Privacy Policy

Last updated: February 9, 2026

1. Introduction

SurpriseHub ("we", "us", or "our") respects your privacy and is committed to protecting the personal data you share with us. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our web application. This policy complies with the Kenya Data Protection Act 2019, the EU General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA).

2. Information We Collect

2.1 Information You Provide

•Account Information: Name, email address, and password when you register.
•Surprise Content: Text messages, images, videos, audio files, and other media you upload to create surprise pages.
•Payment Information: M-Pesa phone number and transaction details for subscription purchases. We do not store full payment credentials.
•Guestbook & Feedback: Messages, names, and reactions left by surprise recipients.

2.2 Automatically Collected Information

•Device Information: Device type, brand/model, operating system, and browser type (extracted from your user agent string using the ua-parser-js library).
•Usage Data: Page views, view counts, timestamps, and interaction events with surprise pages.
•IP Address: Used for rate limiting and approximate geographic location. We do not store IP addresses permanently.

3. How We Use Your Information

•To provide, operate, and maintain the Service.
•To process your subscription payments and manage your account.
•To display analytics on your surprise pages (view counts, device breakdowns).
•To protect the security of the Service (rate limiting, fraud detection).
•To communicate with you about your account, updates, and support requests.
•To comply with legal obligations.

4. Third-Party Services

We use the following third-party services to operate the platform:

Service	Purpose	Data Shared
Firebase (Google)	Authentication, Database, Hosting	Email, account data, surprise data
Cloudinary	Media storage & CDN	Uploaded images, videos, audio
Safaricom M-Pesa	Payment processing	Phone number, transaction details
Netlify	Web hosting	Server logs, IP addresses
Google Analytics	Usage analytics	Anonymous usage data (if consent given)

5. Data Retention

•Account Data: Retained as long as your account is active. Deleted within 30 days of account deletion.
•Surprise Content: Retained for the active duration of your subscription plan, plus the grace period. Expired surprises are purged automatically.
•Analytics Data: Retained for 90 days after the associated surprise expires, then deleted.
•Payment Records: Retained for 7 years for legal and tax compliance.

6. Your Rights

Depending on your jurisdiction, you may have the following rights:

Right of Access

Request a copy of all personal data we hold about you.

Right to Rectification

Request corrections to inaccurate personal data.

Right to Erasure

Request deletion of your account and all associated data.

Right to Data Portability

Export your data in a machine-readable format (JSON).

Right to Restrict Processing

Request that we limit our use of your data.

Right to Object

Object to processing of your data for specific purposes.

Right to Withdraw Consent

Withdraw consent for analytics tracking at any time.

Right to Non-Discrimination

Exercise your rights without receiving discriminatory treatment (CCPA).

To exercise any of these rights, use the Account Settings page in your dashboard, or contact us at privacy@surprisehub.com. We will respond within 30 days.

7. Cookies & Tracking

•Essential Cookies: Required for authentication and session management. These cannot be disabled.
•Analytics Cookies: Used via Google Analytics to understand usage patterns. You can opt out through our cookie banner or browser settings.
•No Advertising Cookies: We do not use third-party advertising or sell your data to advertisers.

8. Children's Privacy

The Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If we discover that we have collected data from a child under 13, we will delete it immediately. If you believe a child under 13 has provided us with personal information, please contact us.

9. Security Measures

•All data is transmitted over HTTPS with TLS encryption.
•Firebase Authentication handles secure credential storage.
•All user inputs are sanitised to prevent XSS and injection attacks.
•Rate limiting protects against brute-force and DDoS attacks.
•Content Security Policy headers restrict executable content sources.

10. International Data Transfers

Your data may be transferred to and processed in countries outside of Kenya, including the United States (where Firebase and Cloudinary servers are located). These transfers are protected by appropriate safeguards including Google's Standard Contractual Clauses for Firebase services.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. For significant changes, we may also send an email notification.

12. Contact Us

For privacy-related enquiries, data requests, or complaints:

SurpriseHub

Email: privacy@surprisehub.com

If you are in the EU and are not satisfied with our response, you have the right to lodge a complaint with your local Data Protection Authority.