Privacy Policy

Fosia Ltd (RDB TIN: 122245701), Kigali, Rwanda, is the data controller for all personal data processed through the SHEREHE platform and Keza AI system.

This Privacy Policy applies to sherehe.io and all SHEREHE services including Keza AI on WhatsApp and Telegram. It complies with:

• Rwanda Law No. 058/2021 on the Protection of Personal Data and Privacy
• EU General Data Protection Regulation (GDPR), for EU/EEA users
• Nigeria Data Protection Regulation (NDPR 2019), for Nigerian users
• Kenya Data Protection Act 2019, for Kenyan users
• Senegal Law No. 2008-12, for Senegalese users
• Cameroon Law No. 2010/012 on Electronic Communications, for Cameroonian users
• OHADA Uniform Act on Commercial Law, for users in OHADA member states (Côte d'Ivoire, Cameroun, Bénin, Burkina Faso, RDC, Congo, Gabon, Mali, Niger, Sénégal, Tchad, Togo, etc.)
• South Africa Protection of Personal Information Act (POPIA 2020), for South African users
• Ghana Data Protection Act 2012, for Ghanaian users

Account data: full name, email address, phone number, profile photo, professional type.

Event data: event type, dates, location, guest lists, RSVPs, budgets, ceremony details, vendor bookings.

Payment data: Mobile Money transaction references, amounts, status (we never store your Mobile Money PIN).

Keza AI conversations: messages you exchange with Keza via dashboard, WhatsApp, or Telegram, stored to maintain context and improve accuracy.

Technical data: IP address, device type, browser, session data, usage patterns.

Learning insights: anonymized behavioral patterns extracted from interactions to improve Keza's recommendations (stored locally on SHEREHE servers).

• Contract performance: processing necessary to deliver the event planning services you subscribed to
• Legitimate interest: improving Keza AI, fraud detection, platform security
• Consent: marketing communications, WhatsApp messaging (you can withdraw at any time)
• Legal obligation: financial records retention (7 years), compliance with Rwandan law

• Provide and maintain SHEREHE event planning services
• Power Keza AI to deliver personalized event planning assistance
• Process Mobile Money contributions and subscriptions
• Send event invitations, RSVP notifications, and reminders
• Connect you with relevant verified vendors
• Detect and prevent fraud, abuse, and unauthorized access
• Improve service quality and Keza AI accuracy
• Comply with legal obligations in applicable jurisdictions

Keza AI generates responses using advanced AI models. When you send a message to Keza AI, that message and relevant conversation context are processed by our AI infrastructure under strict data processing agreements.

• Your messages are not used to train external AI models
• Keza AI's learned insights about your preferences are stored securely on SHEREHE's own servers
• All AI processing is governed by appropriate data protection safeguards

We never sell your personal data. We share data only as necessary to operate our services:

• Payment partners: transaction data only, to process Mobile Money contributions
• AI infrastructure providers: message content to generate Keza AI responses, under DPA
• Messaging platforms: to deliver invitations and notifications via WhatsApp and Telegram
• Media storage: event photos and vendor assets
• Vendors you book: booking details, name, contact info shared only upon confirmed booking
• Event guests: your event details visible to guests you invite
• Legal authorities: when required by Rwandan law, court order, or to protect rights

All third-party providers are bound by data processing agreements. For the list of sub-processors, contact [email protected].

Your data is primarily stored on secure servers in Europe. Some service operations involve processing in other jurisdictions. In all cases, we ensure appropriate safeguards are in place, including Standard Contractual Clauses or equivalent mechanisms where required.

For EU/EEA users: all transfers outside the EEA are subject to appropriate safeguards per GDPR Article 46. You can request details of applicable transfer mechanisms at [email protected].

• Account data: retained while your account is active + 30 days after deletion request
• Event data: retained for 2 years after event date, then archived or deleted
• Financial records: retained for 7 years per Rwandan financial regulations
• Keza AI conversations: retained for 12 months then automatically deleted
• Technical logs: retained for 90 days
• Deleted accounts: personal data purged within 30 days of deletion request (except financial records required by law)

Under applicable data protection laws, you have the right to:

• Access: request a copy of all personal data we hold about you
• Rectification: correct inaccurate or incomplete data
• Erasure ("right to be forgotten"): request deletion of your data
• Portability: receive your data in a machine-readable format
• Restriction: limit how we process your data in certain circumstances
• Objection: object to processing based on legitimate interest
• Withdraw consent: for WhatsApp/Telegram messaging at any time (send "STOP")

To exercise any right, email [email protected]. We will respond within 30 days. EU users may also lodge a complaint with their local supervisory authority.

• All data transmitted via HTTPS/TLS encryption
• Passwords are hashed and never stored in plain text
• Secure session management, invalidated on password change
• Rate limiting and message validation on all API endpoints
• Strict role-based access controls for internal admin functions
• Keza AI output reviewed to prevent leakage of sensitive data
• Regular security reviews and dependency updates

SHEREHE uses essential cookies for authentication and session management, and optional analytics cookies to improve the platform. For full details, see our Cookie Policy. You can manage cookie preferences at any time.

SHEREHE is not directed to individuals under 18 years of age. We do not knowingly collect personal data from minors. If we become aware that a minor has provided us with personal data, we will delete it promptly. Contact us at [email protected] if you believe a minor has created an account.

We may update this Privacy Policy periodically. We will notify you of significant changes via email and platform notification at least 15 days before they take effect. The "Last updated" date at the top reflects the most recent revision.

• Data Protection inquiries: [email protected]
• Support: [email protected]
• Company: Fosia Ltd, Kigali, Rwanda, RDB TIN: 122245701
• EU Representative: To be appointed (if required by GDPR Article 27)