1. Who we are
Baraza (“Baraza”, “we”, “us”) is a civic-engagement platform operated by FIREBIRD COMPUTING LTD, a company registered in Kenya. We are the data controller for the personal data described here. Contact us at barazacivic@gmail.com.
2. The data we collect
- Account details: your name, username, email address and phone number, and the password you set (stored only in hashed form by our authentication provider).
- Where you vote: the county, constituency and ward you select, so we can map you to the seats and candidates that represent you.
- Candidate details (candidates and leaders only): party, the seat you are contesting, biography, the photo you provide for approval (shown publicly as your profile picture), and any IEBC certificate you choose to upload (seen only by administrators).
- Content you create: posts, comments, poll votes, messages, promises, feedback and the media you upload.
- Sign-in provider data: if you use Google to sign in, we receive your name, email address and profile picture from Google.
- Payment data: when you buy a paid feature, you pay by M-Pesa paybill or bank transfer into our company bank account. We record the amount, the transaction code you give us and what it was for. We never see or store card details. We receive a confirmation and reference; we do not receive or store your M-Pesa PIN or full card details.
- Usage & device data: basic analytics (pages viewed, performance) and essential cookies needed to keep you signed in.
3. How we use your data
- To create and run your account and show you your ward, constituency and county.
- To let you follow candidates, ask questions, vote in polls and receive updates.
- To check that candidates are who they say they are, using the photo and any certificate they provide.
- To deliver SMS campaigns that candidates send to their electorate (see section 6).
- To take payment for paid features and keep a record of it.
- To keep the platform safe — moderation, preventing spam, abuse and incitement.
- To measure and improve performance, and to comply with the law.
4. Our lawful basis
We process your data on the basis of your consent (which you may withdraw), the performance of our service to you, our legitimate interests in running a safe platform, and where necessary to comply with the law. Information about your political views is sensitive personal data, and we handle it only to provide the civic features you have chosen to use.
5. Who we share it with
We do not sell your personal data. We share it only with the service providers that make Baraza work, who process it on our instructions:
- Supabase — database, authentication and file storage.
- Vercel — website hosting and basic analytics.
- Africa’s Talking — SMS delivery.
- Google — only if you choose to sign in with it.
Some content is public by design: your username, public profile, and anything you post to the feed can be seen by other users and by signed-out visitors. We may also disclose data if required by law or to protect the rights and safety of people on the platform.
6. SMS and communications
Verified candidates can send SMS to registered voters in the area they are contesting, and to contact lists they upload. We send transactional messages (for example, account and verification notices). You can opt out of campaign SMS by replying to a message or contacting us, and unsubscribe from non-essential emails at any time.
7. Cookies
We use strictly necessary cookies to keep you signed in and secure, and lightweight analytics to understand performance. We do not use advertising cookies.
8. How long we keep it
We keep your data for as long as your account is active, and for a reasonable period afterwards to meet legal, accounting and dispute-resolution needs. You can ask us to delete your account and personal data at any time (see section 9).
9. Your rights
Under the Kenya Data Protection Act, 2019, you have the right to:
- access the personal data we hold about you;
- ask us to correct data that is inaccurate or incomplete;
- ask us to delete your data, or restrict how we use it;
- object to processing, and withdraw consent you previously gave;
- data portability where it applies.
To exercise any of these, email barazacivic@gmail.com. If you are not satisfied, you may lodge a complaint with the Office of the Data Protection Commissioner at odpc.go.ke.
10. Security
We protect your data with encryption in transit, access controls and row-level database security. No system is perfectly secure, but we work to keep your information safe and will notify you and the relevant authority of a breach where the law requires.
11. Children
Baraza is intended for people who are eligible to register as voters in Kenya. It is not directed at children under 18, and we do not knowingly collect their data.
12. International transfers
Some of our service providers process data on servers outside Kenya. Where that happens, we rely on providers that apply appropriate safeguards for your data.
13. Changes
We may update this policy from time to time. We will post the new version here and update the date above; significant changes will be highlighted on the platform.
14. Contact
FIREBIRD COMPUTING LTD · barazacivic@gmail.com.