01Who we are
Fremfolio is a service of Wakali Labs, based in Nairobi, Kenya (“we”, “us”). We are the data controller for the personal data described in this policy, except where we act for a creator as explained in section 4.
Contact us about privacy at privacy@fremfolio.com.
02Data we collect
When you create an account
- Your name, email address and a securely hashed password.
- If you sign in with Google: your name, email address and profile photo from Google. We only ask Google for your email and basic profile.
When you use your workspace
- Your studio name, web address, bio, services and contact details.
- The photos, videos and other files you upload, and their technical metadata.
- Galleries, share links, bookings, job posts, applications and messages you create.
When you pay or get paid
- Subscription payments are processed by Paystack. We never see or store your card number. We keep the transaction reference, amount, currency, date and status.
- If you connect your own Paystack or M-Pesa account to receive client payments, we store your API keys encrypted, and we keep payment records such as the M-Pesa receipt number, amount and phone number.
Your clients and visitors
- When a client books a session: their name, email, phone number and any notes.
- When a client opens a share link: when it was opened and which files were downloaded.
- When a visitor sends an enquiry or a support request: the details they enter.
Automatically
- Basic technical data such as IP address, browser type and pages requested, kept in server logs to run and secure the service.
03How we use it, and why we're allowed to
We use personal data only to run Fremfolio, and on the lawful bases in the Data Protection Act, 2019:
- To provide the service you signed up for (performance of a contract): hosting your portfolio, delivering files to your clients, bookings, payments, jobs and support.
- To keep Fremfolio safe (legitimate interests): preventing fraud, spam and abuse, and fixing errors.
- To meet legal duties (legal obligation): for example keeping payment records for tax.
- To send you service emails such as verification, password resets, receipts and booking confirmations. We don't send marketing emails without your consent, and you can opt out at any time.
We do not sell personal data, and we do not use it for advertising.
04Photos of people, and your clients' data
When you upload photos or videos of other people, or collect your clients' details through bookings and share links, you decide why that data is processed. For that data you are the data controller and we process it on your behalf, only to provide Fremfolio to you.
You are responsible for having the right to use those images and that data, including consent from the people shown where the law requires it. Images of children need the consent of a parent or guardian.
06Data outside Kenya
Some providers, such as Paystack and Google, may process data outside Kenya. When that happens we rely on the safeguards required by the Data Protection Act, 2019, such as the provider's contractual commitments to protect it.
07How long we keep data
- Your account and workspace data: for as long as your account is open.
- If a paid plan lapses, your workspace becomes read-only for 30 days, and your files stay viewable and downloadable. After that we will warn you by email, for at least another 30 days, before anything is deleted.
- When you delete your account, we delete your data, except what we must keep by law.
- Payment records: for as long as Kenyan tax and accounting law requires.
- Backups: for a limited period, after which they are overwritten.
08How we protect it
- Everything is sent over HTTPS.
- Passwords are hashed, and payment API keys are encrypted and never shown again after you save them.
- Private files can only be opened through a permission check and a short-lived signed link.
- Access to personal data within our team is limited to people who need it.
09Your rights
Under the Data Protection Act, 2019 you have the right to:
- be told how your data is used (this policy);
- access the personal data we hold about you;
- have inaccurate data corrected, and have data deleted;
- object to processing, and withdraw consent where we rely on it;
- receive your data in a portable format.
Email privacy@fremfolio.com from the address on your account. If you're not satisfied with our answer, you can complain to the Office of the Data Protection Commissioner.
11Children
You must be 18 or older to create a Fremfolio account.
12Changes to this policy
If we make important changes, we'll tell you by email or in your dashboard before they take effect. The date at the top shows when this policy last changed.