Global Privacy Policy

1. Introduction

"Afripods", "we", "us" or "our" refers to the Afripods group of companies, comprising Afripods Inc., a company incorporated in Delaware, United States ("Afripods Inc."), and Afripods Limited, a company incorporated in Kenya and trading as Afripods Africa ("Afripods Limited"). Together, the group operates a podcast hosting, distribution and creator monetization platform available via https://afripods.africa/ and our mobile applications (together, the "Platform").

This is a global Privacy Policy. It applies to podcast creators ("Creators"), listeners ("Listeners"), advertisers and sponsors, and visitors to our website (together, "you"), wherever in the world you use the Platform, and explains how we collect, use, disclose, store and protect your personal data, and how you can exercise your rights over it.

Afripods applies one consistent set of core data protection standards, modelled on the GDPR, Kenya Data Protection Act, No. 24 of 2019 (the "DPA") and international best practice, to all Users worldwide as a baseline. Where you are located in a jurisdiction that grants additional or different rights, including Kenya, the United States, or the European Economic Area, this Policy sets out those jurisdiction-specific rights in Section 13, in addition to the global baseline.

This Policy should be read together with our Terms & Conditions, which govern your use of the Platform generally. Where this Policy and the Terms & Conditions conflict on a data protection matter, this Policy prevails.

By accessing or using the Platform, you acknowledge that you have read and understood this Policy. Where our processing relies on your consent, you may withdraw it at any time as described in Section 9.

2. Who we are — the data controllers

Afripods Inc. and Afripods Limited each act as data controllers for the Platform. Where the two entities jointly determine the purposes and means of a particular processing activity, they act as joint controllers and have put in place an internal arrangement documenting their respective responsibilities (Intercompany Data Sharing and Joint Controller Agreement).

3. Definitions

• "Personal data" means any information relating to an identified or identifiable natural person, as defined under the DPA.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, or deletion.
• "Data subject" means the natural person to whom personal data relates.
• "Google user data" means any data obtained through Google APIs that is subject to the Google API Services User Data Policy, including data made available through Google Sign-In and the YouTube Data and Analytics APIs.
• "Child" means a person under the age of eighteen (18). Where a stricter age threshold applies under local law (for example, 13 for certain purposes under US law), the stricter threshold applies for that purpose.
• "Sensitive personal data" includes financial information, biometric data, and other special categories recognised under the DPA or equivalent local law.

4. Personal data we collect

4.1 From Listeners

• Account information: name, email address, phone number, date of birth or age confirmation, and password (stored encrypted/hashed).
• Location information: general location inferred from IP address; precise location only with separate opt-in.
• Device and technical information: device identifiers, IP address, browser type, operating system, app version.
• Listening behaviour: podcasts played, listening duration, playback history, favourites, downloads, search queries.
• Payment information: collected via our payment processors (e.g. M-Pesa, card processors); we do not store full card numbers ourselves.
• Communications: support messages, survey responses, reviews.

4.2 From Creators

• Identity and contact information: full name, email, phone number, and, where required, identification details for verification.
• Financial information: bank/mobile money details, tax identification information, revenue-share payment history.
• Content and profile data: podcast uploads, artwork, episode metadata, biography, profile images.
• Performance data: listener analytics for the Creator's show, advertising performance, revenue-share calculations.

4.3 From Advertisers and Sponsors

Business contact details, billing information, and advertising campaign data (creative, targeting parameters, performance metrics).

4.4 Collected Automatically (Cookies and Trackers)

We and the following third-party partners use cookies and similar technologies on the Platform:

• Microsoft Clarity: behavioural analytics including heatmaps and session-replay recordings, used to understand how Users interact with the website and improve its design.
• Google Analytics and other analytics partners we may add from time to time; any additions will be reflected here and, where required, in the cookie consent banner categories.

Afripods does not currently use a third-party advertising or retargeting cookie provider. If we introduce one in the future, this section and our Cookie Policy will be updated to name it, and you will be asked for fresh consent before it loads.

