Privacy Policy
PharmaVault · effective [DATE OF LAUNCH]
This explains what PharmaVault collects, why, and what you can do about it. PharmaVault is the data controller, and Kenya's Data Protection Act 2019 applies.
What we collect
- Your name and email address — given when you sign up, used to identify your account and contact you about it.
- Your password — stored only as a secure hash by our authentication provider. We cannot read it.
- Your M-Pesa phone number — collected when you pay, so a payment can be matched to your account if something goes wrong.
- Payment records — the amount, plan, academic year, date, outcome and the payment provider's reference. We never receive or store your M-Pesa PIN, and we do not store card details.
- Your subscriptions — which academic years you have access to and until when.
We do not run advertising trackers, and we do not sell or rent your data to anyone.
Why we hold it
- To give you an account and the access you paid for — this is us performing our contract with you.
- To take and confirm payments, and to resolve payment problems.
- To keep records of transactions, which we are required to do.
- To detect and prevent abuse of the service.
Who else handles it
We use a small number of providers, and only for the purposes below:
- Supabase — stores your account, subscriptions and the content library.
- IntaSend — processes M-Pesa payments. Your phone number and the amount are shared with them to take payment.
- Vercel — hosts the site and serves pages to you.
- Sentry — receives technical error reports so we can fix faults. These can include your account identifier, so we can tell whether an error affected a real student.
Some of these providers operate outside Kenya, which means your data may be processed abroad.
How long we keep it
- Account details: while your account exists.
- Payment and transaction records: kept after an account closes, because financial records have to be retained.
- Technical error reports: a limited period, then discarded.
Your rights
Under the Data Protection Act 2019 you can ask us to:
- show you what we hold about you
- correct anything that is wrong
- delete your account and personal details
- stop using your data for a particular purpose
- give you your data in a portable form
Email pharmavault.contact@gmail.com and we will act on it. Note that we may need to keep transaction records even after deleting your account, as above. You also have the right to complain to the Office of the Data Protection Commissioner.
Cookies
We set cookies only to keep you signed in. There are no advertising or analytics cookies, so there is nothing here to opt out of.
Contact
PharmaVault — pharmavault.contact@gmail.com