Privacy Policy
Effective 2 October 2026 · RIYO Ventures Limited · Applies to darursoft.com and to the services DarurSoft provides
1. Who we are
DarurSoft is a technology business operated by RIYO Ventures Limited, a private limited company incorporated in Kenya (registration no. PVT-7LUQL29), with its registered office at Riyo Place, Kirongothi Street, Eastleigh, P.O. Box 71909 – 00622, Nairobi, Kenya. In this policy “we”, “us” and “DarurSoft” mean RIYO Ventures Limited.
We are the data controller for information about people who visit darursoft.com, contact us, or hire us. Where we build, host or manage a website, app or social media account for a client, and it handles data about the client’s own customers, the client is the controller of that data and we act as its data processor: the client decides why the data is used, and we only act on its instructions. Section 2 sets out which group you are in.
Products we run under their own name have their own privacy policy, which applies when you use them — for example the TickBalance Privacy Policy.
We process personal data in accordance with the Kenya Data Protection Act, 2019 and, where it applies, the EU/UK General Data Protection Regulation.
2. Who this policy covers
This policy applies to four groups of people:
- Visitors to darursoft.com.
- People who contact us by WhatsApp, email or phone, whether or not they become clients.
- Clients — businesses that hire us, and the staff who work with us on their behalf.
- Our clients’ customers — people whose data passes through a website, app or social media account we build, host or manage for a client. The client decides why your data is processed; contact that business first, and us if you need help reaching them.
3. Data we collect
3.1 Information you give us
- Contact details — your name, phone number, WhatsApp profile name, email address and business name.
- Messages and project files — what you tell us about your business and project, and the text, logos, photos, documents and other content you send us to use in your work.
- Access details — logins, passwords or keys for domain, hosting, app store or social media accounts, where you give them to us so we can do the work.
- Billing details — business name, address, tax identifiers, and records of the invoices we send and the payments you make.
3.2 Information collected when you visit darursoft.com
- Technical data — your IP address, browser and device type, the pages you request and when, recorded in our hosting provider’s server logs.
- Anonymous visit statistics — the page viewed, the site that sent you, your browser, operating system, device type and country, collected by Vercel Web Analytics. It does not use cookies and cannot identify you.
- Your light or dark mode choice — saved only in your own browser.
darursoft.com has no sign-up, no log-in and no forms. We only learn who you are if you contact us.
3.3 Data we handle for clients
When we build, host or manage something for a client, we may handle data about that client’s own customers — for example messages sent through a contact form on a website we host, or comments and messages on a social media account we manage. We use it only to do the work the client asked for.
We do not collect special categories of personal data (such as health, religion or biometric data) and ask you not to send them to us.
4. How we use data
Answer your questions and send you a quote
- Data used
- Contact details and the messages you send us
- Legal basis
- Steps you ask us to take before a contract; legitimate interest in replying to you
Build, host or manage the website, app or social media account you hired us for
- Data used
- Project files, content and access details
- Legal basis
- Performance of our contract with you
Send invoices, record payments and keep accounting records
- Data used
- Billing details and payment records
- Legal basis
- Contract; legal obligation under Kenyan tax law
Run darursoft.com, keep it secure and fix errors
- Data used
- Technical data and server logs
- Legal basis
- Legitimate interest in keeping the website working and safe
Count visits so we know which pages are useful
- Data used
- Anonymous visit statistics
- Legal basis
- Legitimate interest in improving the website
Tell clients about their service and security issues and, with your consent, about new services
- Data used
- Contact details
- Legal basis
- Contract for service notices; consent for marketing
We do not sell personal data, use your messages or project files for advertising, or use one client’s data in another client’s project.
5. WhatsApp and email
Most people reach us on WhatsApp or by email. The following applies to those conversations.
- WhatsApp is run by Meta. When you tap “Chat on WhatsApp”, the conversation happens in WhatsApp, operated by Meta Platforms, Inc. and its affiliates (“Meta”). Your messages pass through Meta’s systems, which are hosted outside Kenya, under the WhatsApp Privacy Policy.
- What we see. Your phone number, the profile name you share on WhatsApp, and the messages and files you send us. We use them only to reply to you and to do the work you ask for.
- No marketing without your agreement. We do not add you to broadcast lists or send you promotional messages unless you have agreed to receive them. You can stop them at any time by telling us or by blocking our number.
- Email. Messages sent to info@darursoft.com are stored by our email provider and read only by the people who need to answer them.
Want us to delete your conversation with us? Send us a WhatsApp message or email info@darursoft.com and we will delete it. See section 11.
WhatsApp Business messaging we run for clients
Some apps we build let a client connect its own WhatsApp Business account through Meta’s secure sign-up (Embedded Signup), so the app can send messages to the client’s customers and receive their replies. For this data the client is the controller and we are its processor (section 1).