Depending on your jurisdiction, the use of analytics tools such as Microsoft Clarity may be considered a "sale" or "share" of personal information (see Section 13.3 for US residents). These tools require your consent before they load, obtained through the cookie banner described in Section 10, and are never used to profile or target Users we know or reasonably believe to be under 18.

5. Google user data

Afripods integrates with certain Google APIs to provide specific features of the Platform. This section describes, in the detail Google requires, how we access, use, store, share, and allow deletion of Google user data.

5.1 Data Accessed

• Google Sign-In (OAuth 2.0): basic profile information — your name, email address, and profile picture — used to create and authenticate your Afripods account.
• YouTube Data API v3: aggregated YouTube channel statistics (view counts, subscriber counts, watch time, engagement data) for YouTube channels that a Creator explicitly connects to their Afripods account.
• YouTube Analytics API: more detailed channel and video performance data, such as audience demographics, traffic sources, retention, and revenue-related metrics, for connected YouTube channels.

We do not access private content, messages, comments, or any Google data beyond what is explicitly authorised through the Google consent screen at the time of connection.

5.2 Data Usage

• Profile data from Google Sign-In is used solely to create, identify, and authenticate your Afripods account.
• YouTube statistics and analytics data are used to power a Creator's analytics dashboard within Afripods, giving them a unified view of their podcast's performance across platforms, and to improve Afripods' own aggregated, non-identifying platform statistics.

We do not use Google user data for advertising, profiling, or any purpose beyond what is described in this section.

5.3 Data Sharing

We do not sell, rent, or share Google user data with third parties for advertising or marketing purposes. Google user data may only be disclosed to:

• Subprocessors and infrastructure providers (e.g. hosting and database providers) acting strictly on our instructions and bound by written confidentiality and data processing obligations.
• Public authorities, where required by applicable law.

Google user data is never sold or shared with third parties for their own independent use.

5.4 Data Storage and Protection

Google user data is stored on Amazon Relational Database Service (Amazon RDS). We apply encryption in transit (HTTPS/TLS) and at rest, strict access controls limited to personnel who need the data to perform their role, and regular security reviews, to protect this data from unauthorised access, alteration, or disclosure.

5.5 Data Retention and Deletion

Google user data is retained for as long as your Afripods account remains active and connected to the relevant Google service. If you disconnect your Google account, or request deletion of your Afripods account, all associated Google user data is permanently deleted within 30 days. You can request deletion at any time via your account settings or by contacting contactus@afripods.com.

6. How we use your personal data and our legal basis

We process personal data only where we have a valid legal basis, applying the DPA's framework as our global baseline. The table below sets out our main processing activities and the corresponding legal basis.

We do not sell your personal data to third parties for their own independent marketing purposes.

7. Children's privacy and age requirements

The Platform is intended for use by individuals aged 13 and above. Users aged 13-18 may listen to age-appropriate content but may not register as a Creator, receive payments, or interact with advertising features without parental or guardian consent.

• We do not knowingly collect personal data from a User under 13 without verifiable parental or guardian consent.
• We do not knowingly target advertising or behavioural profiling at Users under 18, including through analytics tools such as Microsoft Clarity.
• Parents or guardians may contact our DPO (Section 21) to review, correct, or delete a child's data.

See also our Child Safety Policy, which sets out our platform-wide approach to child protection in more detail.

8. How we share your personal data

We share personal data only where necessary for the purposes in this Policy, subject to appropriate contractual safeguards. We share with:

• Afripods group companies: Afripods Inc. and Afripods Limited share personal data with each other as necessary to operate the Platform, under the intercompany arrangement referenced in Section 2.
• Service providers and processors: cloud hosting, analytics (Microsoft Clarity, Google Analytics), payment processors (M-Pesa, card processors), and communications tools, each under a written Data Processing Agreement.
• Other Users, where relevant: a Creator's public profile and published episodes are visible to Listeners and the public as core platform functionality.
• Advertisers and sponsors: aggregated or pseudonymised analytics, not identifiable Listener data, unless you have separately consented.
• Professional advisers and regulators, including the ODPC, where required by law or to establish, exercise or defend legal claims.
• A successor entity in a merger, acquisition, or sale of assets, subject to confidentiality and data protection safeguards.

