Privacy Policy

Last updated: 6 October 2026

This Privacy Policy explains what personal data Thika Superhighway (thikasuperhighwayvip.com, the "Site") collects, why, who it is shared with and what your rights are.

1. Who is responsible

The data controller is Thika Superhighway, based in Nairobi, Kenya.

Privacy contact: [email protected]

2. What we collect

We collect as little as the Site needs to work.

When you buy a subscription

• The phone number you give at checkout, or for card and crypto payments, an email address.
• The payment record: reference, subscription, amount, currency, method, status and dates.
• For a payment our team checks: the phone number you paid from, the confirmation code from your payment message, and a screenshot of the payment message if you upload one.
• For an M-Pesa payment prompt: the phone number and receipt code reported by M-Pesa.

We never see or store card numbers. Card and crypto payments are handled entirely by the payment provider.

If you create an account

• Your phone number or email address, used only to sign you in and to find your purchases.
• Your password, stored only as a one-way hash that cannot be turned back into the password.
• Creators you follow, videos you like, and your watch history.

When you use the Site

• A random visitor ID stored in a cookie, so the Site can recognise your device. See the Cookies page.
• The pages and videos you view, the website that sent you (its domain only), a campaign tag if you arrived through a tagged link, and your country, as reported by our network provider.
• Your browser type and a device label for each device that has access to your purchases, so you can see and remove them.
• Your IP address is never stored as is. We keep only a scrambled (salted hash) form, used to limit abuse such as repeated failed sign-ins.

When you report content or send a takedown request

• What you write, plus the name and contact details you give us.

We do not use advertising trackers, we do not sell personal data, and we do not send marketing messages.

3. Why we use it

• To sell you subscriptions, give you access and let you restore it on another device (performing our contract with you).
• To check payments and prevent fraud and abuse (legitimate interest, and legal obligations for financial records).
• To keep the Site secure and working (legitimate interest).
• To understand which pages and creators are popular, using our own statistics (legitimate interest). We do not use third-party analytics.
• To handle reports, takedown requests and legal requests (legal obligation and legitimate interest).

4. Who we share it with

We use these service providers, who process data only on our instructions:

• Cloudflare: network, security and delivery for the whole Site. It handles every request, including your IP address.
• Bunny.net (BunnyWay d.o.o., Slovenia): video streaming and image storage and delivery. It receives your IP address when you watch or load images. It also stores our encrypted backups.
• Zomro: our server host, in the Netherlands.
• Payment providers: the mobile money operators, banks and card or crypto payment services that process your payment. The providers offered at checkout may change from time to time.

We also disclose data where the law requires it, for example to law enforcement with a valid request.

5. Where your data is stored

The Site's database is on a server in the Netherlands. Encrypted backups are stored in Germany, with a copy in the United Kingdom. Videos and images are delivered from Bunny.net locations worldwide. If you are in Kenya, this means your data is transferred outside Kenya. We use these providers under data processing terms and keep the data they hold encrypted or limited to what the Site needs.

6. How long we keep it

• Account data: until you delete your account.
• Payment records: 7 years, as financial records, including after an account is deleted.
• Detailed usage records (pages and videos viewed): 13 months. Daily totals with no personal data are kept longer.
• One-time sign-in and reset links: deleted within a day of being used or expiring.
• Records used to limit abuse: 1 day.
• Reports and takedown requests: 3 years after the request is closed.
• Backups: up to 8 weeks, after which older backups are deleted. Deleted data may remain in a backup until that backup expires.

7. Your rights

Under the Kenya Data Protection Act 2019 you have the right to be told how your data is used, to access it, to have it corrected or deleted, to object to its use, and to receive it in a portable form. You can delete your account yourself from Account settings. For anything else, write to [email protected]. We reply within 30 days.

You can also complain to the Office of the Data Protection Commissioner (ODPC) in Kenya, or to the data protection authority where you live.

8. Security

The Site uses encrypted connections (HTTPS) throughout, stores passwords and IP addresses only in hashed form, encrypts its backups, keeps the records of people who appear in content and payment screenshots in private storage that only authorised staff can open, and requires two-step sign-in for staff.

9. Children

The Site is for adults only. We do not knowingly collect data from anyone under 18. If you believe a minor has used the Site, contact us and we will delete their data.

10. Changes

We may update this policy. The date at the top shows when it last changed.