Version 1.0 · Last updated: 14 October 2026
This Privacy Policy explains how CHAPUIS BRANDING AND CREATIVES LTD, trading as Nibambe ("Nibambe", "we", "us"), collects, uses, shares and protects your personal data when you use nibambe.com and its related services (the "Platform").
We process personal data in accordance with the Constitution of Kenya (Article 31, right to privacy), the Data Protection Act, 2019 (the "Act") and the Data Protection (General) Regulations, 2021. This Policy forms part of our Terms of Use. Words defined in the Terms of Use have the same meaning here.
1. Who we are
1.1 The data controller is CHAPUIS BRANDING AND CREATIVES LTD, a company incorporated in Kenya, with its registered office in Nairobi, Kenya.
1.2 For any question about your personal data, or to exercise your rights, write to support@nibambe.com with the subject "Privacy". We will reply within the time limits set by the Act.
2. The personal data we collect
2.1 Account data: your full legal name, email address, account type (creative, parent or guardian, client), language preference, and, for clients, your organisation name.
2.2 Profile data (Creatives and Guardians): stage or professional name, photo, headline, biography, categories, skills, languages, county and area, whether you travel, height and playing age (for actors and models), services and prices, portfolio items, social media links, Group size and members' names and roles.
2.3 Contact data: the main and backup phone numbers you choose to list, the name of the person and their relationship to you (for example "mother" or "manager"), and whether each number uses WhatsApp.
2.4 CV and coach data: any CV you upload, what you tell the AI profile coach, and the summary the coach writes from it.
2.5 Sensitive personal data, only if you choose to give it: information about disability or access needs (for example that you are Deaf, blind or use a wheelchair) that you add to be matched with inclusive opportunities. This is "sensitive personal data" under section 2 of the Act. You decide whether to give it, whether it is shown publicly, and you may delete it at any time.
2.6 Children's data: where a Guardian creates a profile for a Minor, the profile data in clause 2.2 about the child, with all contact data being the Guardian's.
2.7 Verification data: the phone number from which you send a WhatsApp verification code, and the date of verification; for clients asking for the "Verified client" label, the documents you send us (such as a KRA PIN certificate or certificate of registration).
2.8 Gig and safety data: Gigs you post, the result of automated and human checks on them, reports you make or that are made about you, and our decisions on them.
2.9 Usage data: searches made on the Platform, profile views, taps on contact buttons, and basic technical data needed to run and secure the Platform (IP address, browser type, time of access, error logs).
2.10 Messages to Jay: what you type to our AI assistant Jay is sent to our AI provider to produce an answer. We do not store these conversations on our servers. Your browser keeps the current conversation only until you close the tab.
2.11 Newsletter: if you subscribe, your email, whether you are a creative, a client or just interested, your language, and a record of your consent.
2.12 Messages to us: emails you send to support@nibambe.com or info@nibambe.com.
2.13 We do not ask for, and you must not upload, national ID numbers, passport numbers, bank or card details, M-Pesa PINs or passwords.
3. How we collect it
3.1 Directly from you, when you register, build a profile, upload a CV, talk to the coach or Jay, post a Gig, make a report, verify your phone or write to us.
3.2 From a Guardian, for profiles of Minors, and from a Group Leader, for Group members' names and roles.
3.3 Automatically, when you use the Platform (usage and technical data, see clause 2.9 and our Cookie Policy).
3.4 From WhatsApp (Meta), only when you choose to verify your phone: we receive the number that sent the code.
4. Why we use it, and our legal basis
Under section 30 of the Act, we only process personal data where we have a lawful basis. We use your data:
4.1 To create and run your Account and show your profile to Clients (performance of our contract with you, the Terms of Use).
4.2 To let signed in Clients contact Creatives through the numbers Creatives choose to list (performance of contract, and your consent when you list a number).
4.3 To power search and AI Features: understanding requests, ranking Creatives by relevance, writing profile summaries, checking Gigs, answering questions (performance of contract and our legitimate interest in a useful, safe Platform).
4.4 To keep the Platform safe: preventing spam, fraud, scams, trafficking and abuse, verifying phones and clients, reviewing reports, protecting children (legitimate interests, and compliance with legal obligations).
4.5 To process sensitive personal data about disability or access needs (your express consent, section 44 and 45 of the Act). You may withdraw consent at any time by removing the information.
4.6 To process children's data (the consent of the parent or guardian, section 33 of the Act, and in the best interests of the child).
4.7 To communicate with you about your Account, safety and changes to our Terms (performance of contract and legitimate interests).
4.8 To improve the Platform using aggregated statistics, for example how many searches lead to a contact (legitimate interests).
4.9 To comply with the law, court orders and lawful requests of competent authorities (legal obligation).
4.10 We will only send you our newsletter or other marketing messages with your consent (section 37 of the Act), and every message has a one click unsubscribe link.
5. Automated decisions and profiling
5.1 We use AI to rank search results, summarise profiles and check Gigs for signs of scams or abuse. Ranking is based on relevance to the request; nobody can pay to be ranked higher in ordinary results.
5.2 Some automated steps can affect you, for example a Gig flagged for review or a profile hidden after several reports. These are always reviewed by a person before any final decision. Under section 35 of the Act, you may ask for a decision to be reviewed by a person by writing to support@nibambe.com.
