active. When the account is deleted, all of this is erased after the 30-day grace period, as described above.
• Payment records: after an account is deleted, we keep them only as described above.
• Backups: rotated on a rolling cycle; deleted data ages out of backups within that window.

8. How we protect your data

• Tenant isolation: every business’s data is separated at the database level (PostgreSQL Row-Level Security scoped by tenant), so one business can never see another’s data.
• Encryption: sign-in and WhatsApp access tokens are encrypted at rest; all traffic is encrypted in transit (TLS / HTTPS).
• No passwords to steal: sign-in is passwordless (magic link / Google).
• Error tracking with personal data scrubbed: our diagnostics remove personal data before it is recorded.
• No system is perfectly secure, but if a breach occurs that poses a real risk to you, we will notify the Office of the Data Protection Commissioner within 72 hours and affected people where required (Kenya DPA s.43).

9. Your rights

Under the Kenya Data Protection Act (s.26) you have the right to: be informed about how your data is used; access your data; ask for correction of inaccurate data; ask for deletion; object to certain processing; and withdraw consent. We also voluntarily extend GDPR-style data export/portability.

How to exercise your rights:

• Use “Delete my details” in any reminder email to delete an unfinished sign-up at once.
• Business owners (tenant admins): use the export/delete tools in your dashboard, or email contact@wahylabs.com.
• Customers who booked with a business on Wahy: contact that business first — they control your booking data and we act on their instructions. You can also email us and we will route your request to them and assist.

You also have the right to complain to the Office of the Data Protection Commissioner (ODPC) in Kenya (odpc.go.ke).

10. Google user data (Sign-In and Google Calendar)

Google Sign-In. When you sign in with Google, we receive your name, email address and profile picture to create and secure your account.

Google Calendar (optional). A business owner can choose to connect their Google account from their admin dashboard so that bookings appear in a calendar. It is off until they do, and they can disconnect it at any time. When connected, Wahy requests one Google permission:

• https://www.googleapis.com/auth/calendar.app.created — a non-sensitive scope that lets Wahy create and manage only the calendars Wahy itself creates. Wahy creates a dedicated secondary calendar named “<Business> bookings (Wahy)” in the owner’s Google account and creates, updates and deletes the appointment event for each booking made through Wahy only in that calendar. Each event contains the booking’s service, date and time, the client’s name, phone number and email, and the location (and address, for a house call).

Wahy does not read or list the owner’s other calendars, does not read the owner’s other calendars’ events, and does not read free/busy information. Of your calendar data, we store only the identifier of the dedicated calendar Wahy created (plus the encrypted token described below).

How we store it. The Google OAuth refresh token is encrypted at rest with AES-256-GCM and stored in a tenant-isolated database table, so one business can never read another’s connection. It is used only on our servers, is never sent to your browser, and is redacted from data exports.

Retention and deletion. Choosing Disconnect in the admin dashboard revokes Wahy’s access token with Google and deletes the stored token and calendar identifier immediately. You can also revoke Wahy’s access at any time in your Google Account settings. If a business account is permanently deleted, the stored connection is deleted along with the site’s data (Section 7 lists what we keep). The dedicated bookings calendar and its events are left in the owner’s Google account, under the owner’s control, until the owner deletes them.

Wahy’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically: we use Google user data only to provide the sign-in and calendar features you see in the product; we do not sell it, transfer it to advertisers or data brokers, or use it for advertising or credit decisions; and no human reads it except with your explicit consent, for security, or where the law requires. We request the minimum Google permissions needed. Wahy does not use Google user data to develop, improve or train generalized AI or machine-learning models.

11. Cookies

We keep cookies minimal:

• A strictly necessary session cookie to keep you signed in.
• Cloudflare Turnstile for bot protection on sign-up.

We do not use advertising cookies or cross-site tracking.

12. Children

Wahy is a business tool and its booking services are intended for adults. It is not directed at children, and we do not knowingly collect data from anyone under 18 (the age of majority in Kenya). If you believe a child’s data has been collected, contact us and we will delete it.

13. Changes to this policy

We may update this policy as the service or the law changes. We will change the “Last updated” date above and, for material changes, take reasonable steps to notify tenants (e.g. by email or an in-app notice).

14. Contact

Questions or requests: contact@wahylabs.com. To complain to a regulator: the Office of the Data Protection Commissioner, Kenya — odpc.go.ke.