Privacy Policy

Last updated: 20 September 2026

This policy explains what personal data SawaBite collects, why we collect it, who sees it, and the choices you have. We process personal data in line with the Kenya Data Protection Act, 2019.

1. Who we are

SawaBite operates SawaBite and is the data controller for the personal data described here. You can reach us at support@sawabite.com.

2. What we collect

• Account details: your username, email address, a scrambled (hashed) version of your password, the time you accepted our terms, and whether you have confirmed your email. We never store your password in readable form.
• Your food activity: the plates you save, and the weekly timetable you build (Pro).
• Consultation requests: if you ask to be matched with a dietitian, we collect your health goal, age, weight, phone number and budget. This can be sensitive information about your health, so we only collect it with your consent (you tick a box before sending).
• Payment details: for Pro upgrades paid by M-Pesa, the M-Pesa confirmation code, the phone number you paid from, the amount and the status. We never see your M-Pesa PIN.
• Messages: your name, email address and message when you use the Contact form.
• Technical data: your IP address and the time of certain actions (signing in, registering, contact messages, password resets, searches for new ingredients). We use this to prevent abuse and to keep the service secure.

3. Why we use your data

• To provide the service you asked for: your account, saved plates, timetable, macros and Pro features (performance of a contract).
• To connect you with a dietitian and share your request with the dietitian you choose (your consent).
• To verify payments and activate Pro (performance of a contract, and keeping financial records as the law requires).
• To send service emails such as email confirmation and password reset links, and to reply to your messages.
• To protect the site against fraud, abuse and unauthorised access (our legitimate interests).

We do not use your personal data for advertising, and we do not sell it.

4. Who we share it with

• The dietitian you choose. When you select a dietitian, they receive the details from your consultation request so they can contact you. Other dietitians do not see it.
• Service providers that help us run the site, such as our web hosting and email delivery providers. They may only use the data to provide their service to us.
• Google (Gemini). When you search for an ingredient we have not seen before, only the ingredient text is sent to Google's AI service to generate a pairing. Your name, email and other account details are not sent.
• Content delivery. Pages load fonts, styling and some images from third-party servers (for example Google Fonts). Those providers can see your IP address and browser details when your browser requests those files.
• Authorities, where the law requires it or to protect rights, safety and security.

Brand sponsors shown on the site do not receive your personal data.

5. Cookies

We use only the cookies the site needs to work: session cookies that keep you signed in and protect forms against forgery. Member sessions last up to 14 days (or until you sign out) and are also ended after a period of inactivity. We do not currently use advertising or analytics cookies. If that changes, we will update this policy and ask for your consent where the law requires it.

6. How long we keep data

• Account and food data: while your account is open. Ask us to delete your account and we will remove it, apart from the records below.
• Rate-limit records (IP addresses and timestamps used to stop abuse): deleted automatically after a couple of days. Administrator audit logs are kept for security purposes.
• Payment records: kept for as long as tax and accounting law requires.
• Contact messages and consultation requests: kept for as long as needed to deal with your request and any follow-up, then deleted.

7. How we protect your data

We use encrypted connections (HTTPS), store passwords only as salted hashes, limit administrator access, throttle repeated sign-in attempts, and record administrator actions in an audit log. No system is perfectly secure, so please use a strong, unique password and keep it private. If a breach affects your data, we will notify you and the Office of the Data Protection Commissioner as the law requires.

8. Your rights

Under the Data Protection Act, 2019 you have the right to:

• be told how your data is used, and ask for a copy of it;
• ask us to correct data that is wrong or incomplete;
• ask us to delete your data, or restrict how we use it;
• object to certain uses, and withdraw consent at any time (this does not affect what we did before you withdrew);
• receive your data in a common format where that applies.

To use any of these rights, contact us using the details above and we will respond within the time the law allows. If you are unhappy with our response, you can complain to the Office of the Data Protection Commissioner of Kenya (www.odpc.go.ke).

9. Children

SawaBite is for people aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a child has given us data, please contact us and we will delete it.

10. Data stored outside Kenya

Some of our providers, including Google and our hosting or email providers, may process data on servers outside Kenya. Where that happens we take steps to make sure your data is handled with appropriate safeguards.

11. Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last changed. If we make important changes we will let you know on the site or by email.