Privacy Policy — Bikwayé

⚖️ Draft to be validated by a lawyer. Version [0.1 — draft], last updated [publication date]. This English version is a translation of the French text, which prevails in case of discrepancy.

Bikwayé is published by Kamersoft (“we”). This policy explains which data we process when you use the Bikwayé app, why, with whom, for how long, and what your rights are. It applies together with the Terms of Use.

Bikwayé is offered in Cameroon, Côte d'Ivoire, Senegal, Burkina Faso, Mali and Niger. This policy is drawn up under the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), which applies because the publisher and its servers are established in France, and under the personal data protection law of each of these countries:

• Cameroon: Law No. 2024/017 of 23 December 2024;

• Côte d'Ivoire: Law No. 2013-450 of 19 June 2013;

• Senegal: Law No. 2008-12 of 25 January 2008;

• Burkina Faso: Law No. 001-2021/AN of 30 March 2021;

• Mali: Law No. 2013-015 of 21 May 2013;

• Niger: Law No. 2017-28 of 3 May 2017, as amended by Law No. 2019-71 of 24 December 2019.

1. Who is responsible

The data controller is Kamersoft, the publisher of Bikwayé. For any question about your data or to exercise your rights: contact@kamersoft.net. The data protection contact is reached at the same address.

2. What we collect, and why

2.1 Your account

Bikwayé has no password. Your account is identified by your phone number, proven at every sign-in by a one-time code sent by SMS. We also keep a technical identifier of your device, your country, the status of your account and your sign-in dates. A “guest” account, without a reachable number, can be created to browse listings.

Why: to let you use the service and to secure access to your account.

2.2 Your profile

What you choose to put in it: display name, photo, description, business sector and, for a business, its company name and details. Your contact details (phone, email, social networks) are shown only to the people you have chosen for each of them: all signed-in members, only the members you have already exchanged messages with, or nobody (the default setting).

Why: to present your identity to other members and build trust; to verify a business that asks for it.

2.3 Your listings and your media

The content of your offers and requests (title, description, characteristics, price, city), your photos, videos and voice messages. From the text of your listings we compute a numerical fingerprint (“embedding”) used for search and recommendations; this computation runs on our own servers.

Your videos are reduced to 720p and limited to 60 seconds, your voice messages to 3 minutes. On a video we measure the moments when someone speaks, only to lower the background music during the voice.

Why: to publish your listings and help people find them.

2.4 The listing creation assistant

When you start the assistant, the photos, the video (a few frames and its sound track) or the voice message you provided are sent to a third-party artificial intelligence service, Google Gemini, which returns a proposal: category, title, description, characteristics, transcription of your voice. We send it neither your name, nor your number, nor any account identifier. You review and correct the proposal before publishing; nothing is published without you.

This service is hosted outside Africa (see §5). You can always create a listing without the assistant.

Why: to save you time when creating a listing.

2.5 The voice corpus — only with your separate consent

To make transcription better for the way we speak (French, English, Camfranglais, accents), we wish to keep some voice messages with their corrected transcription in order to evaluate, then train, a model that belongs to us. This is a separate purpose from creating your listing: we do it only if you explicitly agree, through a separate setting that you can withdraw at any time in the app.

If you withdraw your consent, we delete your recording and its entry in the corpus. We must be honest about one limit: a model already trained on your recording cannot “unlearn” it; withdrawal prevents any future use, it does not undo past training.

See the consent text.

2.6 Your exchanges

Your conversations and messages with other members, your blocks and your reports; your lives (title, products shown, chat, reactions, gifts) and, if you asked for it, the recording of your live, kept for 30 days.

Why: to enable exchanges, messaging safety and replays.

2.7 Your interactions

Favourites, likes, comments, ratings, shares, follows, and the history of the listings you view, which feeds the “for you” feed and the sellers' view counters (without revealing to them who looked).

2.8 Your orders and your wallet

When a listing accepts direct orders: the order (quantity, price, delivery method, delivery address), the escrow of the payment until delivery, your wallet (balance, transactions), your payment methods, your withdrawals, your promotion purchases (“boost”). A card number is never kept: only its last four digits are. A mobile money number or a bank account number is kept, because it is used to pay you, and is only shown to you masked. The final payment provider will be named here before any real money flow: [provider, country].

2.9 Notifications

A device token used to send you notifications (message received, order, live). They go through Google Firebase Cloud Messaging. You control them in the app.

2.10 Reports, incidents and moderation

When you report content or tell us about a problem: your report, your screenshots and a technical diagnosis of your device (model, system version, app version, language, screen you reported from). The moderation decisions that concern you and their reasons.

2.11 Technical data

Our servers' logs (IP address, pages requested, timestamps, account identifier when you are signed in) and a counter of request frequency per account or per IP address, which we use to block abuse.

