Privacy
Last updated 3 November 2026.
Album is operated by WP FOSS LIMITED, trading as Album, a company registered in Kenya.
We are registered with the Office of the Data Protection Commissioner under the Data Protection Act 2019, as Data Controller and Data Processor, registration number 507-1539-1BAA.
We are the data controller for your account: your name, your email address, your telephone number, what you paid and when. We are a data processor for what is inside your album: the photographs, the stories, the records of your people and the private sections are yours, held on your instructions, and we do not decide what they are for.
Only what the service needs. We do not buy information about you from anybody and we do not build a profile of you.
| What | Why we have it | Lawful basis |
|---|---|---|
| Your name, email address and telephone number | To create your album, to let you sign in, to send you a sign-in code, and to write to you about your album and its renewal | Performing our contract with you |
| Your KRA PIN, only if you add one at checkout for a VAT invoice | To put it on the tax invoice for your payment, which we file with KRA | Our legal obligation to keep accounts and file tax invoices |
| What you paid, when, and how, with the M-Pesa reference or the last four digits of a card | To take payment, to account for it, and to answer a question about a payment | Contract, and our legal obligation to keep accounts |
| The registrant details for a domain name: the registrant’s full name, postal address, town, county, country, email and telephone, and an organisation name where there is one | Because a domain name must be registered to a real, identified person. We pass them to our registrar and to KENIC for that purpose alone | Contract, and our legal obligation as a registrar’s customer |
| Everything inside your album: photographs and the information in them, names, dates, roles, stories, documents | Because it is your album and this is what it is for | Contract. We hold it on your instructions |
| Sensitive information you choose to put in a private section: confidential documents, and anything personal a person chooses to add | Because a school asked to be able to keep them in one safe place | Your explicit consent, given by choosing to enter them. You can delete them at any time |
| Who you invite, and what each of them may see | To let the right people in and keep everybody else out | Contract |
| Records of signing in, and of changes made in your album | To show you who did what, and to notice somebody trying to get in. Sign-ins are also recorded centrally at wpfoss.ke with your name or email, role, site and time, and kept 365 days | Our legitimate interest in keeping your album secure |
| A message you send through our contact form: your name, email address, telephone if you give one, and what you wrote | To answer you | Our legitimate interest in answering a question you asked us |
| If you apply to sell Album: your name, email address, M-Pesa number and the name it is registered to, your national ID or passport number, where you plan to share Album, and when you agreed to the terms. If we ask for them, also a copy of your ID or passport and your KRA PIN | To decide your application, to know who we are paying, and to pay you. In public, on your link page and to the families you bring, you are shown only by your first name and initial, like "Neema B."; your full name, ID number and M-Pesa number are seen by our team only | Taking steps you asked for before a contract, and then the contract itself |
| Your email address, and telephone if you give one, on our list for occasional emails: when you subscribe, ask for our guide, start buying an album or buy one | To send you occasional emails from us. Every one carries an Unsubscribe link: press it, then press Unsubscribe on the page it opens, and you are off the list. No sign-in is needed. The two reminders we send if you start buying an album and do not finish are different: each is sent once, and then they stop by themselves, as the emails say | Your consent when you subscribe. For somebody who started buying or bought, our legitimate interest in writing to our own customers. Either way you can unsubscribe at any time |
| A copy of each email we send you, exactly as it went: the address, the subject, what it said, and whether it went. Never a sign-in code | We keep a copy of the emails we send you for 12 months to check they are right, then delete them | Our legitimate interest in making sure our emails are right and arrive |
| A record that a page of our public website was visited: which page, which of our websites, the country, the website that sent you (if any), and a one-way code made from the address and browser that changes every day | To know whether anybody is reading our own pages | Our legitimate interest in understanding our own website. This record holds no IP address and cannot be traced back to a person |
What is never inside an album: no advertising, no tracking tags, no analytics of any kind. We do not look at which photographs anybody opens, and we do not follow anybody around inside an album.
