FASTA Privacy Notice

Effective date: 21 October 2026 Data controller: FASTA APP GLOBAL LIMITED (company registration number PVT-A71MM7QJ), Maasai Road off Mombasa Road, P.O. Box 45268-00100, Nairobi, Kenya ("FASTA", "we", "us"). Contact: [email protected].

1. Who this notice is for

Customers who book repairs through FASTA; fundis (service providers) who take jobs through the FASTA Fundi app; anyone who joins the waiting list on fastaapp.co; and anyone who contacts FASTA support or uses our website.

2. What we collect

We do not collect contacts, SMS, call logs, calendar, health data, browsing history or advertising identifiers, and the apps do not send crash or diagnostic reports to us on their own. The apps contain no advertising or analytics software.

3. Why we use it

• To create and secure your account and let you recover it.
• To run your booking: send it to available fundis, take the booking fee, let a fundi quote and complete the work, and let you rate them.
• To show the customer an estimated arrival time while the fundi travels to the job.
• To verify fundis before they can take jobs, and to keep the marketplace safe (fraud prevention, incident investigation, disputes).
• To answer your support requests, using any diagnostics you choose to attach.
• To tell people on the waiting list when FASTA is live, and nothing else.
• To meet our legal obligations in Kenya.

If you do not give us certain information: without a phone number and a service address we cannot book or dispatch a repair, and without M-Pesa payment of the booking fee the job is not sent to fundis. At least one photo of the problem is needed to book. You can use FASTA without agreeing to service messages by SMS or WhatsApp. Fundis cannot take jobs until their verification documents have been reviewed. A fundi who does not allow location access can still do the job; the customer is then told that the fundi's location is not available.

We do not use your data for advertising, and we do not sell it.

4. Who sees your data, and when

Fundis, before a job is accepted. When you book, your request is shown to the verified fundis on FASTA who can take it, so that one of them can accept. At present, those fundis may see the service category, your description, your photos, the service address and its map position, and your preferred time before one of them accepts. FASTA support can also see your photos. Fundis do not see your name or phone number until one of them accepts.

The fundi who accepts. Once a fundi accepts your job they also see your name and phone number, so they can contact you. You see their name, photo, verification badge, rating and phone number.

The fundi's journey and your arrival estimate. When the fundi taps "On my way", the Fundi app sends the fundi's latest position to FASTA. We store it as a single record for the job, replaced each time a new position arrives. It is deleted when the fundi taps "I have arrived" or the journey ends, and a scheduled job on our server deletes any position that has stopped updating, normally within 15 minutes of the last update; a journey never lasts longer than 4 hours. To work out the arrival estimate, the fundi's position and the service address are sent to Google Maps Platform (see below). The customer sees only the estimated travel time and distance and when the fundi's position was last updated, never the fundi's position. We keep the times when the journey started and ended, but not the positions.

Other customers never see your details. Customers see a fundi's average rating and the number of ratings. The written comment you leave with a rating is not shown to the fundi in the Fundi app; FASTA staff can see it.

FASTA staff can see everything above in order to run the service, review verifications and resolve disputes.

Fundi verification. A FASTA reviewer looks at every document you upload. The reviewer can run an automated read of the document (see the Google Document AI row below). FASTA's own software then checks the dates it read against the type of document (for example whether a police clearance certificate has expired or is about to expire) and compares the name it read with the name on your profile. The result and any warnings are shown to the reviewer only as help; the reviewer can correct a detail that was read wrongly, and every correction is recorded with a reason. A FASTA staff member makes every decision; no document and no application is approved or rejected automatically. When a decision is made on a document or on your application, we tell you in the FASTA Fundi app (an in-app notification and a push notification to your phone). Once a document with an expiry date has passed that date, you cannot take new jobs until you upload a replacement and it is approved. If you replace a document that was already approved, you cannot accept new jobs until the replacement is approved. A job you have already accepted is never cancelled because a document was replaced or has expired; it is flagged for FASTA staff to review.

Google Maps Platform. The FASTA apps use Google Maps features. The address text you type, or your device's location if you choose to use your current location, is sent to Google (Places and Geocoding) to suggest and pin the service address. During a fundi's journey, the fundi's position and the service address are sent to Google (Routes) to estimate the arrival time. Google receives this data as an independent controller under its own terms, not as a service provider acting on our instructions. Your use of the Google Maps features in the apps is subject to the Google Maps Additional Terms of Service and the Google Privacy Policy.

Service providers who process data for us, under contract and on our instructions:

Authorities. We disclose data where the law requires it or to investigate a safety or fraud incident.

