Privacy · Tesa

Our commitment

Tesa is built for people to share, discover and earn from content they love. Protecting your personal data is central to that experience. This policy explains what we collect, how we use it, and the rights you have. It is written to comply with the Constitution of Kenya (Article 31), the Data Protection Act, 2019 and the regulations made under it, and it applies to everyone who uses Tesa.

Who is responsible for your data

Tesa is the data controller for personal data processed on this platform, within the meaning of the Data Protection Act, 2019, and is registered with the Office of the Data Protection Commissioner (ODPC) as required by sections 18 and 19 of the Act. You can contact us about anything in this policy through your account settings or the contact details published on this site.

Personal data we collect

Account and profile data — your name, username, email address, phone number, date of birth, gender, bio and profile photos you choose to add.
Content and activity — videos you upload, posts you unlock, comments, likes, bookmarks and search activity.
Payment and payout data — mobile money numbers or bank details you provide for payouts, and transaction records. Card and mobile money payments are processed by licensed payment providers; we do not store your full card details.
Technical data — IP address, device and browser information, and logs that help us keep the service reliable and secure.
Verification data — information we may request to confirm your age or identity where the law requires it.

Why we process it (lawful basis)

Section 30 of the Data Protection Act requires a lawful basis for every use of personal data. We rely on:

Contract — to run your account, host your content, process unlocks and pay creators.
Legal obligation — tax records, responding to lawful requests from Kenyan authorities, and age verification.
Legitimate interests — preventing fraud and abuse, securing the platform, and improving our features.
Consent — for anything optional, such as marketing messages. You may withdraw consent at any time and we will stop that processing.

We collect only what we need (data minimisation), we never sell your personal data, and we do not use your data for automated decisions that significantly affect you.

Who we share data with

Service providers (data processors) — video hosting and delivery, cloud infrastructure, and payment providers, bound by contracts that meet the requirements of the Data Protection Act.
Other users — your public profile and the content you choose to publish are visible to others; private profiles limit this.
Authorities — where disclosure is required by Kenyan law or a valid court order, including requests under the Computer Misuse and Cybercrimes Act, 2018.

Transfers outside Kenya

Some of our service providers store data outside Kenya. When that happens we comply with sections 48 and 49 of the Data Protection Act: we transfer personal data only where there is proof of appropriate safeguards for its security and protection, or another lawful ground for the transfer, and we remain responsible for it.

How long we keep data

In line with section 39 of the Act, we keep personal data only as long as it is needed for the purposes described here or as required by law — for example, tax law requires us to keep transaction records for a period after they are made. When you delete your account we delete or anonymise your personal data, except what we must retain to meet legal obligations or resolve disputes.

Security

We apply the technical and organisational measures required by section 41 of the Act, including encryption in transit, hashed passwords, access controls and audit logs. If a breach occurs that is likely to cause real risk of harm to you, we will notify the Data Commissioner within 72 hours and communicate with you as the Act requires (section 43).

Your rights

Under sections 26, 34, 36, 38 and 40 of the Data Protection Act you have the right to:

Be told how your data is used (this policy).
Access a copy of the personal data we hold about you.
Have inaccurate or misleading data corrected.
Have your data deleted where we no longer have a lawful reason to keep it.
Object to processing, including for direct marketing.
Receive your data in a portable, machine-readable format.
Withdraw consent at any time, without affecting past processing.

You can exercise most of these directly in your account settings, or by contacting us. We respond within the timelines set by the Act. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (odpc.go.ke).

Children

Tesa is strictly for adults aged 18 and over. We do not knowingly collect personal data from children, and section 33 of the Data Protection Act's protections for children's data are not a substitute for this rule: if we learn that an account belongs to a person under 18 we will close it and delete the data.

Changes and contact

If we change this policy we will update the date above and, for significant changes, notify you in the app or by email. Questions or requests about your personal data? Reach us through your account settings or the contact details published on this site — we're happy to help.