Private invitations deserve careful data.

Kadiraha is a Tanzania-based event experience and guest-management service. In this notice, “Kadiraha”, “we” and “us” refer to the service operated under the Kadiraha name.

For organizer accounts, platform security and direct enquiries, Kadiraha determines why and how relevant personal data is processed. When an organizer supplies a guest list and instructs us to prepare or deliver invitations, the organizer remains responsible for that guest relationship and Kadiraha processes the information to provide the requested event service.

• Organizers, hosts and authorized event-team members who use the workspace.
• Guests and household members named on an event list or using a private invitation or pass.
• People who contact Kadiraha, request support or visit the public website.

Guests do not need to create a Kadiraha account to open an invitation or submit an RSVP.

• Organizer information: name, email address, authentication records, organization membership, permissions and support correspondence.
• Event information: hosts, occasion, dates, programme, venue, guest estimates, language and operational settings.
• Guest information: name, honorific, phone number, email where supplied, preferred language, household or party details, guest category, personal invitation note, RSVP, seating, access and arrival status.
• Creative material: design briefs, wording, reference links and photographs voluntarily supplied for an event identity.
• Delivery information: approved message content, destination number, provider identifiers and delivery, read, failure or opt-out status.
• Technical and security information: essential cookies, session identifiers, request metadata, device/browser details, IP address and minimized audit or error logs that may be processed by our hosting and security providers.

Organizers should avoid recording sensitive information unless it is necessary for the event and they are entitled to provide it. Details such as accessibility or dietary needs must be limited to what is genuinely required.

• Directly from organizers, hosts and authorized team members.
• From a guest when they answer an invitation, change an RSVP or communicate with the hosts.
• From spreadsheets or records an organizer lawfully imports.
• From service providers when they return authentication, message-delivery, storage or security events.

• Create and operate event workspaces, guest lists and role-based access.
• Design personalized invitations, artwork and private guest passes.
• Deliver approved messages and reconcile whether they were sent, delivered, opened or answered.
• Record RSVPs, party sizes, seating, access and check-in.
• Provide support, prevent duplicate or unauthorized actions and keep an audit trail of high-value operations.
• Protect guests, organizers and the platform from fraud, abuse and security incidents.
• Meet applicable legal, regulatory and accounting duties.

We do not sell guest lists or use private event information for third-party advertising.

Depending on the interaction, we process information to perform an agreement with an organizer, follow the organizer’s lawful instructions, act with consent, protect legitimate service and security interests, or comply with a legal obligation. Guests may withdraw consent where consent is the applicable ground, although this does not undo processing already lawfully completed.

• The organizer and only those event-team members whose assigned role requires access.
• Supabase for authentication, PostgreSQL records and private file storage.
• Vercel for application hosting, delivery and operational logs.
• Meta and WhatsApp when an organizer authorizes WhatsApp delivery.
• Future communications, monitoring or support providers only when enabled and necessary for the service.
• Regulators, courts or public authorities where disclosure is legally required.

Providers act under their own terms and privacy obligations. Kadiraha limits the information sent to each provider to the service being performed.

Some technology and communications providers may process information outside Tanzania. Where personal data crosses borders, Kadiraha will use the transfer basis and safeguards required by applicable Tanzanian data-protection law and will limit the transfer to a justified service purpose.

Information is kept only while it is needed to operate the event, provide the contracted service, resolve disputes, secure the platform or meet legal duties. Organizers can request event or account deletion. Invitation tokens may be revoked and replaced; Kadiraha stores only their cryptographic fingerprints. Provider backups and legally required audit records may take additional time to expire or may be retained in minimized form where deletion is not legally permitted.

Kadiraha uses access controls, authenticated organizer sessions, tenant isolation, private storage, expiring file links, encrypted transport, role-based permissions and minimized audit records. Private guest links are unguessable bearer credentials and should not be forwarded. No online service can promise absolute security; suspected misuse should be reported immediately through our contact page.

• Ask whether we hold personal data about you and request access.
• Request correction of inaccurate or incomplete information.
• Request deletion or restriction where applicable.
• Object to direct marketing or other processing where the law provides that right.
• Withdraw consent where processing depends on consent.
• Raise a concern with Tanzania’s Personal Data Protection Commission.

Use the data-deletion instructions or email japhetjovan@gmail.com. We may need enough information to verify the request without exposing another person’s event data.

Kadiraha is not directed to children as account holders. An organizer may include a child as part of a family or household invitation. The organizer must have appropriate authority, and only the minimum information needed for the event should be supplied.

The application uses essential cookies for authentication, session continuity and security. Kadiraha does not currently place third-party advertising cookies. If non-essential analytics or marketing technologies are introduced, this notice and any required consent controls will be updated before they are enabled.

We may revise this notice as the service or law changes. The effective date above identifies the current version. Material changes will be communicated through an appropriate service channel.

Privacy questions may be sent to japhetjovan@gmail.com. Kadiraha operates from the United Republic of Tanzania.