Privacy Policy
AirFlo Sciences — Last updated: 4 November 2026
1. Who We Are
AirFlo Sciences ("we", "us", "our") provides a WhatsApp-based digital employee platform for restaurants and businesses.
Contact:
2. What Data We Collect
2.1 Data You Provide Voluntarily
- WhatsApp phone number
- Name and contact details
- Order information (food/drink, quantities, preferences, table numbers)
- Payment information (mobile money transaction IDs, payment status)
- Business information (business name, location, menu items)
2.2 Data Collected Automatically
- Conversation history (messages sent through our WhatsApp bot)
- Usage data (timestamps, message frequency, features used)
- Technical data (message IDs and basic connection information)
2.3 Data We Do NOT Collect
- Mobile money PIN numbers (processed entirely by the payment provider)
- Government-issued IDs
- Biometric data
- Precise location data
3. How We Use Your Data
| Purpose | Legal Basis | Data Used |
|---|
| Process orders and payments | Contract performance | Order details, phone number, payment receipt |
| Provide AI business assistant | Legitimate interest | Conversation history, business data |
| Generate invoices and reports | Contract performance | Order history, customer details |
| Improve our service | Legitimate interest | Anonymized usage patterns |
| Multi-tenant service delivery | Contract performance | Tenant identification |
4. Data Security and Retention
4.1 Security Measures
- Data isolation ensures each client can only access their own data
- All connections are encrypted in transit
- Access keys are stored in encrypted credentials
- Access to production data is restricted to authorized personnel
- We process data only through trusted service providers bound by confidentiality obligations
4.2 Data Retention
- Order data: 3 years from last activity (tax compliance)
- Conversation logs: 12 months, then anonymized
- Payment records: 5 years (legal requirement)
- Deleted accounts: Data purged within 30 days of closure
5. Your Rights
Under the Kenya Data Protection Act, 2019, you have the right to:
- Access – request a copy of your personal data
- Correction – ask us to correct inaccurate data
- Deletion – request deletion of your data
- Restriction – limit how we process your data
- Portability – receive data in a machine-readable format
- Objection – object to processing based on legitimate interests
- Withdraw consent – where processing is based on consent
Email: [email protected] — Response within 30 days.
6. AI Processing
Our platform uses AI to answer business questions, process orders, and generate reports. The AI does NOT retain data after processing. We do not train AI models on your data.
7. Children's Privacy
Our services are not directed at children under 13. Contact us immediately if you believe a child has provided data.
8. Data Breach Notification
In the event of a breach affecting your data, we will notify you within 72 hours and report to the Office of the Data Protection Commissioner as required.
9. Changes to This Policy
Material changes will be notified via WhatsApp at least 14 days before taking effect.
10. Governing Law
This policy is governed by the laws of the Republic of Kenya: Data Protection Act 2019, Computer Misuse and Cybercrimes Act 2018, and Consumer Protection Act 2012.
11. Complaints
If you believe we have violated your rights:
- Contact us first at [email protected]
- If unresolved: Office of the Data Protection Commissioner (ODPC), P.O. Box 54815 – 00200, Nairobi, Kenya — [email protected]