5. How long we keep it

• Your account and job history: for as long as your account is open, then as described below.
• Deleting your account: you can ask to delete your account in the app (open the Account screen, then Close account) or by following fastaapp.co/delete-account; if you can no longer open the app, email us and, after verifying you, a staff member opens the same request for you. Your account is then scheduled for deletion 30 days after the request, and the app shows you the exact date. Until that date you can select Keep account to cancel. You cannot make a new booking while deletion is scheduled. Fundis cannot accept new jobs or change their verification documents while deletion is scheduled. After that date the deletion is carried out automatically and your account cannot be recovered. If it cannot be completed straight away, it is retried; if it keeps failing, FASTA staff are alerted and restart it. FASTA staff can also pause a deletion while a documented legal hold applies. When the deletion is carried out, your login is disabled (sessions and two-step factors are revoked; an already-issued sign-in token may keep working for a short time until it expires) and we remove: your name, the phone number and photo on your profile; your saved addresses; your notification registration and the notifications we sent you in the app; the text of your rating comments (scores stay); photos you uploaded to jobs that have closed and were booked more than 30 days before processing; the map location of the service address on closed jobs you booked; the phone number, IP address and device details stored with your service-message consent record; all but the first four and last three digits of the M-Pesa phone number inside the payment provider's confirmation messages; for fundis, your verification document images (including earlier uploads you replaced) and the details we extracted from them; and the email address in the record of your deletion request (removed when processing completes). Fundis: your service area and availability status are deleted. The delete-account page lists exactly what is removed and what is kept.
• What is kept after deletion: if you have any job history (a booking, a job, a dispute, a rating or a job photo), your account is kept as an anonymised entry so that the records below can stay linked to it without your name. Job and booking-fee payment records (booking reference, category, status history, the description you typed, notes, quotes, amounts, dispute records, receipt numbers and the payment provider's confirmation message, with the phone number reduced as above) are kept for legal, tax, safety and dispute reasons, and your payment records are marked with a reference that does not show who you are. Your consent record (that you agreed or declined, the wording and the date, without the identifiers) is kept as evidence, and so is any record that you confirmed reading this notice, which is separated from your account. We have not yet fixed how long these are kept.
• The record of your deletion request (when it was made and completed, what was removed and kept, and your account's reference number, without your email address) and our internal log entries about it are kept for 36 months after the deletion is completed and are then deleted automatically, unless a documented legal hold applies.
• If you have no job history at all, your login and account record are deleted outright together with the database records linked to them, except the record of your deletion request, the minimal verification record (fundis) described below and any record that you confirmed reading this notice. Your profile photo and, for fundis, your verification documents are removed from storage; other files in storage (for example support attachments) are not removed.
• Kept, not yet covered by any removal, no fixed period: (a) photos you uploaded to jobs booked less than 30 days before processing; photos on a job whose evidence must be kept because of an open dispute, an open support request about the job or a documented hold; and photos a fundi took at your address when completing a job. Nothing removes them automatically later. We have not yet fixed how long they are kept; (b) support messages and any photos you attached to them, including any app diagnostics you chose to attach: kept while the request is open and afterwards to handle follow-ups; deleting your account does not remove them (unless you had no job history, in which case the messages are deleted with your account record and only the attached files remain), though a copy of a message's text inside an internal staff alert is replaced with a placeholder when your deletion is processed. We have not yet fixed how long they are kept; (c) verification records (fundis): your documents are kept while you are a fundi on FASTA so that we can show that we verified you. When your deletion is processed the document images and extracted details are removed (see above), but we keep a minimal verification record: the document type, the review decision and dates, and a one-way hash of your ID number, without the image or your name. If a documented hold applies to your verification documents, they are kept until it is released. If your application to become a fundi is rejected and you do not delete your account, your documents are kept and nothing removes them automatically yet. We have not yet fixed how long the minimal verification record and the documents of rejected applications are kept.
• Accounts deleted before 1 October 2026 were processed under our earlier procedure, which did not yet remove the map location of closed jobs, the consent-record identifiers, the full M-Pesa phone number inside confirmation messages or the email address in the deletion record; those details may still be held. We intend to apply the same removals to those earlier records. You have the right under the Data Protection Act to ask us what is still held about you and to have it erased: email [email protected] from the email address that was on your account. During our closed beta these requests are handled manually by FASTA, not by an automated process, and we reply in writing. If you are not satisfied with our reply you can complain to the Office of the Data Protection Commissioner.
• Waiting-list entries: kept until we have told you FASTA is live in your area, or until you ask us to remove you (email [email protected]).

6. Your rights

You can ask us to tell you what we hold about you, correct it, delete it, restrict or object to its use, or give it to you in a portable form, and you can withdraw consent for optional processing (such as device location) at any time. Email [email protected] from the email address on your account. During our closed beta these requests are handled manually by FASTA, not by an automated process; we confirm receipt and reply in writing. You can also complain to the Office of the Data Protection Commissioner (Kenya).

7. Security

Data is encrypted in transit; access is controlled per account by database rules so that customers and fundis can only read what this notice says they can; passwords are stored as one-way hashes; verification documents and photos are held in private storage and served through time-limited links (a link that has already been issued keeps working until it expires); a fundi's journey position can be read only by our server, not by any app user; staff access is limited to named administrator accounts protected by two-step sign-in, and key administrative actions (such as verification decisions, corrections a reviewer makes to details read from a document, deletion requests opened by staff and payment reviews) are logged; payment is handled by M-Pesa and we never see or store your M-Pesa PIN. No system is perfectly secure. Tell us at once if you think your account has been compromised.

8. Age

FASTA is for adults. You must be 18 or over to create an account. We do not knowingly collect data from anyone under 18; contact us if you believe we have.

9. Changes

We will update this notice when FASTA changes. Material changes will be announced in the app or by email, and the effective date above will move.

10. Contact

[email protected], or in the app: open the Account screen (the Profile tab in the FASTA app, the Account tab in the FASTA Fundi app), then Help centre, then Contact support. Post: FASTA APP GLOBAL LIMITED, Maasai Road off Mombasa Road, P.O. Box 45268-00100, Nairobi, Kenya. Harjeev Jandu is responsible for monitoring support and privacy requests; Manraj Flora is the backup.