Privacy Policy

Who is responsible

LAJ House Limited, a company registered in Kenya, operates ViewPoint—EA. For the purposes of the Data Protection Act 2019 we are the data controller: we decide what is collected and why, and we are who you hold to account for it.

Contact: viewpoint@lajhouseltd.com · PO BOX 943-00621, Nairobi, Kenya

What we collect, and why

Account details — your email, your name, and whether you are a viewer, creator or administrator. Optionally a photo, a short bio, your country, and website or social links if you add them. We need these to give you an account and show you the right things. Your password is stored only as a cryptographic hash; we cannot see it or recover it.

Payment records— which film, rental or purchase, the amount, the phone number the payment came from, IntaSend’s reference, and the time. We keep these because they are what proves you own what you bought, and because they are our financial records. Your M-Pesa PIN and payment credentials are entered with IntaSend and never reach us.

Viewing activity — when you open a film and how far through it you are, so you can resume where you stopped, and so creators can see how their films are doing.

Creator payout details — if you earn money, either your M-Pesa number or your bank name, account name and account number. Used to pay you, and for nothing else. They are not on your public profile and other users cannot see them.

Consent records — which version of these documents you accepted and when. We keep these because being able to show what you agreed to, and when, is the point of asking.

Who else sees it

Each of these gets only what it needs to do its job:

• IntaSend (Kenya) — payments. Receives your payment details and the amount; tells us whether it worked.
• Bunny.net — video delivery. Films are stored and streamed from Bunny; when you press play we mint a link that works for a few hours.
• Supabase — database and accounts hosting. Your account and the records above live there.
• Vercel — application hosting. Serves the site and processes the requests you make to it.

We may also disclose information where the law requires it, or to establish or defend a legal claim such as a copyright dispute.

We do not sell your personal data and we do not share it with advertisers.

Some of these providers store data outside Kenya. The Data Protection Act requires that it still be protected appropriately when it goes abroad, and we rely on each provider’s contractual commitments for that.

How long we keep it

• Account and profile — while your account is open. Deleted when you delete the account.
• Payment and payout records — kept after an account closes, because they are financial records, for 5 years, and in the least revealing form that still serves the purpose.
• Viewing activity — while the account is open; deleted with it.
• Payout details — while you are an active creator, then for as long as the payments they relate to.
• Consent records — for as long as the account exists and for 5 years after, since their purpose is evidential.

Your rights under the Data Protection Act 2019

You have the right to be told what we hold and why (this page); to get a copy of it; to correct it — most of it you can edit yourself from your profile; to have it deleted; to object to what we do with it or ask us to restrict it; and to take it with you in a portable form.

To exercise any of these, email viewpoint@lajhouseltd.com from the address on your account, saying what you want. The Data Protection (General) Regulations 2021 set the deadlines and we work to them:

• Access to your data — 7 days (Regulation 9(4)). Free of charge, and if you ask electronically we reply in a commonly used electronic form.
• Correcting your data — 14 days (Regulation 10).
• Deleting your data — 14 days (Regulation 12).

We may ask you to verify who you are before we act, precisely so that nobody else can use these rights against you.

If we have to keep something you asked us to delete — financial records are the usual reason — we will tell you plainly what and why rather than quietly keeping it.

If you are unhappy with how we have handled it, you can complain to the Office of the Data Protection Commissioner of Kenya.

Keeping it safe

Access to the database is restricted by row-level security, so one account cannot read another’s. Payout details are not readable back out to anyone but you and the administrator who runs payouts. Films are served through short-lived signed links rather than public URLs.

No system is perfectly secure and we would rather say so. If a breach ever affects your personal data we will notify you and the Data Protection Commissioner as the Act requires.

Children

ViewPoint—EA is for adults; you must be 18 to hold an account. We do not knowingly collect data from children, and will remove any account we learn belongs to one.

Changes

We will update this page as the platform changes and when counsel has reviewed it. The version and date at the top tell you which one you are reading. Material changes are put to you for acceptance on next sign-in, not slipped in.