Your Privacy Matters to Us

Next Mavens (“Next Mavens”, “we”, “our”, or “us”) is committed to protecting your privacy. This Privacy Policy describes the personal information we collect from you when you visit our corporate website at nextmavens.com, use the FIDScript developer platform, the WhatsApp Business API service at whatsapp.fidscript.com, the Deploy cloud platform, or the Soostori retail management platform — and how we use, share, and safeguard that information.

By accessing or using any of our products or services, you agree to the terms of this Privacy Policy. If you do not agree, please discontinue use of our services.

The data controller responsible for your personal information is Next Mavens, headquartered in Nairobi, Kenya.

For each product, product-specific data controllers or processors may apply. Where a third party (e.g., a payment processor) processes your data on our behalf, they are bound by data-processing agreements consistent with this Privacy Policy.

This Policy applies to all Next Mavens properties: the corporate website, FIDScript, the WhatsApp Business API platform (whatsapp.fidscript.com), the Deploy cloud platform (when launched), and the Soostori retail management platform.

It does not apply to third-party websites linked from our products. Please review those third parties’ privacy policies independently.

4.1 Information you provide directly

• Account information: name, email, phone number, password (hashed), role, profile photo.
• Billing information: business name, tax identifiers, M-Pesa phone number, billing address.
• Identity verification: government ID for KYC where required by Kenyan law.
• Communications: messages, support tickets, feedback, and any content you submit.

4.2 Information collected automatically

• Device & connection data: IP address, browser type, operating system, device identifiers.
• Usage data: pages visited, features used, timestamps, click patterns, referrer URLs.
• Cookies & similar technologies (see Section 11).

4.3 Product-specific data

• Soostori: shop inventory, point-of-sale transactions, customer debt records, M-Pesa references, salesperson commission data, receipts, audit logs.
• FIDScript / Deploy: source code, deployment configs, server resource usage, API keys, SSH keys, billing records.
• WhatsApp platform: WhatsApp Business Account IDs, phone numbers, message templates, contact lists, conversation logs.

We use personal information to deliver and improve our services, manage accounts, process payments, provide customer support, analyze product usage, send transactional and (with consent) marketing communications, prevent fraud, comply with law, and evaluate bootcamp or job applications.

We do not sell your personal information to third parties. We do not use the content of your private messages, code, or transactions to train third-party AI models.

Under the Kenya Data Protection Act, 2019, we rely on:

• Performance of a contract to deliver the services you signed up for.
• Consent for marketing communications and optional cookies. You may withdraw consent at any time.
• Legitimate interests for security, fraud prevention, product improvement, and analytics.
• Legal obligation to comply with tax, anti-money-laundering, and other regulatory requirements.

We may share personal information with: (a) service providers (cloud hosting, email, WhatsApp gateway, payment processors, KYC vendors) under data-processing agreements; (b) WhatsApp/Meta, where you use the WhatsApp Business API; (c) acquirers in a merger or sale; (d) authorities where required by law; or (e) other parties with your consent.

We do not share your data with advertisers or data brokers.

• Account data: while active, plus 30 days after deletion.
• Billing & transaction records: at least 7 years (Kenyan tax law).
• Support tickets: up to 3 years.
• Server logs: up to 90 days.
• WhatsApp message logs: while workspace is active, deletable on request subject to legal minimums.
• Demo mode data: automatically purged 8 hours after session expiry.

We use TLS in transit and AES-256 at rest, RBAC, hashed passwords, optional 2FA, dependency scanning, regular audits, segregated staging environments, and an incident-response plan with statutory breach notification.

No system is 100% secure. If we discover a breach affecting your personal data, we will notify you and the relevant authorities as required by law.

Subject to applicable law, you have the right to access, correct, delete, restrict or object to certain processing, data portability, withdraw consent, and lodge a complaint with the Office of the Data Protection Commissioner of Kenya.

To exercise these rights, contact privacy@nextmavens.com. We respond within 30 days.

We use strictly necessary cookies (authentication, security), functional cookies (language, theme), analytics cookies, and marketing cookies (with consent). You can manage preferences via your browser or our in-product cookie banner.

Our products integrate with WhatsApp/Meta, M-Pesa/Safaricom/PayHero, Resend, Cloudinary/CDN providers, AWS/DigitalOcean/Cloudflare, and social platforms (GitHub, Twitter/X, LinkedIn). Each operates under its own privacy policy.

When we transfer personal data internationally, we use appropriate safeguards such as Standard Contractual Clauses, encryption, and contractual data-processing terms.

Our products are not directed to children under 18, and we do not knowingly collect personal information from children. Contact us if you believe a child has provided personal data.

We may update this Policy from time to time. We will revise the “Last updated” date and, where material, notify you via email, in-product notification, or a prominent banner. Continued use indicates acceptance.

For any questions about this Privacy Policy or to exercise your data-protection rights, contact our Data Protection team: