Privacy Policy
Version 1.0 · updated 21 September 2026
Draft pending legal review. This document describes how AVYRA actually works and is published so the product is not shipped with an empty policy. It has not been reviewed by an advocate. Replace it through Admin → Content before public launch.
This notice explains what personal data AVYRA collects, why, and what rights you have over it. It is written to meet the Data Protection Act 2019 (Kenya).
Who is responsible
The operator of AVYRA is the data controller for the personal data described here. Our Data Protection Officer can be reached at privacy@avyra.co.ke.
What we collect
What you give us
- Account details: email address, password (stored only as a hash, never in a readable form), date of birth, and display name. - Profile content: photos, gender and who you are interested in, your bio, prompt answers, interests, your university and course, and your intent. - Verification: your university email address, or the selfie you submit if your institution has no verifiable domain. - Messages you send to other members, and reports you make. - Payment records, where you buy a paid tier. Card and M-Pesa credentials are handled by our payment provider — we receive a confirmation and a reference, not your PIN.
What the service generates
- Approximate location. Location is deliberately imprecise: we store and show a coarsened position, never your exact coordinates, and distance is shown rounded. - How you use the app — screens visited, likes and passes, and the technical logs any web service keeps (IP address, device and browser, timestamps). - Safety signals: moderation outcomes, blocks, and the record of an enforcement decision.
Why we use it, and our lawful basis
| What for | Basis |
|---|---|
| Creating and running your account | Performance of a contract with you |
| Showing you to other members and them to you | Performance of a contract with you |
| Verifying that members are students and are real | Legitimate interest in a safe platform, and your consent for a selfie |
| Moderation, safety and preventing fraud | Legitimate interest, and legal obligation |
| Taking payment | Performance of a contract, and legal obligation for financial records |
| Analytics about how the product is used | Consent — you choose this in the cookie banner |
| Marketing email | Consent, which you can withdraw from any message |
We do not sell your personal data. We do not use your messages or your photos to target advertising.
Who else sees it
- Other members see what your profile and privacy settings say they can see. - Service providers who process data on our behalf under contract: hosting, the payment provider, email and SMS delivery, and error monitoring. - Authorities, where we are legally required to disclose, or where there is a serious and immediate risk to someone's life.
Some providers are outside Kenya. Where data is transferred abroad we rely on the safeguards the Act requires.
How long we keep it
- Active account: for as long as your account exists. - After you delete your account: your profile and photos are removed and your messages are disassociated from you. A limited record — the fact an account existed, enforcement history, and financial records — is retained where we are required to keep it, for up to seven years for tax and accounting purposes and for as long as needed to stop a banned user returning. - Technical logs: a short rolling window, then discarded.
Your rights
Under the Act you may ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or withdraw a consent you previously gave.
Two of these are built into the product rather than requiring an email: Settings → Export your data produces a machine-readable copy, and Settings → Delete account starts deletion. For anything else, write to privacy@avyra.co.ke and we will respond within the statutory period.
If you are not satisfied with our response you may complain to the Office of the Data Protection Commissioner (ODPC).
Security
Passwords are hashed. Traffic is encrypted in transit. Access to member data by our staff is limited by role, and administrative actions against an account are logged in an append-only record. Access to sensitive functions requires a second factor.
No system is perfectly secure. If a breach affects your rights we will notify you and the ODPC as the Act requires.
Children
AVYRA is for adults. We do not knowingly collect data from anyone under 18, and an account we believe belongs to a minor is removed. If you believe a minor is using AVYRA, report the profile — it is treated as the highest priority.
Changes
Material changes are notified in advance and the version at the top of this page is updated.