- What we collect — the client’s WhatsApp Business account ID, phone number ID and Meta business portfolio ID; an access token that lets the app send messages for the client, which we keep encrypted; the client’s message templates; customers’ phone numbers and WhatsApp profile names; and the content and delivery status of messages sent and received.
- Why — only to send and receive messages for that client. We never sell this data, use it for advertising, or use it for any other client.
- How long — while the client keeps its account connected and uses our service. The access token is deleted as soon as the client disconnects; the rest is deleted when the client asks, or within 90 days after our service ends.
- Deleting it — a client can disconnect its WhatsApp Business account at any time in its Meta business settings or by asking us, and can ask us to delete the data by emailing info@darursoft.com. A customer who received messages can ask the business to stop or to delete their data, or email us and we will pass the request on (section 11).
6. Who we share data with
- Vercel — hosts darursoft.com, keeps its server logs and provides the anonymous visit statistics, under its privacy policy.
- Meta Platforms — to carry WhatsApp conversations (section 5).
- Email and cloud storage providers — who store our emails and project files on our behalf under contracts that restrict them to our instructions.
- Services your project needs — for example domain registrars, hosting providers, app stores and social media platforms. We share only what the project needs, and only for work you have asked us to do.
- Banks and payment providers — to receive the payments you make to us.
- Professional advisers and auditors — under confidentiality obligations.
- Regulators, law enforcement and courts — where the law requires it or to protect our rights, our clients or the public.
- A buyer or successor — if RIYO Ventures Limited is sold or merges, subject to this policy continuing to apply.
7. International transfers
We are based in Kenya. Some providers listed in section 6 — in particular Vercel, Meta and our email and cloud storage providers — process data in the United States, the European Union and other countries. Where personal data leaves Kenya we rely on the transfer conditions in section 48 of the Data Protection Act, 2019: appropriate safeguards such as contractual data-protection terms, the recipient’s own adequate protections, or your consent where no other basis applies.
8. How long we keep data
- Enquiries and messages
- 3 years after our last conversation
- Project files and content
- For as long as we work on, host or maintain the project, then up to 90 days so you can ask for a copy, then deleted
- Access details you give us (logins, passwords, API keys)
- Until the work that needed them is finished, then deleted
- Invoices and accounting records
- 7 years after the transaction, as required by Kenyan financial and tax law
- WhatsApp Business data we process for clients
- While the client’s account is connected; access tokens deleted on disconnect; everything else deleted when the client asks, or within 90 days after our service ends
- Server logs
- Up to 12 months
- Visit statistics
- Kept only as totals that cannot identify you
9. Security
darursoft.com is served only over encrypted HTTPS connections. Project files and access details are available only to the people working on your project, and we ask you to change any password you gave us once the work is finished. No system is perfectly secure; if we discover a breach that affects you we will notify you and the Office of the Data Protection Commissioner as the law requires.
10. Your rights
Under the Data Protection Act, 2019 (and the GDPR where it applies) you have the right to:
- be told how your data is used — this policy;
- access the personal data we hold about you and receive a copy;
- correct data that is inaccurate or incomplete;
- delete your data — see section 11;
- object to processing based on legitimate interests, and to any direct marketing;
- restrict processing while a dispute is resolved;
- port data you gave us to another provider in a machine-readable format;
- withdraw consent at any time where consent is the basis for processing;
- complain to the Office of the Data Protection Commissioner in Kenya, or to your local supervisory authority.
To exercise any right, email info@darursoft.com. We respond within 30 days and may ask you to verify your identity first. Exercising these rights is free of charge.
11. Deleting your data
Anyone whose data we hold can ask for it to be deleted, at no cost, from anywhere in the world, whether or not they are a client. There are two ways:
- By email — write to info@darursoft.com with the subject “Data deletion request”. Tell us the email address, phone number or business name the data relates to.
- On WhatsApp — send a message to +1 681 677 2839 asking us to delete your data.
What happens next. We confirm receipt within 3 business days and complete the deletion within 30 days. We delete your contact details, messages, project files and any access details we hold. We keep only what the law obliges us to keep — invoices and accounting records for 7 years under Kenyan tax law — and hold that data in a restricted archive used for nothing else.
If you are a client’s customer, ask the business that holds your data first. If you write to us, we will pass your request to that business and help make sure it is honoured.
Data held by Meta. Deleting data from our records does not delete copies WhatsApp keeps on its own systems or on your phone. WhatsApp’s own practices are described in the WhatsApp Privacy Policy.
12. Cookies
darursoft.com sets no cookies, and we do not use tracking or advertising cookies. Our visit statistics work without cookies and cannot identify you. Your light or dark mode choice is saved in your own browser’s local storage and is never sent to us.
13. Children
DarurSoft is a business service and is not directed at anyone under 18. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
14. Changes to this policy
We will post any changes on this page and update the effective date at the top. If a change materially affects how we use your data we will tell our current clients by email or WhatsApp at least 14 days before it takes effect.