Privacy

Niadirect Conversions runs this platform and decides what personal information is collected on it, which makes it the data controller under the Data Protection Act, 2019. Last updated 29 August 2026.

Registration with the Office of the Data Protection Commissioner

Niadirect Conversions is registering as a data controller with the Office of the Data Protection Commissioner. That registration is not yet issued, so there is no certificate number to show you. The number is published on this page and on the home page on the day it issues. This is stated plainly rather than left out, because a gap in a privacy notice reads as an answer.

This page is published in English. If you would rather have it explained in Kiswahili, ask through the request path at the end of this page and we will do that.

What is collected

This list is closed. Nothing outside it is collected without this page changing first.

If you post for businesses

Your name and national identity number.
A photograph of yourself, which one reviewer looks at to check the identity document is yours.
Your M-Pesa number, which is where your earnings are sent.
Your county and, if you give it, your town.

If you are a business

Your business name, your phone number and your WhatsApp Business number.
Your Till or Paybill number.
If you register as a company: your certificate of registration, KRA PIN and a director identity number.

When somebody taps a link

The time of the tap and which campaign and which promoter it belongs to.
A one way fingerprint of the device, which cannot be turned back into a phone, a person or a number. It exists to notice the same device tapping the same link twice.
The first three parts of the network address only. The last part is cut off before anything is written down, so the address is never stored in a form that identifies one connection.
The network operator and the country and region the network reports.

Why this is allowed

To do what you asked for: Your name, number and campaign details are needed to run your account, pay you, and put a customer in touch with a business. Without them there is no service to give you.
Because the law requires it: Identity details and payment records are kept because money is moving and because the rules that govern payments in Kenya require a business to know who it is paying.
Because the platform has a real interest in it: The tap records exist to stop fraud. An advertiser is paying for each tap, and without these checks they would be paying for taps that never came from a person. The interest is weighed against your privacy by collecting the least that will do the job: a fingerprint that cannot be reversed, and an address with its identifying part removed.

What is never done

Your WhatsApp messages are never read, stored or analysed. The platform cannot see them.
Status view counts are never read or guessed at.
Your WhatsApp session is never borrowed, bridged or automated.
No advertising tracker, pixel or analytics script runs on this site. There are none to switch off.
Your information is not sold, and it is not shared for anyone else to market to you.

Who else sees it

Only the services this platform runs on, and only for the part each one does: Supabase holds the database and the account records, Cloudflare serves the links and the pages, Safaricom moves the money through M-Pesa, and Infobip carries the login codes and notices. Each is given what its own job needs and nothing else.

How long it is kept

Tap records: Twenty four months from the tap.
Account details: For as long as you have an account, and thirty six months after it closes.
Payment records: Seven years, which is the period Kenyan tax and financial record keeping requires.

Deletion at the end of these periods is done by a scheduled job, not by somebody remembering.

Your rights, and what they cost you

Nothing. The Data Protection Act, 2019 gives you the right to be told what is held about you, to get a copy of it, to have it corrected, to have it deleted, and to object to how it is used.

The Act's regulations set different deadlines for different requests: seven days to answer a request to see your information, and fourteen days for a correction, a deletion or an objection. This platform answers all of them within seven days, which is the strictest of the four, so you never have to work out which deadline applies to you.

Make a request from the account screen once you have signed in. It opens a ticket with the deadline attached and a person works through it. You can see your own request and its deadline on the same screen while it is open.

If you are not satisfied with how a request is handled, you may complain to the Office of the Data Protection Commissioner directly.

Contacting us about your information

The data protection contact at Niadirect Conversions is reached through the request path described above, which is monitored against the same seven day deadline. A published postal and email contact is added to this page when the registration described at the top of it issues, because that registration is what fixes the published contact details.

Changes to this page

If what is collected changes, this page changes first and carries the date it changed. There is no version of this platform that collects something this page does not mention.