Privacy Policy

1. Who we are

Docs Recava is the Data Controller. We are registered with the Office of the Data Protection Commissioner (ODPC) of Kenya. DPO contact: safarirecoveries@gmail.com

2. What data we collect

On registration: email (required), full name (optional), phone (optional), password (hashed with Argon2), timezone, notification preferences.

When you add a document: title, type, issuer, dates, document reference number (normalized and hashed), optional notes and attachments.

On lost reports: location, date, description, optional reward and public note.

On finder submissions: optional name/contact, document number found, location, message, IP address (for abuse prevention and duplicate detection).

Automatically: browser type, device type, IP, timestamps, actions taken (for security).

3. Why we collect it

To provide the Service (contract), send reminders (contract with consent for channels), match lost reports with finders (contract), prevent abuse (legitimate interest), respond to legal requests (legal obligation).

4. Document numbers - how we protect them

We normalize document numbers, hash them with HMAC-SHA256 using a server-side secret pepper, never store the raw number in public indexes, and never display the raw number to anyone but you. Even if our database were breached, an attacker could not reverse the hash without the pepper.

5. Who we share data with

We do NOT sell your data. We share with email providers (Resend), SMS/WhatsApp providers when enabled, cloud hosting providers, and law enforcement only with valid legal process.

6. How long we keep data

Account and documents: while account is active + 30 days after deletion.
Lost reports and submissions: 12 months after resolution.
Chat messages: 12 months after report closed.
Notification logs: 12 months.
Audit logs: 24 months.
Backups: 30 days rolling.

7. Your rights (Kenya DPA 2019)

You have the right to access, correct, delete, object, port, and withdraw consent. You may complain to the ODPC at odpc.go.ke. To exercise any right, contact safarirecoveries@gmail.com. We respond within 30 days.

8. Security

Argon2 password hashing, HTTPS in transit, HMAC hashing of sensitive identifiers, access controls on admin functions, regular automatic backups, and audit logging of admin actions.

9. Data breach notification

If a breach affects your data, we will notify you and the ODPC within 72 hours of becoming aware.

10. International transfers

Some providers may process data outside Kenya. Where this happens, we ensure adequate safeguards (standard contractual clauses or equivalent).

11. Children

The Service is not directed to children under 18 without guardian consent. If we learn we have collected data from a child without consent, we will delete it.

12. Cookies

We use browser local storage to keep you logged in. We do not use tracking cookies. We do not serve ads.

13. Changes

We may update this policy. Material changes will be notified by email or in-app.

14. Contact

Docs Recava - DPO: safarirecoveries@gmail.com
Kenya Data Protection Commissioner: odpc.go.ke