Privacy policy

StreamVibeis the data controller for personal data processed through streamvibe.co.ke. This policy is written with reference to Kenya's Data Protection Act, 2019.

Reach us about anything here at privacy@streamvibe.co.ke.

Because you gave it to us. Your email address and name from sign-up. For creators, a public handle, display name, bio, avatar and category. For payouts, the mobile wallet number or bank account details you register. We do not collect payment details at checkout at all — those go straight to our payment provider on their own page.

Because using the product creates it. Your orders and tickets, the amounts and references attached to them, which events you watched and roughly for how long, and the messages you send in live chat.

Because the internet works this way. Standard server logs from our hosting and backend providers, including IP addresses and request timings, used for security and debugging.

What we never hold.Your card number, your card's security code, and any PIN. Those go directly to our payment processor, named in section 4; we receive only a reference, the last four digits where the card network provides them, and whether the payment succeeded.

• To perform our contract with you — issuing your ticket, letting you into the stream, paying creators, and emailing receipts, access links, time changes and cancellations. These emails are transactional and cannot be switched off, because you need them to use something you paid for.
• With your consent — reminders, going-live alerts, post-event follow-ups and creator milestone emails. Every one of these carries an unsubscribe link, and you can change any of it under Settings → Notifications.
• For our legitimate interests — preventing fraud and chargeback abuse, rate-limiting abusive traffic, and understanding which parts of the product work.
• To comply with the law — keeping financial records of transactions for the period Kenyan tax and accounting rules require.

A creator whose event you bought a ticket to can see your name, your email address, the amount you paid, the payment method, and whether you watched. That is what lets them run their event and answer your questions; they are not permitted to use it to market to you elsewhere.

Your display name and your chat messages are visible to everyone else in that event's chat. Your email address and phone number never are.

We use these processors, and no others handle your personal data:

• Clerk — accounts and sign-in.
• Convex — the application database and backend.
• Paystack — payments and payouts. They are the controller for any payment details you enter on their checkout page.
• Cloudflare Stream — video ingest and delivery.
• Resend — sending email.
• Vercel — hosting the web application.

Several of these operate outside Kenya, so your data is transferred abroad. We rely on each provider's contractual data protection commitments for those transfers. We do not sell personal data, and we do not share it with advertisers.

• Account and profile data: until you delete your account.
• Orders, tickets, wallet balances and ledger entries: seven years, because they are financial records we are required to be able to produce.
• Chat messages: kept with the event they belong to, so a host can review what was said.
• Server logs: retained on our providers’ standard schedules, typically a few weeks.

Deleting your account removes your profile and stops all email. It does not erase the financial record of a payment that happened — we anonymise what we can and keep only what the law requires us to keep.

Under the Data Protection Act you can ask us to:

• Tell you what we hold about you, and give you a copy.
• Correct anything that is wrong — most of it you can edit yourself in Settings.
• Delete your account and the data attached to it, within the limits above.
• Stop sending you optional email — one click, from the link in any of them.
• Object to or restrict a particular use of your data.

Email privacy@streamvibe.co.ke and we will respond within 30 days. If you are not satisfied, you can complain to the Office of the Data Protection Commissioner.

Access tokens for streams are 256-bit random values, are never placed in a URL, and are never written to a log. Playback is gated by short-lived signed tokens minted only for people holding a valid ticket. Stream keys are returned only to the creator who owns the event. Payment webhooks are verified by signature before anything is credited, and every amount is re-checked against the order we recorded before the charge.

No system is perfect. If a breach affects you, we will tell you and the Data Protection Commissioner as the Act requires.

We use cookies to keep you signed in and to remember your light or dark theme preference. We do not use advertising or cross-site tracking cookies.

We will update this page when what we do changes, and the date at the top always reflects the current version. For a material change we will email you before it takes effect. See also our terms of service and refund policy.