Vira.chat Privacy Policy

1. Introduction

1.1  Fansoft Solutions ("Fansoft", "we", "us", or "our") respects your privacy and is committed to protecting the personal data of everyone who uses vira.chat and its related mobile and web applications (together, "vira.chat" or the "Service"). This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, and the rights you have in respect of your personal data.

1.2  This Privacy Policy is issued in compliance with the Data Protection Act, 2019 (Laws of Kenya) and its subsidiary regulations, and applies to all users of vira.chat, whether you access the Service from Kenya or elsewhere.

1.3  By creating an account or otherwise using vira.chat, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Privacy Policy, please do not use vira.chat.

2. Who We Are

2.1  vira.chat is developed, owned, and operated by Fansoft Solutions, a company incorporated under the laws of the Republic of Kenya, with its registered office at F17, Ruaraka Square, Thika Road, Nairobi, Kenya (P.O. Box 15455 – 00400, Nairobi, Kenya).

2.2  For the purposes of the Data Protection Act, Fansoft Solutions is the Data Controller in respect of the personal data described in this Privacy Policy, save where otherwise stated.

2.3  You may contact us regarding this Privacy Policy or any data protection matter using the details in Clause 18 (Contact Us).

3. Scope of This Policy

3.1  This Privacy Policy applies to personal data we collect through: (a) the vira.chat mobile and web applications; (b) your interactions with our customer support; and (c) our website at vira.chat.

3.2  This Privacy Policy does not apply to third-party websites, applications, or services that may be linked from vira.chat, which are governed by their own privacy policies.

3.3  If you access vira.chat as an employee or authorised User of a business Client under a separate subscription agreement with Fansoft, this Privacy Policy applies to you in addition to any internal policies of that Client.

4. Personal Data We Collect

4.1  Account and Registration Data. When you create a vira.chat account, we collect information such as your name, phone number and/or email address, password (stored in encrypted/hashed form), and, if you choose to provide one, a profile photograph.

4.2  Message Content and Media. We process the content you send and receive through vira.chat, including text messages, images, voice notes, videos, documents, and other files, together with associated metadata such as the sender, recipient, and timestamp of each message.

4.3  Contacts Data. If you grant vira.chat permission to access your device's address book, we process the phone numbers and/or names in your contacts solely to help you find and connect with other vira.chat users. We do not use your contacts for any other purpose, and you may withdraw this permission at any time through your device settings.

4.4  Automatically Collected Technical Data. Like most apps, vira.chat automatically collects certain technical information when you use the Service, including your IP address, device model and operating system, app version, and basic usage and log data (such as login times and error or crash logs). We collect this data to keep the Service secure, diagnose problems, and improve performance.

4.5  Information from Business Clients. Where you use vira.chat as part of a subscription taken out by a business Client (for example, your employer), we may receive limited account information (such as your name and contact details) from that Client for the purpose of provisioning your account.

4.6  We do not knowingly collect more personal data than is necessary for the purposes described in this Privacy Policy, and we do not collect precise location data.

4.7  AI Reply (optional, organization-enabled feature). Where an organization using vira.chat has enabled AI Reply, the relevant conversation text is sent to our AI subprocessor, OpenAI, L.L.C. ("OpenAI"), to generate a suggested response for the staff member to review, edit, or send. Under OpenAI's standard API terms, data submitted through its API is not used to train its models by default. This feature is off unless an organization's administrator turns it on for their own account.

5. How We Use Your Personal Data

We use the personal data described in Clause 4 to:

• create and manage your account and authenticate your access to vira.chat;
• transmit, deliver, and, where necessary, store your messages and media so that you can send and receive communications;
• help you find and connect with contacts who also use vira.chat;
• provide customer support and respond to your enquiries;
• maintain the security, integrity, and reliability of vira.chat, including detecting and preventing fraud, abuse, and unauthorised access;
• diagnose technical issues and improve the functionality and performance of the Service;
• send you service-related communications (such as verification codes, security alerts, and updates to this Privacy Policy or our Terms of Service); and
• comply with applicable law, regulatory requirements, and lawful requests from public authorities.

We do not use your message content to serve you targeted advertising, and we do not sell your personal data to third parties.

6. Legal Basis for Processing

6.1  In accordance with the Data Protection Act, we process your personal data on one or more of the following lawful bases: (a) performance of the contract between you (or the business Client through which you access vira.chat) and Fansoft for provision of the Service; (b) your consent, for example when you grant access to your contacts, which you may withdraw at any time; (c) our legitimate interests in operating, securing, and improving vira.chat, provided these interests are not overridden by your rights and freedoms; and (d) compliance with a legal obligation to which we are subject.

7. How We Share Your Personal Data

7.1  With Other Users. Because vira.chat is a communications service, the messages and media you send are necessarily shared with the recipient(s) you choose.

7.2  With Service Providers. We engage trusted third-party service providers to help us operate vira.chat, including cloud hosting and infrastructure providers, push-notification services (including each user's own browser/device vendor, for delivering notifications), basic analytics providers, and — only where an organization has switched on AI Reply (see Clause 4.7) — OpenAI, for generating suggested replies from that organization's conversation text. These providers process personal data solely on our instructions (or, for AI Reply, the enabling organization's instructions) and only to the extent necessary to perform their functions, under contractual confidentiality and security obligations consistent with the Data Protection Act.

7.3  For Legal Reasons. We may disclose personal data where required to comply with applicable law, a court order, or a lawful request from the ODPC or another competent authority, or where necessary to protect the rights, property, or safety of Fansoft, our users, or the public.

7.4  Business Transfers. If Fansoft is involved in a merger, acquisition, financing, or sale of all or part of its business, personal data may be transferred as part of that transaction, subject to this Privacy Policy (or a policy offering equivalent protection).

7.5  With Your Consent. We may share personal data for any other purpose with your explicit consent.

7.6  We do not sell, rent, or trade your personal data to third parties for their own marketing purposes.

8. Message Storage and Retention

8.1  Unlike some end-to-end encrypted messaging services, messages and media sent through vira.chat are transmitted through, and stored on, servers operated by or on behalf of Fansoft, so that we can deliver messages reliably, provide chat history, enable customer support, and maintain backups.

8.2  We retain personal data only for as long as reasonably necessary to fulfil the purposes described in this Privacy Policy, including to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. As a general guide: (a) account data is retained for as long as your account remains active, and for up to twelve (12) months after account closure to allow for account recovery and to meet legal or accounting requirements; and (b) message content is retained for as long as it remains available in your chat history or, if earlier, until you or the recipient delete it, save for residual copies retained in routine backups for a limited period before scheduled deletion.

8.3  We may retain certain data for longer where required by applicable law, to resolve disputes, or to enforce our agreements.

9. Cross-Border Data Transfers

9.1  Fansoft's infrastructure and service providers may process personal data in locations outside Kenya. Where we transfer personal data outside Kenya, we do so only where permitted by the Data Protection Act, including where: (a) the destination country has adequate data protection safeguards; (b) appropriate contractual or other safeguards are in place with the recipient; or (c) you have given your consent to the transfer.

9.2  We take reasonable steps to ensure that any recipient of personal data outside Kenya provides a level of protection consistent with the Data Protection Act.

10. Data Security

10.1  We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access, including encryption of data in transit, access controls, and confidentiality obligations on our staff and service providers.

10.2  No method of transmission or storage is completely secure. While we work to protect your personal data, we cannot guarantee its absolute security, and you also play a role in protecting your account, including by keeping your login credentials confidential and notifying us promptly of any unauthorised use.

11. Your Rights as a Data Subject

Subject to applicable law, you have the right to:

• be informed of the personal data we hold about you and how it is processed;
• access a copy of your personal data;
• request correction of inaccurate or incomplete personal data;
• request erasure of your personal data, subject to our right to retain data as described in Clause 8 or as required by law;
• object to, or request restriction of, certain processing of your personal data;
• request the transfer of your personal data to you or a third party in a structured, commonly used, machine-readable format (data portability), where technically feasible;
• withdraw any consent you have given at any time, without affecting the lawfulness of processing before withdrawal; and
• lodge a complaint with the Office of the Data Protection Commissioner (see Clause 17) if you believe your rights have been infringed.

12. How to Exercise Your Rights

12.1  You can exercise most of these rights directly within the vira.chat app (for example, editing your profile or deleting messages), or by contacting us using the details in Clause 18.

12.2  We will respond to verified requests within the timelines prescribed by the Data Protection Act, and in any event without undue delay. We may ask you to verify your identity before actioning a request, and in limited circumstances permitted by law, we may decline or limit a request, for example where required to comply with a legal obligation or to protect the rights of others.

13. Children's Privacy

13.1  vira.chat is not directed at, and is not intended for use by, children under the age of eighteen (18). We do not knowingly collect personal data from children under eighteen (18).

13.2  If we become aware that we have inadvertently collected personal data from a child under eighteen (18) without appropriate parental or guardian consent, we will take reasonable steps to delete that data promptly. If you believe a child has provided us with personal data, please contact us using the details in Clause 18.

14. Cookies and Similar Technologies

14.1  Our website at vira.chat may use cookies and similar technologies (such as local storage) to keep you signed in, remember your preferences, and understand how visitors use our website.

14.2  You can control cookies through your browser settings; however, disabling cookies may affect the functionality of our website. We do not use cookies to track you across unrelated third-party websites for advertising purposes.

15. Data Breach Notification

15.1  In the event of a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of, or access to, personal data that is likely to result in a risk to your rights and freedoms, we will notify the Office of the Data Protection Commissioner within the timelines required under the Data Protection Act (generally within seventy-two (72) hours of becoming aware of the breach) and will notify affected users without undue delay where required by law.

16. Changes to This Privacy Policy

16.1  We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. We will post the updated Privacy Policy on vira.chat with a revised "Effective Date" and, where changes are material, we will provide additional notice (such as an in-app notification or email) before the changes take effect. Your continued use of vira.chat after an update constitutes acceptance of the revised Privacy Policy.

17. Complaints

17.1  If you have a concern about how we handle your personal data, we encourage you to contact us first using the details in Clause 18 so that we can try to resolve it directly.

17.2  You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC):

• Address: Britam Towers, 12th Floor, Hospital Road, Upperhill, Nairobi, Kenya (P.O. Box 30920-00100 G.P.O, Nairobi)
• Email: info@odpc.go.ke
• Website: www.odpc.go.ke

18. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us at:

Fansoft Solutions
F17, Ruaraka Square, Thika Road, Nairobi, Kenya
P.O. Box 15455 – 00400, Nairobi, Kenya
Email: hello@fansoftsolutions.com
Phone: 0724 998 899

For our general terms of use, see our Terms of Service. For more detail on how we secure data (encryption, hosting, backups, and related controls), see our Security page.