6. Who can see your data
6.1 The public (anyone on the internet): a Creative's stage name, photo, headline, biography, categories, skills, languages, area, services and prices, portfolio, social links and Group information, unless you set your profile to hidden. Minors' profiles are never shown to anonymous visitors.
6.2 Signed in Users: in addition, the contact numbers a Creative or Guardian chose to list, and Minors' profiles.
6.3 Never shown to other Users: your legal name, your email, your CV, your coach conversation, your access needs (unless you choose to show them), verification documents, and reports you made.
6.4 Our team, on a need to know basis and according to their role (owner, admin, moderator, verifier, support), bound by confidentiality.
6.5 Our service providers (data processors), who process data only on our instructions and under contract:
(a) Supabase: database, sign in and file storage;
(b) Vercel: website hosting and anonymous visitor statistics (no cookies);
(c) Anthropic: AI Features (search, ranking, profile coach, Jay, Gig checks);
(d) Cloudflare: bot protection on sign up, when enabled;
(e) Meta Platforms (WhatsApp): phone verification, only when you start it;
(f) Resend: sending sign in links, service emails and the newsletter;
(g) GitHub: encrypted copies of our database, kept for 30 days as backups.
6.6 Authorities, where required by Kenyan law, a court order, or to protect someone's life or safety, including reporting suspected child abuse or trafficking.
6.7 A buyer or successor, if our business is reorganised, merged or sold, under the same protections.
6.8 We do not sell your personal data, and we do not share it with advertisers.
7. Transfers outside kenya
7.1 Some of our service providers store or process data outside Kenya, for example in the European Union or the United States.
7.2 We only transfer personal data outside Kenya in line with sections 48 to 50 of the Act and Part VI of the Data Protection (General) Regulations, 2021: to providers that offer appropriate safeguards for the security and protection of personal data, under written contracts. Sensitive personal data and children's data are transferred only with the appropriate consent and safeguards.
8. How long we keep it
Under section 39 of the Act, we keep personal data only as long as needed:
(a) Account and profile data: while your Account is open. When you delete your Account, it is deleted from our live systems at once, and from backups within thirty (30) days.
(b) CVs: until you replace or delete them, or delete your Account. When you upload a new CV, the old one is deleted.
(c) Coach conversations: until you delete your profile or Account.
(d) Contact and view statistics: up to twenty four (24) months, then deleted or made anonymous.
(e) Safety reports and decisions, and records of removed accounts for serious breaches (scams, abuse, risks to children): up to five (5) years, to protect Users and meet legal obligations.
(f) Phone verification codes: unused codes expire; we keep only the verified number and the date.
(g) Emails to us: up to three (3) years.
(h) Jay conversations: not stored by us (see clause 2.10).
(i) Newsletter: until you unsubscribe (one click link in every email). After that we keep only a record that you unsubscribed, so we never email you again by mistake.
9. Your rights
Under section 26 of the Act, you have the right to:
(a) be informed of how your data is used (this Policy);
(b) access the personal data we hold about you;
(c) object to processing based on our legitimate interests;
(d) have false or misleading data corrected;
(e) have data deleted, subject to our legal obligations;
(f) data portability (section 38): receive your data in a commonly used format;
(g) withdraw consent at any time, without affecting earlier processing;
(h) not be subject to a decision based solely on automated processing that significantly affects you (section 35).
You can edit or delete most of your data yourself on your account page, including deleting your Account. For anything else, write to support@nibambe.com. We may ask you to confirm your identity. We will not charge you, except as allowed by the Act for unfounded or excessive requests.
If you are not satisfied, you may complain to the Office of the Data Protection Commissioner (www.odpc.go.ke).
10. Children
10.1 Children under eighteen (18) cannot open an Account. Their profiles can only be created and managed by a parent or legal guardian, who gives consent on their behalf (section 33 of the Act).
10.2 We apply extra protection to children's data: no child's own contact details, school or home address; no display to anonymous visitors; strict rules for Clients. See our Child Safeguarding Policy.
10.3 If you believe a child's data was given to us without a Guardian's consent, write to support@nibambe.com and we will delete it.
11. Security
11.1 We use appropriate technical and organisational measures under section 41 of the Act, including encrypted connections (HTTPS), access controls on every database table, private storage for CVs, role based access for our team, sign in by one time email links (no passwords to steal), and monitoring for abuse.
11.2 No system is perfectly secure. If a data breach is likely to put your rights at risk, we will notify the Data Protection Commissioner within seventy two (72) hours of becoming aware of it, and inform you without undue delay, as required by section 43 of the Act.
11.3 Keep your email account secure, because it is the key to your Nibambe Account.
12. Cookies
We use only the cookies and browser storage needed to keep you signed in and to run the Platform. We do not use advertising cookies. See our Cookie Policy.
13. Changes to this policy
We may update this Policy. We will publish the new version with a new date, and tell you by email or on the Platform before material changes take effect.
14. Contact
CHAPUIS BRANDING AND CREATIVES LTD, trading as Nibambe Nairobi, Kenya Privacy questions and requests: support@nibambe.com (subject: "Privacy")