Privacy Policy

Welcome to Kitsiso ("we," "our," or "us"). Kitsiso is a community notification platform that provides timely alerts about utility disruptions (water, electricity, road works) and facilitates community engagement through location-based forums in Botswana.

This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our services via our website (kitsiso.co.bw), mobile applications, WhatsApp, SMS, and email.

We use your information to:

• Deliver Notifications: Send SMS, WhatsApp, and email alerts about disruptions in your selected locations
• Account Management: Authenticate users, manage subscriptions, process payments
• Service Improvement: Analyze usage patterns, measure engagement, improve features
• Community Safety: Moderate forum content, prevent abuse
• Payment Processing: Process Orange Money subscription payments
• Legal Compliance: Respond to legal requests, prevent fraud, enforce our terms

We process your personal data based on:

• Consent: When you opt-in to receive notifications
• Contract Performance: To provide services you subscribed to
• Legitimate Interests: Service improvement, fraud prevention, security
• Legal Obligations: Compliance with Botswana laws and regulations

We implement industry-standard security measures:

• Encryption: TLS/SSL for data in transit, AES-256 for data at rest
• Authentication: JWT tokens, OTP verification, rate limiting
• Access Controls: Role-based access, audit logs for admin actions
• Database Security: AWS RDS with automated backups, encryption at rest
• Password Security: Passwords hashed with bcrypt (we never store plaintext passwords)

• Active Accounts: Data retained while your account is active
• Inactive Accounts: Accounts inactive for 2 years may be automatically deleted
• Payment Records: Retained for 7 years for tax and accounting purposes
• Forum Posts: Retained indefinitely unless you request deletion
• Audit Logs: Admin actions logged for 1 year

Under Botswana's Data Protection Act and GDPR (where applicable), you have the right to:

• Access: Request a copy of your personal data
• Correction: Update inaccurate or incomplete information
• Deletion: Request deletion of your account and data ('right to be forgotten')
• Objection: Opt-out of marketing communications
• Data Portability: Receive your data in a machine-readable format
• Withdraw Consent: Unsubscribe from notifications at any time

To exercise these rights, contact us at privacy@kitsiso.co.bw

Kitsiso is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If you are a parent/guardian and believe your child has provided us with personal information, please contact us.

Your data is primarily stored in AWS Cape Town (South Africa) region. By using our service, you consent to the transfer of your information to South Africa and processing in accordance with this Privacy Policy.

We use essential cookies for:

• Authentication: Maintaining your login session
• Preferences: Remembering your location and notification settings
• Security: Preventing CSRF attacks, rate limiting

We do not use third-party advertising cookies or tracking pixels.

We may update this Privacy Policy from time to time. We will notify you of material changes via:

• Email notification (for registered users)
• In-app notification
• Prominent notice on our website

Continued use of Kitsiso after changes constitutes acceptance of the updated policy.

For privacy-related questions or concerns:

If you believe we have not addressed your privacy concerns adequately, you may lodge a complaint with: