Privacy Policy

1. Who is responsible for your data

Tetopan is the data controller for the personal data described here. You can reach our privacy team at fullbookerkenya@gmail.com. We respond to privacy requests within 30 days.

2. Data we collect

• Account data. Your name, email address and profile picture, received from Google when you choose “Continue with Google”, or the email address you register with.
• Conversations and uploads. The prompts you send, the answers returned, and any files, images or audio you attach.
• Usage and billing records. Credits bought and spent, which model handled a request, response times, payment references from M-Pesa or Paystack, and your subscription status.
• Technical data. IP-derived country (used only to show the right currency), browser type, device type and error logs.
• Connected apps. If you explicitly connect a service such as Google Drive, Gmail, GitHub or Notion, we store an encrypted access token so Tetopan can act on your instruction. Connecting is always optional.

We never ask for and never store your card number or M-Pesa PIN. Payments are handled entirely by our licensed payment processors.

3. Google user data and Limited Use

When you sign in with Google we request only your basic profile (name, profile picture) and email address, so we can create and secure your Tetopan account. If you separately authorise a Google service such as Drive, Gmail or Sheets, we request only the scopes needed for the feature you asked for.

Tetopan’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not sell Google user data, we do not use it for advertising, we do not allow humans to read it except with your explicit consent, for security investigations, or where required by law, and we do not transfer it except to provide or improve the feature you requested. You can revoke access at any time from your Tetopan connections page or from your Google Account permissions page.

4. Why we use your data

• To provide the service: run your prompts, store your chats, show your history.
• To operate the credit wallet, process payments and prevent fraud or abuse.
• To keep the platform secure, debug faults and monitor reliability.
• To send essential service emails such as welcome, receipt and security notices.
• To meet legal, tax and accounting obligations.

Our legal bases under the GDPR are: performance of a contract (providing the service), legitimate interests (security, abuse prevention, service improvement), consent (optional connected apps and marketing) and legal obligation (tax and records).

5. AI model providers

To answer your prompt, the text, images or audio you send are passed to the AI provider that serves the model you chose. Those providers process the content only to return an answer. We do not sell your conversations, and we do not use your conversations to train our own models. Where a provider offers it, we request that your content is not retained for provider training.

6. Sharing

We share personal data only with processors who help us run Tetopan: cloud hosting and database providers, AI model providers, payment processors (Safaricom M-Pesa, Paystack), email and SMS delivery providers, and analytics. Each is bound by contract to protect your data. We may also disclose data where required by law or to protect the rights and safety of users. We never sell personal data.

7. International transfers

Tetopan serves users worldwide, so your data may be processed outside your country, including in the United States and the European Union. Where required, transfers rely on Standard Contractual Clauses or an equivalent lawful transfer mechanism.

8. How long we keep data

Chats, projects and uploads are kept until you delete them or close your account. Payment and credit records are kept for seven years to meet accounting and tax rules. Security and error logs are kept for up to 12 months. When you delete your account we remove your personal data within 30 days, apart from records we must keep by law.

9. Security

Data is encrypted in transit and at rest. Every record is locked to its owner by row-level security, so no user can read another user’s chats, wallet or payments. Connected-app tokens are encrypted before storage. Access by our team is limited, logged and used only for support and security.

10. Your rights

Depending on where you live you may have the right to access, correct, delete, restrict or object to processing, to receive a portable copy of your data, and to withdraw consent at any time. Residents of the European Economic Area and the United Kingdom have these rights under the GDPR and UK GDPR; residents of Kenya under the Data Protection Act, 2019; residents of California under the CCPA and CPRA, including the right not to be discriminated against for exercising them. Tetopan does not sell or share personal information for cross-context behavioural advertising.

To exercise any right, email fullbookerkenya@gmail.com. You may also delete individual chats or your whole account from your profile page, and you can lodge a complaint with your local data protection authority, including the Office of the Data Protection Commissioner in Kenya.

11. Cookies

We use strictly necessary cookies and local storage to keep you signed in, remember your theme and count free guest messages. Analytics cookies help us understand which pages are used. We do not use advertising cookies.

12. Children

Tetopan is not intended for children under 13 (or under 16 in the EEA without parental consent). If we learn that we hold data from a child below that age, we delete it.

13. Changes

If we make a material change we will update the date above and notify you by email or in the app before it takes effect.