Privacy Policy

Weche is operated by Lingofrica, a company focused on African language technology. References to “we”, “us”, or “our” in this policy mean Lingofrica. You can reach us at privacy@lingofrica.com.

This policy applies to the Weche web application at https://weche.lingofrica.com, our iOS and Android mobile apps, and all related services.

We collect only what is necessary to provide and improve Weche. Here is a complete list:

Weche is passwordless. You sign in by entering your email address and then the six-digit code we send to it. There is no password to choose, store, or reset, so we never hold one.

Signing in and creating an account are the same step: if we have not seen your address before, entering the code creates your account. An account is required to use the app, so we no longer create anonymous sessions. You can delete your account at any time from settings.

We use the data we collect to:

• •Provide the core service: process your language queries and return AI-generated responses.
• •Enforce usage limits and manage your subscription tier.
• •Send transactional emails: account confirmation, payment receipts, cancellation notices, and account deletion confirmation.
• •Send product updates and language learning content (opt-out available at any time).
• •Maintain account security and prevent abuse.
• •Improve the product using aggregated, anonymised feedback data.

We do not use your data to serve advertisements or sell it to third parties for any purpose.

We process your personal data under the following legal bases, in accordance with the Kenya Data Protection Act 2019 (DPA) and, where applicable, the EU General Data Protection Regulation (GDPR):

• •Contract performance: processing your queries, managing your subscription, and sending transactional emails are necessary to deliver the service you signed up for.
• •Legitimate interests: storing query history for session continuity, enforcing rate limits, and maintaining service security.
• •Consent: marketing emails. You can withdraw consent at any time.
• •Legal obligation: retaining payment records for tax and financial compliance requirements.

We work with carefully selected third-party providers. Each receives only the minimum data needed to perform their function. We are not responsible for the privacy practices of these providers, so please review their policies directly.

Your data is stored in Supabase’s managed PostgreSQL database. We apply the following security measures:

• •Row-Level Security (RLS): every database table is protected by Postgres policies ensuring you can only read and write your own data, even if our API layer were bypassed.
• •JWT authentication: all API calls require a valid, time-limited JSON Web Token. Tokens are stored securely on-device (encrypted AsyncStorage on mobile, browser localStorage on web).
• •Webhook signature verification: payment provider webhooks are verified using HMAC-SHA512 signatures (Paystack) and shared-secret headers (RevenueCat) before any data is acted upon.
• •Encrypted transport: all data is transmitted over HTTPS/TLS.
• •Rate limiting: API endpoints are rate-limited to prevent abuse.

No method of transmission or storage is 100% secure. If you believe your account has been compromised, contact us immediately at privacy@lingofrica.com.

• •Authenticated accounts: retained while your account is active. When you request deletion, a 30-day grace period begins during which you can cancel by simply signing back in.
• •Query history: retained while your account is active; deleted with your account.
• •Payment records: subscription status and plan records are retained for as long as required by applicable tax and financial regulations (typically 7 years under Kenyan law), even after account deletion. Raw payment instrument data is never held by us.
• •Email subscriber list: retained until you unsubscribe or delete your account.

Depending on your jurisdiction, you may have the following rights regarding your personal data. We honour these rights for all users, regardless of location.

• •Access: request a copy of the personal data we hold about you.
• •Correction: update inaccurate or incomplete data (e.g. display name, preferred language) directly in the app settings.
• •Deletion: delete your account from the app settings. This initiates a 30-day countdown after which all your data is permanently erased. You can cancel the deletion by signing back in during this window.
• •Portability: request an export of your data in a machine-readable format.
• •Objection: object to processing based on legitimate interests (e.g. marketing emails). Use the unsubscribe link in any email or contact us.
• •Withdraw consent: for consent-based processing (marketing), withdraw at any time without affecting the lawfulness of prior processing.

To exercise any right, email us at privacy@lingofrica.com. We will respond within 30 days. We may need to verify your identity before acting on your request.

The Weche web app does not use advertising cookies or third-party tracking cookies.

We use browser localStorage only for:

• •Your authentication session token (so you stay signed in across page loads).
• •Your selected language and onboarding state (so the app remembers your preferences).
• •Your local daily query count (to show you how many queries remain without a server round-trip).

This data stays on your device and is not shared with third parties.

Weche is not directed at children under the age of 13 (or 16 in the EU/EEA). We do not knowingly collect personal data from children. If you believe a child has provided us with their personal data, please contact us and we will delete it promptly.

Our infrastructure is primarily based in the EU (Supabase on AWS eu-west-1). Some data may be transferred to the United States or other countries when we use third-party services such as Google Gemini, Tavily, RevenueCat, and Resend. These providers are bound by their own compliance frameworks (including EU Standard Contractual Clauses where applicable). By using Weche, you acknowledge that your data may be transferred internationally.

We may update this policy from time to time. When we make material changes, we will update the effective date above and, where appropriate, notify you by email or in-app notice. Your continued use of Weche after a policy change constitutes your acceptance of the updated policy.

We encourage you to review this page periodically. The current version will always be available at https://weche.lingofrica.com/privacy.

If you have questions, concerns, or requests regarding this policy or your personal data, please reach out:

If you are located in Kenya and are unsatisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke. EU residents may contact their local Data Protection Authority.