Privacy notice
In effect from 2026-10-31
Felix Orinda, trading as Pichafiti, in Kenya, decides how your personal data is used on Pichafiti.
What we collect, and why
- Your email address and name, to sign you in and contact you about your account.
- If you turn on alerts: a push address for your device, which we remove when you sign out.
- If you sign in with Google: your Google account ID, name and email, to recognise you.
- If you're a provider: your profile, area, services, and any phone number or social links you add. Only what you choose to show is public.
- Photos you upload, and your confirmation that you may publish them. We remove location data from photos when you upload them.
- Counts of profile views and contact taps, so providers and we can see what's working. These use a code that changes daily, not your name, IP address or device details.
- Records of reports, decisions and sign-ins, to keep the service safe.
People shown in photos
If you're in a photo on Pichafiti and want it removed, you don't need an account. Use the Report link on the photo or profile. How removing photos works.
Who else handles your data
Our hosting, storage, delivery network and email providers process data for us, and Google does if you sign in with it. Some of them store data outside Kenya, including in the European Union. We don't sell your data. When you contact a provider on WhatsApp, WhatsApp's own terms apply to that conversation.
How long we keep it
If you share your saved list, anyone with the link can see the providers on it, but not your notes or your name, until you stop sharing it. Gear listings that are sold or taken down are deleted after 12 months, with their photos. Drafts and listings that weren’t approved go after 90 days without a change. Messages stay until the client in that conversation deletes their account, which removes the whole conversation. A team member who deletes theirs leaves their messages as the workspace's, without their name. Photos sent in a conversation are private, and deleted after 12 months. Conversations are private. If someone reports one, staff may read it only to handle that report, and each reading is logged. If you tap to contact a provider while signed in, we keep that link to your account for 30 days, so we can email you once, 7 to 14 days later, asking whether you booked. You can stop those emails from the email itself. We delete your answer after 180 days. We keep account data until you delete your account or ask us to. Sign-in codes expire within minutes and are deleted after a day. Expired sessions are deleted daily. Queued emails, which hold addresses and message text, are deleted 30 days after sending, or after 90 days if sending failed. Team invites are deleted after 90 days. The name, phone, location and notes on a booking are removed 90 days after it closes, or 90 days after its date if nobody closed it. Records of reports and decisions may be kept longer, where we need them to handle disputes or meet legal duties.
Your rights
You can download your data from your account page. You can also ask to see, correct, move or delete your data, or object to how we use it, by emailing [email protected]. You can also complain to Kenya's Office of the Data Protection Commissioner.
Children
Pichafiti is for people aged 18 or older, and photos may not show identifiable children.