Privacy Policy

For your account information (as a business that signs up for Aisha), we act as the data controller.

For your customers' information that flows through your connected WhatsApp — their messages, names, and phone numbers — you are the data controller, and we act as a data processor handling that information on your behalf, solely to provide the Service. You are responsible for having a lawful basis and any required consent to process your customers' data, and for your own privacy notices to them.

• Account details — your name, email address, business name, and the phone number of the WhatsApp line you connect.
• Conversations & contacts— messages exchanged with your customers through the Service, your customers' WhatsApp names and numbers, and the replies Aisha drafts or sends.
• Catalog & business data — the products, prices, delivery fees, and settings you add.
• Order & payment data — order details, amounts, payment status, payout (M-Pesa) numbers, and wallet and withdrawal history. Card and bank details are entered directly with our payment providers; we do not see or store full card numbers. Any provider API keys you add are encrypted at rest.
• Usage & device data — how you interact with our website and app, including pages viewed, clicks, approximate location, browser and device type, and IP address, collected through analytics (see below).

We use Microsoft Clarity to understand how people use our website. Clarity may set cookies and capture usage data — including mouse movements, clicks, scrolls, and session recordings and heatmaps of your visit — which is processed by Microsoft to help us improve the Service. We may combine this with other usage data for the same purpose. You can learn more from Microsoft's privacy documentation, and you can limit tracking through your browser settings.

We use cookies and similar technologies to keep you signed in, remember your preferences, and measure and improve the Service. Essential cookies are needed for the Service to work; analytics cookies are used as described above.

• to provide, operate, and secure the Service and your account;
• to let Aisha reply to your customers, quote from your catalog, total orders, generate payment links, and help you track payments and shipping;
• to process your subscription and facilitate collection and payout of your sales;
• to provide support, send service-related messages, and prevent fraud or abuse;
• to analyse and improve the Service; and
• to comply with legal obligations.

To generate replies, the content of relevant customer messages, along with your catalog and business context, is sent to our AI provider, Anthropic, which processes it to produce a suggested response. Replies are automated and may contain errors; you can review activity, disable auto-reply, or take over any chat at any time.

We do not sell your personal information. We share it only with:

• Service providers that help us run Aisha, including Anthropic (AI), Paystack and Intasend (payments and payouts), Microsoft Clarity (analytics), the WhatsApp platform, and our hosting and infrastructure providers — each only as needed to provide their part of the Service;
• Authorities or third parties where required by law, to enforce our Terms, or to protect the rights, safety, and property of The Tech Hut, our users, or others; and
• A successor in the event of a merger, acquisition, or sale of assets, subject to this Policy.

Some of our providers (such as Anthropic and Microsoft) process data outside Kenya, including in the United States and other countries. Where we transfer personal data across borders, we take steps to ensure it remains protected in line with applicable law.

We keep personal information for as long as your account is active and as needed to provide the Service, then only as long as necessary to meet legal, accounting, or reporting requirements or to resolve disputes. When you delete your account or ask us to, we will delete or anonymise your personal data within a reasonable period, except where we must retain it by law.

We use reasonable technical and organisational measures to protect personal information — including encryption of sensitive credentials at rest and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your data and to respond promptly to any incident.

Subject to the Data Protection Act, 2019, you have the right to access, correct, update, or delete your personal data, to object to or restrict certain processing, to withdraw consent, and to request a copy of your data. To exercise these rights, contact us using the details below. If your request concerns data about your customers, please direct it to the business you dealt with, who is the controller of that data.

The Service is intended for businesses and is not directed at children under 18. We do not knowingly collect personal data from children.

We may update this Policy from time to time. If we make material changes, we will update the date above and, where appropriate, notify you. Continued use of the Service after changes take effect means you accept the updated Policy.

For any privacy questions or to exercise your rights, contact The Tech Hut at info@thetechhut.co.