We do not control, and are not responsible for, information you choose to share with other Users through the Platform, or how those Users further use or share it. We are also not responsible for the privacy practices of third-party websites or services accessed through the Platform, including those reached via API integrations.

9. Consent management

Where we rely on your consent — for marketing communications, non-essential analytics, or, if introduced in future, behavioural advertising — we ask for it through a clear, affirmative action, never a pre-ticked box. We keep a record of consent given, including the date, the Policy version in force, and the purposes consented to.

• Consent is requested separately for analytics cookies, marketing communications, and any future third-party advertising data sharing.
• You may withdraw consent at any time via account privacy settings, the unsubscribe link in marketing emails, or by contacting our DPO.
• For Google Sign-In and YouTube API access specifically, you can revoke Afripods' access at any time via your Google Account permissions page, in addition to your Afripods account settings.

10. Cookies and similar technologies

A cookie consent banner is shown on your first visit, letting you accept or reject non-essential cookies by category — strictly necessary and analytics (including Microsoft Clarity). We do not currently run an advertising cookie category; one will be added, with its own consent toggle, only if we introduce an advertising or retargeting vendor. See our Cookie Policy for the full list of cookies in use.

11. Cross-border data transfers

Personal data is transferred between Afripods Limited (Kenya) and Afripods Inc. (United States) as necessary to operate the Platform, and to service providers who store or process personal data outside Kenya, including Google (United States), Microsoft (United States/global), and our cloud hosting provider (Amazon Web Services).

We may only transfer personal data outside Kenya where the recipient jurisdiction provides adequate protection, or where appropriate safeguards such as standard contractual clauses (SCCs) or your explicit consent are in place. As Kenya has not concluded an adequacy arrangement with the United States or European Union as of this Policy's effective date, we rely on contractual safeguards, including intercompany data transfer terms between Afripods Limited and Afripods Inc., and, where applicable, your consent. A current list of transfer destinations and safeguards is available on request from our DPO.

12. Data retention

Outside the categories above, we generally do not retain personal data for more than one year after the end of our relationship with you, except where a longer period is required by law or necessary to establish, exercise, or defend legal claims. A full Data Retention and Deletion Schedule is maintained internally and available to the ODPC and data subjects on request.

13. Your privacy rights

This section sets out your rights on a global baseline basis, and then adds jurisdiction-specific rights that apply if you are located in Kenya, the United States, or the European Economic Area. Where you are located elsewhere, the global baseline applies, and we will honor comparable rights on request even where not locally mandated.

13.1 Global Baseline (all Users)

Wherever you are located, you have the right to: be informed of how your personal data is used; access the personal data we hold about you; object to processing; request correction of inaccurate data; request deletion of data we are no longer authorised to hold; withdraw consent at any time, where processing is based on consent; and request data portability, where technically feasible.

To exercise these rights, contact our DPO using the details in Section 21. We will respond within a reasonable time, and within any shorter period required by law in your jurisdiction, and may need to verify your identity first.

13.2 Kenya

If you are located in Kenya, the rights above apply as under the Data Protection Act of Kenya.

13.3 United States

If you are a resident of a US state with an applicable privacy law (such as California's CCPA, as amended by the CPRA), you have the following additional rights:

• Right to know/access: request disclosure of the categories and specific pieces of personal information we have collected, its sources, our purposes for collecting it, and the categories of third parties it is shared with.
• Right to delete: request deletion of personal information, subject to legal exceptions (e.g. completing a transaction, detecting security incidents, complying with a legal obligation).
• Right to correct: request correction of inaccurate personal information.
• Right to opt out of sale or sharing: we do not sell personal information for monetary consideration; where our use of an analytics tool such as Microsoft Clarity is considered "sharing" under applicable state law, you may opt out by contacting contactus@afripods.com
• Right to non-discrimination: we will not deny services, charge different prices, or provide a different quality of service because you exercised these rights.
• Authorised agents: you may designate an agent to submit requests on your behalf, subject to proof of authorisation and identity verification.
• Appeals: if we decline to act on your request, you may appeal by contacting contactus@afripods.com.

