Privacy Policy

STEM Concepts Limited ("STEM Concepts", "we", "us") is a premium chauffeur and transfer service registered in Kenya. We are committed to protecting your personal data in accordance with the Kenya Data Protection Act, 2019 (DPA) and applicable international standards including the EU General Data Protection Regulation (GDPR) where relevant.

Contact: privacy@stemconcepts.co.ke

We collect only what is necessary to provide and improve our service:

• Account data — name, email address, phone number (when you register or enquire)
• Booking data — pick-up/drop-off locations, travel dates, passenger count, flight numbers
• Payment data — processed by our payment partners; we never store raw card numbers
• Communication data — messages sent through our chat or contact form
• Technical data — IP address, browser type, pages visited (analytics, if consented)

• Contract performance — processing bookings and managing your account
• Legitimate interest — fraud prevention, security, service improvement
• Consent — analytics cookies and marketing communications (you may withdraw at any time)
• Legal obligation — tax records, KRA compliance, court orders

We use the following categories of cookies:

• Essential — Required for the site to function. Includes your authentication session (managed by Clerk, HttpOnly and Secure) and our booking flow state. Cannot be disabled.
• Analytics — Anonymised data about how visitors use the site (e.g. pages visited, session duration). Only set with your consent.
• Marketing — Used to show you relevant promotions. Only set with your consent.

You can change your cookie preferences at any time by clicking "Manage" in the cookie banner or clearing your cookies in browser settings.

• Process and confirm your transfer bookings
• Send booking confirmations and driver details via email/SMS
• Respond to enquiries through our chat and contact form
• Maintain your account and booking history
• Detect and prevent fraud or abuse
• Comply with regulatory and tax obligations
• Improve our platform and service quality (with your consent)

We do not sell your data. We share it only with:

• Supabase — secure database infrastructure (EU/US servers with data encryption)
• Clerk — authentication and identity management
• Google — Maps API for route display; Gemini AI for chat assistance
• Payment processors — PCI-DSS compliant third parties
• Drivers — only name and contact details necessary for your transfer
• Authorities — where required by Kenyan law

Account and booking data is retained for 7 years to meet Kenya Revenue Authority requirements. Chat messages are retained for 2 years. Analytics data (if consented) is retained for 13 months. You may request deletion of non-legally-required data at any time.

Under the Kenya Data Protection Act and GDPR (where applicable), you have the right to:

• Access a copy of your personal data
• Correct inaccurate data
• Request deletion ("right to be forgotten")
• Withdraw consent at any time (without affecting prior processing)
• Data portability in a machine-readable format
• Object to processing based on legitimate interest
• Lodge a complaint with the Office of the Data Protection Commissioner (Kenya)

To exercise any right, email privacy@stemconcepts.co.ke. We respond within 30 days.

All data is transmitted over HTTPS (TLS 1.2+). Authentication sessions use HttpOnly, Secure, SameSite=Lax cookies. We enforce rate limiting, bot filtering, and Content Security Policy headers on every request. Access to production data is restricted by role-based access control.

We may update this policy as our services evolve or regulations change. Material changes will be notified via email (if you have an account) or a notice on this page. Continued use of our service after changes constitutes acceptance.