Privacy Policy

Virdap ("we," "us," "our," or "the Platform"), operated by Virdap Smart Solutions (Nairobi, Kenya), provides digital publishing, secure reading, and pan-African author monetization services through virdap.co.ke, related APIs, and the Virdap mobile application across all 54 African Union member nations and globally.

This Privacy Policy explains how we collect, process, store, and safeguard your personal information in compliance with the Kenya Data Protection Act (2019), the Nigeria Data Protection Act (NDPA 2023), the South Africa Protection of Personal Information Act (POPIA 2013), the African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention), and international standards including the General Data Protection Regulation (GDPR).

---

1. Scope and Legal Basis for Processing

We process personal data based on legitimate contractual performance (delivering purchased ebooks, processing payouts, distributing royalties), statutory compliance (anti-money laundering, tax records), and your explicit consent (newsletter subscriptions, marketing, personalization).

2. Information We Collect

2.1 Personal Information You Provide

• Account Profiles: Full legal name, username, email address, password hash, country of residence, and contact phone numbers.
• Author Publishing Profiles: Pen names, biography, profile pictures, and published manuscript files.
• Identity Verification (KYC): Government-issued National ID, International Passport, date of birth, residential county/town, and biometric live selfie photographs required for all author, affiliate, and staff financial withdrawals.
• Payment & Payout Coordinates: M-Pesa mobile money numbers (primary African payout rail) and PayPal email addresses (international settlement) for receiving royalty disbursements, affiliate earnings, and staff compensation.
• Staff Operational Profiles: Virdap operations staff (KYC Reviewers, Manuscript QA Agents, Customer Support Agents) submit personal email addresses, phone numbers, and country of residence during the hiring application process.
• Support Communications: Support ticket messages, chat thread history, DMCA copyright inquiries, and author/reader support correspondence.
• User Submissions: Book reviews, ratings, reader questions, highlights, and notes.

2.2 Information Collected Automatically (Telemetry & Intent)

• Search Intent & Personalization Signals: On-platform search queries, category navigation, book page views, and reading history used to populate dynamic recommendation shelves.
• External Arrival Signals: HTTP referer metadata (e.g. Google search queries, social media links), UTM marketing parameters, and ?ref= affiliate attribution tokens.
• Reading Progress & Telemetry: Reading percentages, last-read CFI bookmarks, session durations, and offline reading activity.
• Technical Diagnostics: IP address, device fingerprints, screen dimensions, operating system, browser type, Android app version codes, and connection speed.

3. How We Use Your Information

• Core Service Delivery: Providing access to your encrypted digital bookshelf, syncing progress across devices, and delivering DRM-protected content.
• Multi-Currency Financial Processing: Processing book purchases via M-Pesa STK Push (for Kenyan buyers) and PayPal Checkout (for international buyers), calculating statutory local VAT (e.g. 16% Kenya, 7.5% Nigeria, 15% Ghana), and routing net payouts.
• Automated Royalty & Affiliate Splitting: Accurately calculating the 70% author share, the 10% affiliate commission, and the 30% platform share.
• Staff Compensation Processing: Logging per-action earnings for Virdap operations staff (KES 10 per KYC review, KES 15 per support ticket, KES 25 per manuscript QA) and processing withdrawals via M-Pesa B2C or PayPal API.
• Fraud Prevention & Account Security: Enforcing the 7-day security hold on pending earnings, locking payout accounts against unauthorized modifications, and verifying high-risk transactions with email OTP 2FA.
• Copyright Protection & Content Integrity: Automatically screening uploaded manuscripts against our catalog using text fingerprinting (SHA-256 content hashing) and perceptual cover art hashing (pHash algorithm) to protect original intellectual property and detect duplicates.
• Customer Support Operations: Processing support inquiries through our secure online conversation portal, maintaining chat thread history, and dispatching email notifications when staff respond.

4. Information Sharing & Third-Party Processing

We do not sell, rent, or trade your personal data. We transfer information strictly to authorized service providers necessary to operate the Platform:

• Safaricom (M-Pesa Daraja API): Our primary African payment processor for STK Push collections, C2B transactions, and B2C payouts to M-Pesa mobile wallets.
• PayPal Holdings: Our international payment processor for cross-border purchases and author/staff payout disbursements via the PayPal Payouts API.
• Cloud & Security Infrastructure: DigitalOcean (cloud servers), Cloudflare (DDoS mitigation), and Brevo (transactional email, OTP delivery, and customer support notifications).
• Operations Communications: Telegram Bot API for internal admin alerts regarding new submissions, escalations, and payout requests.
• Author Analytics: Authors receive anonymized purchase counts and buyer usernames. Reader phone numbers, email addresses, and payment card details are never exposed to authors.
• Legal & Regulatory Authorities: We disclose data when mandated by lawful court orders, criminal investigations, or valid DMCA takedown requests under international copyright treaties.

5. Data Security & DRM Protection

• All network communications are secured using modern TLS 1.3 encryption.
• Passwords are hashed using salted cryptographic functions (PBKDF2/SHA-256) and cannot be viewed by Virdap personnel.
• Digital Rights Management (DRM): Ebook files are protected on encrypted cloud storage. Readers cannot extract raw EPUB/PDF files; reading is exclusively rendered through our sandboxed browser viewer or encrypted offline storage on the mobile app.
• Payout Security Lock: Following an author's, affiliate's, or staff member's first successful withdrawal, destination payment accounts (M-Pesa number or PayPal email) are permanently locked. Alterations require 6-digit email OTP two-factor verification.
• Staff Workstation Access Control: All staff operations are role-gated with first-come-first-served ticket claiming to prevent collision. Every action is logged and auditable.
• Secure Support Portal: Customer support conversations occur exclusively through our secure online portal using tokenized email access. Direct email reply channels are disabled to prevent phishing and formatting corruption.

6. Data Retention

• Active Account Data: Retained for the duration of your active registration.
• Financial & Tax Records: Retained for a mandatory statutory period of seven (7) years in compliance with African financial and banking regulations.
• KYC Verification Records: Retained for the account lifetime plus five (5) years in compliance with statutory Anti-Money Laundering (AML) standards.
• Support Ticket History: Resolved tickets are archived in read-only mode and retained for three (3) years for audit and compliance purposes.
• Staff Action Logs: All operational actions by Virdap staff are permanently retained for performance analytics, compensation verification, and audit trails.
• Affiliate Cookies: Stored locally for twenty-four (24) hours or until the first completed purchase.

7. Your Rights & Account Deletion

Subject to your local data protection authority, you hold the right to access, rectify, restrict, or request the deletion of your personal data.

To request permanent account deletion:

1. Log into your account and submit an erasure request via Profile → Edit Profile.
2. Or open a secure support ticket at virdap.co.ke/contact/ with the subject line "Account Deletion Request".

Upon verified erasure, your personal profile, reading history, and wishlist are purged within thirty (30) days. For authors, affiliates, and staff, pending royalties, commissions, and compensation will be disbursed to your verified payout account before account closure.

8. Contact Data Protection Officer