Privacy Policy

Last updated 29 Oct 2026

Draft for legal review. This document is not yet in force.

This policy explains what personal data Oya Stars, the Telegram bot @oyastarsbot ("Oya Stars", "we", "us"), collects, why, who we share it with, how long we keep it, and your rights under Kenya's Data Protection Act, 2019. It applies to the bot and to this website. Our Terms of Service explain how orders work.

1. Who is responsible for your data

The data controller is ZUKO ROBOTS, P.O. Box 1084, Nairobi, Kenya. [TO CONFIRM: ODPC registration number, or confirmation that registration isn't required.]

For any privacy question or request, contact @apefix on Telegram or privacy@zukorobots.com.

2. What we collect

From Telegram, when you use the bot:

your Telegram user ID and username;
the messages and button presses you send to the bot, to the extent needed to answer them;
the dates you first and last used the bot, and whether you have blocked it.

When you order:

the recipient you choose (yourself, a Telegram username, or the channel or group for a Star Giveaway) and the account name Telegram shows for it;
what you ordered, the price, and the order's status and delivery record.

When you pay with M-Pesa:

the M-Pesa phone number you pay from;
the amount, the M-Pesa receipt number and the payment's status, as reported by our payment provider.

We never see or store your M-Pesa PIN.

When you take part in the Affiliate Program:

who referred you, if you opened the bot through someone's referral link, and the people you referred;
your earnings, their status, and your withdrawals;
for each withdrawal or refund: the M-Pesa number it is sent to, the amount, the M-Pesa receipt and, when M-Pesa returns it, the registered name on that M-Pesa account.

When you contact support: support runs on a separate Telegram account. We read and keep the messages you send there in order to help you.

On this website: we don't use cookies, analytics or tracking. Our server processes your IP address and browser details only to deliver the page and keep the service secure.

We don't collect national ID numbers, and we don't knowingly collect data about anyone under 18.

3. Why we use it, and on what basis

To take, deliver and refund your orders (performing our contract with you): your Telegram ID, the recipient, your order and your M-Pesa payment details.
To run the Affiliate Program (performing our contract with you): referral links, earnings and withdrawals.
To prevent fraud and misuse and keep the service secure (our legitimate interests): order limits, payment prompt limits, checks on withdrawals and payout numbers, and service logs.
To keep accounting and transaction records (legal obligations): orders, payments, refunds and payouts.
To tell you about your orders and earnings, and occasionally about Oya Stars (our legitimate interests): messages in the bot. You can stop them by blocking the bot.

We don't sell your data or use it for advertising, and we don't make decisions with legal or similarly significant effects about you by automated means alone. Automatic checks, such as order limits, can pause an order or a withdrawal; our team reviews these when you ask.

We share only what each party needs:

Our M-Pesa payment provider, [TO CONFIRM: legal name] (Nexus Pay): the phone number to prompt, the amount and the order reference. Safaricom processes the payment under its own privacy notice.
Our M-Pesa payout provider, FinoQ, through the PayHero platform: the phone number and amount for refunds and Affiliate Program withdrawals.
Telegram and Fragment: the recipient's username, or the giveaway's channel or group, so the item can be delivered. Your M-Pesa number is never shared with them.
Our hosting and database providers: Hetzner (servers) and Supabase (database), [TO CONFIRM: the countries where data is stored]. They store data for us and may not use it for anything else.
Authorities, when the law requires it.

Some of these providers store data outside Kenya. [TO CONFIRM: the safeguards relied on for transfers outside Kenya under section 48 of the Data Protection Act.]

5. How we protect it

Only Oya Stars' administrators can see customer data, and changes they make to settings, payouts and refunds are recorded. Phone numbers appear masked in the bot's messages (for example 07•••••678) and in our service logs. Access to our systems is protected by secret credentials that are never written to logs. No system is perfectly secure; if a breach affects your data, we will notify you and the Data Protection Commissioner as the law requires.

6. How long we keep it

Orders, payments, refunds, Affiliate Program earnings and withdrawals: 10 years after the transaction, or until you ask us to delete them, for accounting and dispute purposes. We keep a record longer, or after a deletion request, only where the law requires us to.
Your Telegram ID and username: for as long as you use the bot, and then as long as the records above that refer to them.
Service logs: 30 days.
Support conversations: until you clear the chat or ask us to delete them.

When a retention period ends, we delete or anonymise the data.

7. Your rights

Under the Data Protection Act, 2019, you may:

ask whether we hold data about you and get a copy of it;
ask us to correct data that is wrong or incomplete;
ask us to delete data, or to stop or restrict using it, where we don't have to keep it;
object to our use of your data based on our legitimate interests;
receive the data you gave us in a commonly used format.

To make a request, contact @apefix or privacy@zukorobots.com. We may need to confirm that you control the Telegram account or M-Pesa number concerned. We will reply within 6 hours.

If you are not satisfied with our reply, you may complain to the Office of the Data Protection Commissioner (odpc.go.ke).

8. Telegram

Telegram processes your use of Telegram, including your messages to the bot, under its own Privacy Policy. This policy covers only what Oya Stars does with your data.

9. Changes to this policy

We may update this policy. The date at the top shows the latest version. If a change matters to you, we will tell you in the bot.