Privacy Policy

1. Introduction & Data Controller

This Privacy Policy applies to the personal information collected by Raha (“we,” “us,” or “our”) through our website, mobile interfaces, and associated services. Raha acts as the Data Controller under the Kenya Data Protection Act, 2019 and relevant international data protection frameworks.

By signing up for an account, subscribing, or interacting on Raha, you acknowledge the collection and processing of your information as described in this policy and our Terms of Service.

2. Information We Collect

We collect information in three ways: information you provide, information collected automatically, and information from payment processors.

3. Legal Bases & How We Use Your Data

We process your personal data under the following lawful bases:

• Contractual Necessity: To create your account, authenticate your sessions, process wallet deposits and creator subscriptions, deliver high-speed streaming video, and disburse creator earnings.
• Legal & Regulatory Compliance: To verify that all creators and users are at least 18 years of age, enforce anti-money laundering (AML) controls, maintain statutory tax and financial transaction records, and cooperate with lawful subpoenas.
• Legitimate Interests: To detect and prevent fraud, investigate content piracy and unauthorized screen leaks, secure our servers against attacks, and maintain service reliability.
• Consent: For optional preferences or notifications, which you may revoke at any time in your account settings.

4. Data Security & Storage Architecture

We implement industry-leading technical and organizational measures to safeguard your personal information:

• Passwords are securely salted and hashed using Argon2id (resistant to GPU brute-force).
• All web traffic is encrypted end-to-end using TLS 1.3 encryption.
• Creator KYC documents and verification selfies are stored in encrypted, air-gapped storage vaults with strict administrative access logging.
• Database volumes and file storage are protected with AES-256 encryption at rest.
• Automated rate-limiting, bot detection, and JWT token rotation protect your sessions.

5. Third-Party Data Processors

We partner with trusted third-party service providers who assist us in operating our platform. All processors are bound by strict data processing agreements:

We never disclose user personal data to third parties for independent marketing or advertising.

6. Data Retention & Account Deletion

We retain your personal data for as long as your account remains active. If you delete your account:

• Your public profile, subscription tiers, and uploaded posts will be removed from view.
• Your username and email will be de-indexed.
• Certain financial, payout, and KYC verification records are retained for a statutory period (up to 7 years) as strictly required by Kenyan financial laws, tax reporting mandates, and child-safety compliance audits.

7. Your Rights Under Data Protection Laws

Under the Kenya Data Protection Act, 2019 and applicable data protection legislation, you have the right to:

• Right to be Informed: Know how your data is being used.
• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete personal data.
• Right to Erasure (“Right to be Forgotten”): Request deletion of your personal data where no statutory override applies.
• Right to Restrict or Object: Object to processing of your data for specific purposes.
• Right to Data Portability: Request that your data be provided in a structured, machine-readable format.

To exercise any of these rights, contact our Data Protection Officer at privacy@rahafans.app. We respond to verified requests within thirty (30) days.

8. Minors & Age Protection

Raha is strictly designed and operated for adults aged 18 and older. We do not knowingly collect, solicit, or store personal information from individuals under the age of 18. If we discover that a person under 18 has submitted personal information to Raha, we will immediately delete their data and terminate the account.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect evolving technical, legal, or operational requirements. In the event of material changes, we will notify you via email, platform announcement, or updated timestamp at the top of this page.

10. Contacting Us & Regulatory Inquiries

If you have any questions, comments, or data privacy requests, please reach out directly to our privacy team:

If you believe your data protection rights have been infringed, you also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya (www.odpc.go.ke).