Privacy Policy
Plain language first. This Privacy Policy is written to be read and understood — not to confuse you. We will always tell you clearly what we collect, why we collect it, and what your rights are. If anything is unclear, email us at privacy@kiriqoo.com.
1.Who We Are
Kiriqoo is a Pan-African wellness and wealth ecosystem — a platform rooted in African wisdom, built to help people build wealth, heal the body, and free the mind. Kiriqoo Money and Travel are available now. Body and Mind are in development, and signed-in members can choose whether to receive launch notifications for those upcoming experiences.
Data Controller: RiseUp Africa Inc. (operating as Kiriqoo), Toronto, Ontario, Canada.
Data Protection Contact: privacy@kiriqoo.com
2.What Information We Collect
We only collect what we need. Depending on how you use Kiriqoo, we may collect:
| Data | Required? | Why we collect it |
|---|---|---|
| Email address | Required | To create and secure your account and send service communications |
| First name | Optional | To personalize your account experience and communications |
| Country | Optional | To support localization and understand which communities we serve |
| Age range | Optional | To ensure our services are age-appropriate |
| Primary interest | Optional | To understand which Kiriqoo experiences matter most to you |
| Module launch preferences | Optional | To notify you by email when selected upcoming modules such as Body or Mind become available |
| Product and marketing consent | Optional | To send optional updates only when you have opted in |
We also automatically collect limited technical information when you visit our website:
- IP address (anonymised)
- Browser type and device type
- Pages visited and time spent (via Google Analytics, only with your consent)
- Referring website
We do not collect: government ID, biometric data, health records, or sensitive personal data for module launch notification preferences.
3.Why We Collect It (Legal Basis)
Under GDPR and equivalent laws, we must have a valid legal reason ("legal basis") for processing your data. Our legal bases are:
| Purpose | Legal Basis |
|---|---|
| Sending optional module launch notifications | Consent — you selected the modules and email channel in your account preferences |
| Understanding our community | Legitimate interests — aggregate, anonymised data only |
| Analytics and website improvement | Consent — via the cookie banner |
| Security and fraud prevention | Legitimate interests — protecting the platform and community |
| Legal compliance | Legal obligation — complying with applicable laws |
You can withdraw your consent at any time by emailing privacy@kiriqoo.com or clicking unsubscribe in any email we send.
4.How We Use Your Information
- To operate your Kiriqoo account and provide the available Money and Travel experiences
- To send optional notifications when upcoming modules you selected, such as Body or Mind, become available
- To understand the geographic and demographic makeup of our early community
- To improve the product experience based on anonymous analytics
- To protect against spam and fraudulent submissions
We do not use your information for: targeted advertising, selling to third parties, profiling for automated decision-making, or any purpose other than those listed above.
7.How Long We Keep Your Data
| Data | Retention Period | Reason |
|---|---|---|
| Account and launch preference data | For as long as your account remains active, or until you request deletion | To operate your account and honor your selected notification choices |
| Analytics data | 14 months (Google Analytics default) | Trend analysis |
| Security logs | 90 days | Fraud and abuse prevention |
After the retention period, data is permanently deleted from our systems and those of our service providers. You can request deletion at any time — see Section 8.
8.Your Rights
You have the following rights over your personal data. These apply regardless of where you are in the world:
Request a copy of all personal data we hold about you.
Request that we permanently delete your data ("right to be forgotten").
Request that we correct any inaccurate data we hold about you.
Request your data in a machine-readable format to take to another service.
Withdraw your consent at any time. We will stop processing your data immediately.
Object to processing based on legitimate interests.
To exercise any of these rights, email privacy@kiriqoo.com with the subject line "Privacy Request." We will respond within 30 days (EU/UK: within 1 month as required by GDPR).
We will never charge a fee for handling privacy requests unless they are manifestly unfounded or excessive.
9.Jurisdiction-Specific Rights
🇨🇦 Canada — PIPEDA + Quebec Law 25
Canadian residents have the right to access and correct their personal information under PIPEDA. Quebec residents have additional rights under Law 25, including the right to data portability and the right to de-index information. You may file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca or the Commission d'accès à l'information du Québec.
🇪🇺 European Union — GDPR
EU residents have all rights listed in Section 8 under Articles 15–22 of the GDPR. You have the right to lodge a complaint with your national Data Protection Authority (DPA). A list of EU DPAs is available at edpb.europa.eu. We respond to EU requests within 30 days and will extend to 60 days only for complex requests, with notification.
🇬🇧 United Kingdom — UK GDPR
UK residents have equivalent rights under UK GDPR. You may file a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
🇺🇸 United States — CCPA (California)
California residents have the right to know what personal information is collected, the right to delete, the right to opt-out of the sale of personal information (we do not sell personal information), and the right to non-discrimination for exercising privacy rights. To exercise CCPA rights, email privacy@kiriqoo.comwith subject "CCPA Request." We will respond within 45 days.
🇳🇬 Nigeria — NDPA 2023
Nigerian residents have rights under the Nigeria Data Protection Act 2023, including rights of access, rectification, erasure, restriction, portability, and objection. You may file a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.
🇿🇦 South Africa — POPIA
South African residents have rights under the Protection of Personal Information Act (POPIA), including the right to access, correction, and deletion of personal information. Complaints may be lodged with the Information Regulator at inforegulator.org.za.
🇰🇪 Kenya — Data Protection Act 2019
Kenyan residents have rights under the Data Protection Act 2019, overseen by the Office of the Data Protection Commissioner at odpc.go.ke.
🇬🇭 Ghana — Data Protection Act 2012
Ghanaian residents have rights under the Data Protection Act 2012, overseen by the Data Protection Commission at dataprotection.org.gh.
10.How We Protect Your Data
- Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS (HTTPS).
- Encryption at rest: All data stored in Firestore is encrypted at rest using AES-256.
- Security rules: Our database enforces strict access controls so that only authorised processes can read or modify data.
- Secret management: All API keys and credentials are stored in secure server-side environment variables — never in frontend code.
- Bot protection: Cloudflare Turnstile prevents automated spam submissions.
- Access limitation: Only the minimum number of people required to operate Kiriqoo have access to personal data.
In the event of a data breach that affects your rights and freedoms, we will notify you and the relevant regulatory authority within 72 hours of becoming aware of the breach (as required by GDPR and PIPEDA).
11.Children's Privacy
Kiriqoo's services are intended for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has submitted information to us, please contact us at privacy@kiriqoo.com and we will delete the information immediately.
12.Changes to This Policy
We may update this Privacy Policy from time to time as Kiriqoo evolves. When we make material changes, we will:
- Update the "Last updated" date at the top of this page
- Notify account holders or affected users when required
- Display a prominent notice on the website for 30 days
Continued use of our services after changes take effect constitutes acceptance of the updated policy. If you do not agree with changes, you may request deletion of your data at any time.
13.Contact Us
Privacy requests and questions
Email: privacy@kiriqoo.com
Subject line:"Privacy Request" for data access/deletion, "GDPR Request" for EU/UK, "CCPA Request" for California
Response time: Within 30 days for all jurisdictions (GDPR: within 1 month)
RiseUp Africa Inc. · Toronto, Ontario, Canada · kiriqoo.com