13.4 European Economic Area

If the GDPR applies to our processing of your personal data for example, because you are located in the EU/EEA we comply with its applicable requirements in addition to the global baseline above, including, where required, appointing an EU representative, and you have the right to lodge a complaint with your local supervisory authority.

13.5 Other Jurisdictions

As Afripods expands into new markets, jurisdiction-specific subsections will be added here to reflect any additional local rights, consistent with our practice of layering local requirements onto the global baseline rather than replacing it.

14. Data security and breach notification

We implement technical, organisational, and administrative measures designed to protect your personal data against unauthorised access, alteration, disclosure, loss, or destruction, including access controls, multi-factor authentication for administrative and Creator accounts, encryption in transit and at rest, and regular security reviews.

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the ODPC without undue delay, within the timeframe required under the DPA, and will notify affected data subjects and other relevant regulators where required by applicable law.

15. Sensitive personal data

Please do not send us, or disclose through the Platform, any sensitive personal data — such as information about racial or ethnic origin, political opinions, religion, health, sexual orientation, criminal history, or union membership — except where you have knowingly and intentionally chosen to provide it for a specific feature of the Platform that requires it.

16. Automated decision-making and AI tools

Where we use automated tools, including AI, for functions such as content recommendations or transcription, we will disclose this use and, where such processing produces legal or similarly significant effects, provide a means to request human review. We do not currently use fully automated decision-making to determine Creator revenue-share without human oversight; if this changes, this Policy will be updated.

17. Third-party products, services, and other users

The Platform generally accesses third-party information through APIs, including the Google integrations described above. This Policy does not address, and we are not responsible for, the privacy practices of third-party websites or services, whether or not linked to or accessible from the Platform. We are also not responsible for third parties who circumvent our security measures.

18. How this policy fits with our other documents

This Privacy Policy is the root global data-protection document for the Platform. It works together with the following documents, each of which forms part of the overall Afripods legal framework:

• Terms & Conditions; the root contractual document; incorporates this Policy by reference and vice versa.
• Listener Terms, Creator Terms, and Advertising Terms; role-specific extensions of the Terms & Conditions; where they address data practices specific to that role, this Policy takes precedence on data protection matters.
• Cookie Policy; the detailed list of cookies and trackers referenced in Section 10, including Microsoft Clarity.
• Child Safety Policy; platform-wide child protection measures referenced in Section 7.
• Community Guidelines; content standards referenced in the Terms & Conditions; relevant where personal data appears within published content.
• Revenue Share Policy; a schedule to the Creator Terms; referenced in Section 4.2 in relation to revenue-share data.

A Data Retention and Deletion Schedule, our Intercompany Data Sharing and Joint Controller Agreement between Afripods Inc. and Afripods Limited, our Data Processing Agreements with vendors (including Google, Microsoft, and Amazon Web Services), our Incident Response Plan, and our Data Protection Impact Assessments are maintained internally, are not published, and are available to the ODPC and to data subjects on reasonable request through our DPO.

19. Changes to this privacy policy

We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, corporate structure, or third-party integrations. Where changes are material, we will notify you by email or a prominent Platform notice before they take effect, and, where required, seek fresh consent. Your continued use of the Platform after a revised Policy takes effect constitutes acceptance of it; if you do not agree, please discontinue use of the Platform.

20. Governing law

This Policy applies a global baseline modelled on the Republic of Kenya's Data Protection Act, No. 24 of 2019, to all Users, supplemented by jurisdiction-specific rights under Section 13. Processing carried out by Afripods Limited is governed by the laws of the Republic of Kenya. Processing carried out by Afripods Inc. is governed by applicable US federal and state law. Nothing in this Policy limits any rights you have under the mandatory law of your own country of residence.

21. Contact us

Data Protection Officer, Afripods - dpo@afripods.com | Woodgreen Gardens, Westlands

General enquiries - contactus@afripods.com

Afripods Limited (Kenya) - Woodgreen Gardens, James Gichuru Street, Lavington, Westlands District, Nairobi, Kenya, P.O. Box 14816 Westlands

You may also lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Britam Towers, Upper Hill, Nairobi, Kenya, or via www.odpc.go.ke.