Legal

Privacy Policy

Last updated: 28 September 2026

1. Who we are

Jibu provides an AI receptionist that answers customer messages on WhatsApp for businesses in Kenya. In this policy, "Jibu", "we" and "us" mean the operator of jibu.co.ke and the Jibu service.

[Legal review needed] Legal entity name, registration number, physical address, and Jibu's registration status with the Office of the Data Protection Commissioner (ODPC) are to be confirmed and added here.

Contact for privacy questions: hello@jibu.co.ke or WhatsApp +254 182 485163.

2. Whose data this policy covers

• Visitors to jibu.co.ke.
• People who contact Jibu itself, for example business owners asking about the service on WhatsApp or by email.
• Customers of businesses that use Jibu. When you message a business that uses Jibu, Jibu processes your messages on that business's behalf. That business decides how your information is used, and its own privacy notice also applies. [Legal review needed] Confirm Jibu's role (data processor for client businesses; data controller for its own website and enquiries) and the data processing terms agreed with each client business.

3. What we collect

When you message a business through Jibu, or message Jibu

• Your WhatsApp phone number and the name on your WhatsApp profile, as provided by WhatsApp.
• The content of messages you send and the replies you receive, with dates and times.
• Details you choose to share in the conversation, such as your name, what you are asking for, a location, or a preferred date and time. Jibu may save these as an enquiry (lead) or a booking request.
• If a conversation is handed to a person at the business, a short note of the reason.

From businesses that use Jibu

• Business details used to answer customers (services, prices, opening hours, policies, FAQs) and the owner's or staff member's WhatsApp number for alerts.

When you visit jibu.co.ke

• The website has no sign-up forms, no advertising trackers and no analytics.
• It remembers whether you chose the light or dark theme, stored only in your own browser.
• Images are loaded from Unsplash, fonts from Google Fonts and icons from cdnjs (Cloudflare). Like any website request, these services receive your IP address and browser details when the page loads.
• Our hosting provider may keep standard server logs. [Legal review needed] Hosting provider to be named once confirmed.

4. How we use it

• To read and reply to messages automatically on the business's behalf, using the business's own information.
• To record enquiries and booking requests so the business can follow up.
• To alert the business's staff when a person needs to step in, with the conversation attached.
• To send booking reminders and weekly summaries to businesses.
• To operate, secure and fix the service.

[Legal review needed] The lawful basis for each purpose under the Data Protection Act, 2019 (for example contract, consent or legitimate interest) is to be confirmed.

5. Automated replies

Replies on WhatsApp are written by an AI system (Claude, provided by Anthropic) based on the business's information. Jibu is instructed not to make up prices, availability or promises, and to pass the conversation to a person when it cannot answer. AI replies can still contain mistakes. You can ask to speak to a person at any time.

6. Who we share it with

We do not sell personal data. We share it only with the business you are messaging and with the service providers that run Jibu:

• Meta Platforms (WhatsApp Business Platform): delivers messages between you and the business.
• Supabase: stores conversation records, enquiries and bookings, and runs Jibu's server code. Data is stored in Supabase's EU (Ireland) region.
• Anthropic: processes conversation content to write replies.
• Render: previously hosted part of Jibu's server code and is being phased out.

We may also disclose information where Kenyan law requires it.

7. Transfers outside Kenya

The providers above process data outside Kenya, including in the European Union and the United States.

[Legal review needed] The safeguards relied on for these transfers under Part VI of the Data Protection Act, 2019 are to be confirmed.

8. How long we keep it

Conversation records, enquiries and bookings are kept while the business uses Jibu, so its staff can see past conversations and follow up. Technical logs are deleted automatically after a short period (currently 14 days or less).

[Legal review needed] A fixed retention period for conversation records, and what happens to data when a business stops using Jibu, are to be set.

9. How we protect it

Data is sent over encrypted connections. The database can only be read by Jibu's own server code, not by the public website. Messages arriving from WhatsApp are checked against Meta's signature before they are processed. No system is completely secure, but we work to protect the data we hold.

10. Your rights

Under Kenya's Data Protection Act, 2019 you have the right to:

• be told how your personal data is used;
• access your personal data;
• object to the processing of all or part of it;
• have false or misleading data corrected;
• have false or misleading data deleted.

To make a request, contact hello@jibu.co.ke. If you messaged a business that uses Jibu, you can also contact that business directly. If you are not satisfied with our response, you can complain to the Office of the Data Protection Commissioner (ODPC).

[Legal review needed] Response times and identity checks for requests are to be confirmed.

11. Children

Jibu is a service for businesses. We do not knowingly collect data from children through jibu.co.ke.

[Legal review needed] How children's data is handled when a child messages a client business (for example a salon or school) is to be confirmed.

12. Changes to this policy

We will update this page when our practices change and show the new date at the top.