Privacy policy

• Account details: your name, email address and/or phone number, and your Google profile name if you sign in with Google.
• Tickets and payments: the events and tiers you buy, amounts, dates and payment references. Your M-Pesa number is used to send the payment request. Card details go straight to Paystack; we never see or store your full card number.
• Watching: which events you watch, when, and a random device ID so a ticket can only play on one device at a time.
• At the venue: when your entry pass was scanned and by which usher.
• Chat: messages you post in an event's live chat, shown with your display name.
• Technical data: basic logs such as your IP address, browser and device type, used for security and fixing problems.

• To create and secure your account and sign you in.
• To sell, deliver and check tickets, take payments, issue refunds and send your e-tickets and receipts.
• To stream events to people who have access, and stop ticket sharing.
• To answer support requests and keep the chat safe.
• To give organisers numbers about their event, such as tickets sold and check-ins.
• To meet our legal, tax and accounting duties.

We rely on our contract with you (to provide tickets and streams), our legitimate interests (security, preventing fraud, improving the service), our legal obligations, and your consent where we ask for it, for example for marketing.

We only send you news about upcoming events if you've agreed to it. You can unsubscribe at any time from the link in any marketing email. Ticket emails and important service messages aren't marketing and will still be sent.

We don't sell your personal data. We share it only as needed with:

• Event organisers: the name and ticket details of people attending their event, so they can run entry and the event safely.
• Service providers who process data for us: Supabase (accounts and database hosting), Paystack (payments, including M-Pesa and cards), Mux (video streaming), Resend (email), our SMS provider (sign-in codes) and Google (if you choose Google sign-in).
• Authorities: when the law requires it.

Some of our providers store data outside Kenya, for example our database is hosted in the European Union. Where data leaves Kenya, we use providers with appropriate safeguards, as the Data Protection Act requires.

• Account details: while your account is open, and deleted within 90 days after you ask us to close it.
• Ticket and payment records: as long as tax and accounting law requires (generally up to 7 years).
• Chat messages and viewing records: up to 12 months after the event.
• Encrypted backups are kept for up to 15 days.

Under the Data Protection Act you can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct data that's wrong, or delete data we no longer need;
• stop or limit some uses of your data, or object to them;
• move your data to another service, where that applies.

Email hello@zuqa.co.ke and we'll respond within the time the law sets. You can also complain to the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke.

Your data is protected with encryption in transit, access rules that let each person see only their own tickets, staff accounts limited to the events they work on, and encrypted backups. No system is perfectly secure; if a breach affects you, we'll tell you and the ODPC as the law requires.

Zuqa is not meant for children under 18 without a parent or guardian's permission. If you believe a child has given us their data without that permission, contact us and we'll delete it.

We may update this policy. We'll change the date at the top and let you know if the change is significant.