2.12 Your location and your address

If you allow it, Bikwayé reads the approximate location of your phone. On the device it is used to suggest nearby cities first and, when you filter by distance or sort by proximity, it is sent rounded to about 1 km, for that search only: we do not keep it. Without it, distance is measured from your profile address. The point you place on the map of a listing or of your profile is part of your address.

Maps come from third-party providers, which receive your phone's IP address and the area shown:

• the map where you place the point of a listing or of your profile loads its images from the OpenStreetMap servers, and its display library (Leaflet) from the unpkg service;

• the map on a listing's page is a Google Maps map.

When a neighbourhood is not yet known, our servers look it up on OpenStreetMap (Nominatim): only its name is sent, neither your IP address nor your identity.

Why: to locate your listings and find those near you.

3. On what basis

• The performance of the contract between us (the Terms of Use) for everything that makes the service work: account, profile, listings, media, assistant, messaging, lives, orders, service notifications.

• Your consent, specific and revocable, for the voice corpus (§2.5) [and for any promotional notification].

• Our legitimate interest in securing the platform: moderation, technical logs, rate limiting, audit trail of administration actions.

• Our legal obligations [accounting, requisitions] for financial transactions.

[The lawyer confirms or corrects each basis.]

4. Who sees your data

• Other members: your public profile, your published listings, your comments and ratings, your messages (for their recipients), your lives (according to the access you chose), your contact details according to the visibility you set.

• Our moderation team, through a back office where every action is logged in a tamper-proof way — including viewing that log.

• Our service providers, who act only on our behalf: SMS delivery (Twilio), AI assistant (Google Gemini), push notifications (Google Firebase), maps (Google Maps, OpenStreetMap, unpkg) and neighbourhood search (OpenStreetMap), [payment provider].

• The authorities, when the law requires us to.

We do not sell your data and do not hand it over to anyone for advertising purposes.

5. Where your data is, and transfers outside your country

Our servers are hosted in France, by the publisher itself. SMS, the AI assistant, notifications and the Google Maps map go through providers established in the United States; OpenStreetMap maps and neighbourhood search are provided by the OpenStreetMap Foundation, in the United Kingdom. In each country where the service is offered, these transfers are subject to the formalities its law provides (authorisation or declaration to the data protection authority); in Cameroon, they are the subject of an application for authorisation to the Personal Data Protection Authority (art. 32 of Law No. 2024/017) [reference and date of the authorisation once obtained]. They are also covered by contractual safeguards with each provider. From our servers in France, they rest on the European Commission's adequacy decisions or its standard contractual clauses.

We are working to bring hosting and AI models closer to Africa; this policy will be updated at each change.

6. How long

When you ask for your account to be deleted, it is closed at once: you are signed out of all your devices and your content stops being visible. Thirty days later, your data is erased: account and number, profile, listings and their files, messages (the people you talked to no longer see them), comments, ratings, follows, favourites, history, payment methods, drafts, and the tickets and reports you filed. During those thirty days, signing back in with an SMS code cancels the request. Deletion is refused while an order is in progress or your wallet holds money: a member's money does not disappear with the account.

We keep what the law requires us to keep, without your name or your number: your wallet transactions and your orders, ten years (accounting obligation), and the log of administration actions, five years [legal basis to be confirmed]. Backup copies disappear on their own within five weeks.

7. Your rights

You may, at any time:

• access the data we hold about you and obtain a copy [procedure];

• correct your profile, your listings and your contact details directly in the app;

• delete your account, in the app (Profile → Privacy) or at www.kamersoft.net/en/bikwaye/account-deletion, without installing the app (see §6);

• withdraw your consent to the voice corpus (dedicated setting) and manage your notifications;

• object to processing based on our legitimate interest, on grounds relating to your situation;

• ask for the portability of your data or the restriction of a processing;

• lodge a complaint with the CNIL (www.cnil.fr), the supervisory authority of the publisher, established in France, or with the data protection authority of your country: in Cameroon, the Personal Data Protection Authority; in Côte d'Ivoire, the ARTCI; in Senegal, the Personal Data Protection Commission (CDP); in Burkina Faso, the Commission de l'informatique et des libertés (CIL); in Mali, the Personal Data Protection Authority (APDP); in Niger, the High Authority for Personal Data Protection (HAPDP).

To exercise a right: contact@kamersoft.net. We reply within one month.

8. Security

Sign-in by one-time code and lock-out after several failures; short-lived tokens stored in your phone's secure storage; encrypted communications (HTTPS, HSTS); ownership check on every write; administration access restricted to authorised accounts and logged; regular backups. No system is infallible: we will inform you of any data breach that concerns you, as the law requires.

9. Minors

Bikwayé is reserved for people aged [18] and over. If we learn that an account belongs to a minor, we delete it.

10. Changes

We may change this policy. Any substantial change is announced to you in the app before it applies; the date at the top is authoritative.