1. Introduction & Who We Are
Nairobi Feast (the “Platform”) is a restaurant discovery, exploration, and reservation service for the Nairobi dining community, operated by Naifeast Digital, a company registered in Kenya. We are the Data Controller for personal data processed in connection with your use of the Platform.
This Privacy Policy applies to all users of nairobifeast.com, including visitors, registered users, and restaurant partners. It covers data collected through the website, AI features, community features, the reservation system, and any associated communication channels (email, SMS, WhatsApp).
2. Lawful Basis for Processing
Under the Data Protection Act, 2019 (Kenya), we process your personal data on the following lawful bases:
- Performance of a contract: To provide the services you have requested (e.g., creating your account, processing a reservation).
- Consent: Where you have voluntarily provided information or opted in to communications (e.g., our newsletter, marketing emails).
- Legitimate interests: To operate and improve the Platform, personalise your experience, ensure security, and prevent fraud — where these interests are not overridden by your rights.
- Legal obligation: To comply with applicable Kenyan laws, including tax, accounting, and anti-fraud requirements.
3. Information We Collect
A. Information You Provide Directly
- Account registration: Name, email address, phone number, and password (hashed).
- Profile: Optional profile photo and dining preferences.
- Reservations: Name, contact details, party size, date, time, special requests, and dietary requirements.
- Community posts: Photos, captions, and restaurant tags you submit to the community feed.
- Newsletter sign-up: Email address when you subscribe to updates.
- Contact forms: Name, email, and message content when you contact us.
- Partnerships enquiries: Business name and contact details for restaurant partners.
B. Information Collected Automatically
- Usage data: Pages visited, features used, search queries, filter selections, and time on page.
- Device & technical data: IP address, browser type and version, device type, operating system, and referring URL.
- Cookies & local storage: Session tokens, preference data, and analytics identifiers. See Section 10 for details.
C. AI Feature Data
- Conversational inputs: Text messages you send to the AI dining assistant (Nairobi Feast AI) to generate recommendations.
- Vibe / preference data: Selections made in the Vibe Picker and Curate Experience features.
- AI conversations are processed via third-party AI providers (see Section 5). We do not permanently store the full transcript of AI conversations beyond what is required to provide the current session.
D. Information from Third Parties
- Google Sign-In: If you choose to sign up or log in via Google, we receive your name, email address, and profile picture from Google, subject to Google's Privacy Policy.
- DineBook: Reservation data when you make a booking through a partner restaurant's DineBook link.
4. How We Use Your Information
- To provide, operate, maintain, and improve the Platform and its features.
- To create and manage your user account and personalise your experience.
- To process and manage restaurant reservations made through the Platform.
- To power AI-driven dining recommendations, the Vibe Picker, and curated results.
- To send you reservation confirmations and transactional notifications (email, SMS, or WhatsApp).
- To send our newsletter and promotional updates, where you have opted in (you may unsubscribe at any time).
- To respond to enquiries, feedback, and support requests.
- To detect, investigate, and prevent fraud, abuse, or violations of our Terms.
- To analyse usage patterns and improve the Platform's performance and content.
- To comply with applicable legal obligations, including tax laws and regulatory requirements.
5. Data Sharing & Third Parties
We do not sell your personal information. We share data only in the limited circumstances below:
- Service providers (sub-processors):
- Supabase — database hosting, media storage, and authentication
- Anthropic (Claude) — AI assistant processing for dining recommendations
- DineBook — reservation management for partner restaurants
- Email & SMS providers — transactional notifications and newsletter delivery
- Vercel — website hosting and infrastructure
- Google — maps integration, Sign-In with Google, and analytics
- Restaurant partners: When you make a reservation, we share your booking details (name, contact, party size, date/time, special requests) with the relevant restaurant to fulfil the reservation.
- Legal requirements: We may disclose your data when required to do so by law, court order, or governmental authority, or when necessary to protect the rights, property, or safety of Naifeast Digital, our users, or the public.
- Business transfers: In connection with a merger, acquisition, or sale of all or substantially all of our assets, your data may be transferred as part of that transaction. We will notify you before this occurs.
All our service providers are contractually required to process your data only on our instructions and to maintain appropriate security measures.
6. International Data Transfers
Some of our service providers (including Supabase, Anthropic, and Vercel) are based outside Kenya and process data in other countries (including the United States and the European Union). Where we transfer personal data internationally, we take steps to ensure that appropriate safeguards are in place in accordance with Section 48 of the Data Protection Act, 2019, including using Standard Contractual Clauses or equivalent mechanisms approved by the Office of the Data Protection Commissioner (ODPC).
7. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected:
- Account data: Retained for as long as your account is active. On deletion, data is removed within 30 days, except where legal hold applies.
- Reservation data: Retained for up to 2 years for operational purposes, unless you request earlier deletion.
- Transaction & financial records: Retained for 7 years as required by Kenyan tax and financial law.
- Community posts: Retained until you delete them or your account is deleted.
- AI conversation data: Not permanently stored beyond the active session. Only reservation details extracted from the conversation are retained.
- Newsletter subscriptions: Retained until you unsubscribe or request deletion.
- Usage/analytics data: Aggregated and anonymised where possible; retained for up to 24 months.
8. Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These measures include:
- Encryption of data in transit (TLS/HTTPS) and at rest.
- Hashed password storage — we never store plain-text passwords.
- Role-based access controls limiting who can access personal data internally.
- Regular security reviews and monitoring for suspicious activity.
No system is 100% secure. If you believe your account has been compromised, contact us immediately at [email protected]. In the event of a data breach affecting your rights and freedoms, we will notify you and the ODPC as required by law.
9. Your Rights
Under the Data Protection Act, 2019 (Kenya), you have the following rights regarding your personal data:
- Right of access: Request a copy of the personal data we hold about you.
- Right to rectification: Request correction of inaccurate or incomplete data.
- Right to erasure: Request deletion of your personal data (“right to be forgotten”), subject to legal retention requirements.
- Right to object: Object to the processing of your data for legitimate interests or direct marketing.
- Right to data portability: Receive your data in a structured, commonly used, machine-readable format.
- Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
- Right to lodge a complaint: You have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke.
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. We may need to verify your identity before processing your request.
10. Cookies & Analytics
Nairobi Feast uses cookies and similar technologies (local storage, session storage) for the following purposes:
- Strictly necessary cookies: Required for the Platform to function correctly, including authentication tokens and session management. These cannot be disabled.
- Preference cookies: Remember your settings, such as saved filters, favourite restaurants, and display preferences.
- Analytics cookies: Used to understand how visitors use the Platform (pages visited, features used, time on site) to help us improve the experience. We use privacy-respecting analytics tools.
You can control cookies through your browser settings. Disabling certain cookies may affect the Platform's functionality. We do not use advertising or tracking cookies for cross-site behavioural advertising.
11. Children's Privacy
Nairobi Feast is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe we have inadvertently collected data from a child under 13, please contact us at [email protected] and we will take prompt steps to delete it.
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify you by email or prominent in-platform notice.
We encourage you to review this page periodically. Your continued use of the Platform after the effective date of changes constitutes your acceptance of the updated Policy.
