Privacy Policy

1. Who we are

Safubi, Nairobi, Kenya ("Safubi", "we", "us") provides Safubi Antivirus, Safubi DNS and Safubi VPN. We are the data controller for the personal data described here under the Kenya Data Protection Act, 2019 and, for people outside Kenya, under the data protection law of the country where they live. Contact: support@safubi.com.

2. Safubi Antivirus (Windows app)

Scanning happens on your PC. Files, scan results and quarantine stay on your device. The app contacts the internet only to download signature and blocklist updates and, if you use the VPN, to talk to your Safubi account. We do not upload your files.

3. Safubi DNS and VPN

• Account data: name, email address and a securely hashed password.
• DNS queries: the domain names your devices look up, needed to decide whether to block them. Allowed lookups are never stored. For each profile you choose whether blocked lookups are logged (domain, time and reason) or nothing is logged. Daily totals of queries and blocks are kept for your dashboard.
• Linked IP addresses: the public IP you link to a profile, so we can apply your settings.
• VPN (Windows and Android apps): each device's model name, WireGuard public key and assigned tunnel address, and which location it connects to. The VPN uses Android's VpnService only to encrypt your traffic to a Safubi server and filter harmful sites; it never changes other apps' traffic for advertising or money. Your private key is created on your device and never sent to us. We do not log the websites you visit over the VPN beyond the DNS logging you chose.
• Scam check (website and apps): when you ask Safubi to check a message, the text (and the sender, if you add it) is sent to our server, analysed automatically by the Safubi AI and then discarded - we don't store it, only a daily count of checks. If a scam message contains a link that imitates a known company, that website address (not your message) is added to Safubi's block list. If you tap "It was a scam" or "It was safe", that message is kept so our team can review it and use it to improve the AI; please remove personal details you don't want to share before reporting. You can ask us to delete a report at any time.
• Payments (when available): M-Pesa transaction references and phone numbers, handled with our payment provider.

Website analytics

safubi.com uses Google Analytics to count visits and see which pages are useful (for example pages viewed, approximate country, device and browser type). It uses cookies, and Google processes this data on our behalf under its own privacy terms. We don't use it for advertising and it is not used inside the Safubi apps. You can block it with your browser's privacy settings or Google's opt-out add-on (tools.google.com/dlpage/gaoptout).

4. Why we use it (lawful basis)

To provide the service you signed up for (contract), to keep the service secure and prevent abuse (legitimate interest), and to meet legal obligations such as tax records.

5. Retention

The blocked-site log keeps only the most recent 500 entries per profile; older entries are deleted automatically. Daily statistics are kept while your account is active. You can delete your account at any time in the Safubi app or at app.safubi.com/delete-account. Your account and its data are deleted immediately; server backups that contain them are overwritten within 14 days, except records we must keep by law.

6. Sharing and where your data is stored

We never sell your data and never use it for advertising. We share it only with service providers that run parts of our service for us under contract, and only as much as they need:

• Server hosting (Vultr): our servers are in Johannesburg, South Africa, and New York, USA - your account and settings are stored in South Africa; the VPN location you choose handles your traffic.
• Email (Namecheap Private Email): to send you messages such as password-reset links.
• Payments (when available, e.g. Safaricom M-Pesa): to process your payments.
• Authorities: only when the law requires it, and we push back on requests that are not lawful.

Because our servers are outside Kenya, your data is transferred abroad. We do this with appropriate safeguards (contracts, encryption and access controls) as the Kenya Data Protection Act and similar laws require.

7. Your rights

Wherever you live, you can ask to access, correct, download or delete your personal data, object to or restrict how we use it, and withdraw consent where we rely on it. Email support@safubi.com; we reply within 30 days. You can also complain to the data protection authority where you live - for example the Office of the Data Protection Commissioner (Kenya), the Personal Data Protection Office (Uganda), the Personal Data Protection Commission (Tanzania), the National Cyber Security Authority (Rwanda), the Nigeria Data Protection Commission, the Information Regulator (South Africa) or the Data Protection Commission (Ghana).

8. Security

Encrypted connections (HTTPS, DNS-over-HTTPS/TLS, WireGuard), hashed passwords and restricted server access.

9. Children

Accounts are for adults. Parents and schools may use Safubi to protect children's devices; in that case the account holder is responsible for informing the users.

10. Changes

We will post updates here and email account holders about significant changes.