Privacy · Tesa

Our commitment

Tesa is an adults-only platform, and we know that what you watch and buy here is private. This policy explains what personal data we collect, how we use and protect it, and the rights you have. It is written to comply with the Constitution of Kenya (Article 31), the Data Protection Act, 2019 and the regulations made under it, and it applies to everyone who uses Tesa. It forms part of our Terms of Service.

Who is responsible for your data

Tesa is the data controller for personal data processed on this platform, within the meaning of the Data Protection Act, 2019. For anything in this policy, including requests to exercise your rights, contact us at support@tesa-app.com.

Personal data we collect

Account and profile data: your name, username, email address, phone number, date of birth, gender, bio and profile photos you choose to add.
Content and activity: videos you upload, videos you unlock, comments, likes, bookmarks, viewing history and searches.
Payment and payout data: the M-Pesa number you pay from, transaction references and amounts, and the mobile money or bank details creators give us for payouts. Card and mobile money payments are processed by licensed payment providers; we never see or store your full card details or M-Pesa PIN.
Safety and fraud data: IP address, device and browser information, the numbers payment prompts are sent to and whether they succeed, and logs of logins and admin actions. We use these to stop abuse such as mass payment prompts, account takeovers and paywall circumvention.
Reports and support: reports you make about content or accounts, and messages you send to our support team.
Verification data: proof of age or identity, and from creators, the age and consent records of people appearing in their content, when we ask for them.

Sensitive data and discretion

What you watch, buy or post on an adult platform can reveal information about your sex life, which the Data Protection Act treats as sensitive personal data. We handle it with extra care:

We process it only to provide the Service you asked for, to keep the platform safe and lawful, or where the law requires, and by using Tesa you give your explicit consent to that processing.
We never sell it, never share it with advertisers and never use it to target ads.
Creators do not get a list of who bought their videos beyond what is needed to show sales and earnings.
Payment descriptions on your M-Pesa or card statement are kept discreet.
Access inside Tesa is limited to the staff who need it for support, safety or legal reasons.

Why we process it (lawful basis)

Section 30 of the Data Protection Act requires a lawful basis for every use of personal data. We rely on:

Contract: to run your account, host your content, process unlocks and pay creators.
Legal obligation: tax records, age and consent verification, and responding to lawful requests from Kenyan authorities.
Legitimate interests: preventing fraud and abuse, enforcing our Terms and Content Policy, securing the platform and improving our features.
Consent: for sensitive data as described above and for anything optional, such as analytics cookies or marketing messages. You may withdraw consent at any time; this does not affect processing already done, and some features may stop working.

We collect only what we need, and we do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Automated limits, such as blocking a number after repeated failed payment prompts, are temporary and reviewed by a person on request.

Cookies and similar technology

Essential: keeping you signed in, remembering that you confirmed you are 18 or over, keeping the videos you unlocked as a guest tied to your browser, and protecting forms against forgery. The Service does not work without these.
Preferences: remembering your light or dark theme.
Analytics: Microsoft Clarity records how pages are used (clicks, scrolling and page views) so we can fix problems and improve the design. We do not use it to identify you, and we do not use advertising cookies.

You can clear or block cookies in your browser settings, but blocking essential cookies will sign you out and remove guest unlocks.

Who we share data with

Service providers (data processors), bound by contracts that meet the requirements of the Data Protection Act: payment providers (Paystack and Safaricom M-Pesa), video hosting and delivery (Bunny.net), cloud hosting, email delivery, Google (if you sign in with Google) and Microsoft Clarity (analytics).
Other users: your public profile and the content you choose to publish are visible to others. Your email, phone number, date of birth and purchases are not shown publicly.
Authorities: where disclosure is required by Kenyan law or a valid court order, including requests under the Computer Misuse and Cybercrimes Act, 2018. We report suspected child sexual abuse material and other serious crimes to the Directorate of Criminal Investigations and preserve the related data for them.
Rights holders: limited information needed to deal with a valid copyright takedown notice.
A successor: if the Service is transferred to a company or other entity formed to run Tesa, or in a merger or sale, your data moves with it under this policy.

When you report another user, we do not tell them who made the report.

Transfers outside Kenya

Some of our service providers store data outside Kenya. When that happens we comply with sections 48 to 50 of the Data Protection Act and the Transfer regulations: we transfer personal data only where there are appropriate safeguards for its security and protection, or another lawful ground, and for sensitive data only with your consent, which you give by using the Service. We remain responsible for it.

How long we keep data

Account and profile data: while your account is open. When you delete your account it is hidden at once and, after a 7-day window in which you can cancel by logging in, deleted or anonymised, except as below. Creators' videos are deleted from our video hosting provider too.
Payment, payout and tax records: at least five years, as the Tax Procedures Act, 2015 requires. If you delete your account they are kept without your name, contact details or IP address.
Records relating to bans, reports, fraud and legal claims: as long as needed to prevent repeat abuse, defend claims or assist investigations.
Age and consent records for creators' content: as long as the law and our Terms require.
Security logs: for a limited period, usually no more than 12 months.

This follows section 39 of the Act: we keep personal data only as long as needed for the purposes described here or as required by law.

Security

We apply technical and organisational measures in line with section 41 of the Act, including encryption in transit, hashed passwords, access controls, content security policies, input sanitisation, rate limits and audit logs. No system is perfectly secure, so keep your password private and tell us at once if you suspect misuse. If a breach occurs that is likely to cause real risk of harm to you, we will notify the Data Commissioner within 72 hours and tell you as the Act requires (section 43).

Your rights

Under sections 26, 34, 36, 38 and 40 of the Data Protection Act you have the right to:

Be told how your data is used (this policy).
Access a copy of the personal data we hold about you.
Have inaccurate or misleading data corrected.
Have your data deleted where we no longer have a lawful reason to keep it. You can delete your account yourself in your account settings or the app.
Object to processing, including for direct marketing.
Receive your data in a portable, machine-readable format.
Withdraw consent at any time, without affecting past processing.

Email support@tesa-app.com from the address on your account. We may need to confirm your identity first, and we respond within the timelines set by the Act. Some data may be kept despite a deletion request where the law requires it or to deal with fraud, abuse or legal claims. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (odpc.go.ke).

Children

Tesa is strictly for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we learn that an account belongs to a person under 18 we will close it and delete their data, except anything we must keep to protect a child or assist the authorities.

Changes and contact

If we change this policy we will update the date above and, for significant changes, tell you in the app or by email. Questions or requests about your personal data? Write to support@tesa-app.com.