Privacy Policy

1. Data Controller

Lystra is the data controller responsible for the personal data described in this policy. You can contact us about privacy matters at privacy@lystra.africa. For security-related concerns, contact security@lystra.africa.

2. Personal Data We Collect

We may collect the following categories of personal data:

• Account data: your email address and, where provided, your phone number.
• Profile data: your date of birth, profile image, display name, and biography.
• Location data: approximate or precise location you provide or that we derive from your device, where you have enabled location services.
• Content: photos, videos, comments, and other materials you upload or post.
• Usage data: information about how you interact with the Service, such as pages viewed, features used, device and browser information, and IP address.
• Payment data: limited transaction information necessary to process payments made through our processors.

3. Why We Collect Your Data

We use your personal data to:

• create and manage your account and authenticate you when you sign in;
• provide, operate, and personalise the Service, including showing you relevant content;
• store and deliver the media you upload;
• process payments for any paid features you purchase;
• communicate with you about your account, security, and service updates;
• maintain the safety and security of the Service and prevent abuse or fraud;
• comply with our legal obligations.

4. Legal Basis for Processing

Under the Act, we process your personal data on the following legal bases:

• Performance of a contract: processing necessary to provide the Service you have signed up for, such as creating your account and delivering content.
• Consent: where you have given us permission, for example for optional location features or marketing communications. You may withdraw your consent at any time.
• Legitimate interests: processing necessary for our legitimate interests such as securing the Service, preventing abuse, and improving our platform, where these do not override your rights.
• Legal obligation: processing necessary to comply with applicable law.

5. Third-Party Processors

We share personal data with trusted third-party service providers who process it on our behalf. These processors are:

• Google / Firebase: authentication, database, and hosting services.
• Cloudinary: media storage and content delivery (CDN) for the photos and videos you upload.
• Vercel: application hosting and delivery.
• Stripe and Paystack: payment processing for paid features.

Some of these providers may store or process data outside Kenya. Where personal data is transferred outside Kenya, we take steps to ensure it is afforded an adequate level of protection as required by the Act.

6. Data Retention

We retain your personal data for as long as your account is active or as long as needed to provide the Service and fulfil the purposes described in this policy. When you delete your account, we will delete or anonymise your personal data within a reasonable period, except where we are required to retain it to comply with a legal obligation, resolve disputes, or enforce our agreements.

7. Your Rights

As a data subject under the Act, you have the right to:

• be informed of how your personal data is used;
• access the personal data we hold about you;
• request correction of inaccurate or misleading personal data;
• request deletion of personal data that we no longer have a lawful reason to retain;
• object to or restrict certain processing;
• request portability of your personal data;
• withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at privacy@lystra.africa.

8. How to Lodge a Complaint

If you believe your personal data has been handled unlawfully, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya. The ODPC can be reached through its official website at www.odpc.go.ke or by email at complaints@odpc.go.ke. We encourage you to contact us first at privacy@lystra.africa so that we can try to resolve your concern.

9. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or alteration. No method of transmission or storage is completely secure, but we work to safeguard your data and to notify you and the relevant authorities where a breach affecting your rights occurs, as required by the Act. Security matters can be reported to security@lystra.africa.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes we will update the "Last updated" date above and, where appropriate, notify you. Your continued use of the Service after changes take effect constitutes acceptance of the revised policy.

11. Contact

For any questions about this policy or how we handle your personal data, contact the data controller at privacy@lystra.africa.