What we do count. To help you, and to know when to write to you, we count the photographs, videos, stories, people and members in a school album, the date something was last added, and the date somebody last signed in. Our team sees these counts. We do not count what anybody looks at.
The public demo albums. The demo albums are the only albums anybody can walk into, and they belong to nobody real. They count visits and what visitors try (arriving, adding a photograph, pressing a button the demo keeps shut), using a one-way daily code and no IP address, and keep this for 90 days.
We use a small number of other companies to run the service. Each is given only what it needs to do its part. Our suppliers are bound by contract to keep it confidential and not to use it for anything of their own. Three below are different, and we say so: Google and YouTube, which you choose to use, and OpenStreetMap, a free public service we have no contract with.
| Who | What they handle | Where |
|---|---|---|
| Our hosting and storage provider | Running the service, and storing your photographs | Outside Kenya |
| Our hosting provider's person check | Only on our buying, paying, contact, subscribe and seller application forms: a check that a person, not a program, sent the form. It looks at how your browser behaves, not at what you type, and is not used for advertising | Outside Kenya |
| Our card payment processor | Card payments. Card details are entered with them and never reach us | Outside Kenya |
| GitHub, Inc. (owned by Microsoft) | Keeps an encrypted copy of our database, photographs and other files for up to 15 days, renewed every week, outside our main provider, so that albums can be recovered if that provider fails. Only we can open it | Outside Kenya |
| Safaricom | M-Pesa payments. We receive the reference and the amount, never your PIN | Kenya |
| Our email provider | Sending email: sign-in codes, welcome letters, renewal reminders | Outside Kenya |
| Our accounting software | Keeping our books, and the tax invoice for each payment that we file with KRA: the name, email, telephone and postal address given at checkout (or the organisation bought for), your KRA PIN if you gave one, and what you paid, when and how | Outside Kenya |
| Our domain registrar, and KENIC | Registering a domain name in your name. They receive the registrant details listed above. Some of those details may appear in the public registry record for the name, which is how domain registration works everywhere | Kenya |
| Tag Manager always, and Google Analytics once you press Accept, on the public pages of album.africa and album.ke, never inside an album. Otherwise only if you use it. Importing from Google Photos: we see only the photographs you choose, for that visit. Connecting your own Google Drive: we may write the files we create and nothing else. See "Photographs and files from Google" below | Outside Kenya | |
| YouTube (Google) | Only if an album has videos. Videos stay on the YouTube account of the person who added them; we keep only the link. Opening the Videos tab loads each video's picture from YouTube, and pressing play loads YouTube's player, so YouTube sees that visitor's browser, as on any website. The player is YouTube's privacy-enhanced one | Outside Kenya |
| OpenStreetMap (Nominatim) | To find a place name for a photograph. We send it the position where the photograph was taken, rounded to about 11 metres, or the place you type when you search for one. We never send the photograph, a name or an email address. A free public service: we have no contract with it | Outside Kenya |
If you want to know exactly who these companies are, write to hello@album.ke and we will tell you. The law asks us to describe who receives your information, which is what the table above does; it does not ask us to publish the list of suppliers we have built the service on, and we would rather not hand that to a competitor.
On album.africa and album.ke, our own public marketing pages use Google Tag Manager, which runs Google Analytics and the Meta Pixel only after you press Accept (see "Cookies, Tracking and Activity Monitoring" below). The page where you renew and the form to sell Album carry none, and no family album on any site carries any.
If somebody introduced you to Album and is paid a share, they can see that you are their customer: your school or album name, the email address and telephone number you gave when buying, your plan and your renewal date. They cannot open your album. Tell us and we will stop showing them your details.
We do not sell your information. We do not share what is in your account or your album for advertising. We give it to the authorities only where the law actually requires it, and we tell you when we are allowed to.
Importing from Google Photos. When you press Import from Google Photos, you sign in to Google and choose photographs in Google's own picker. Album is given access only to the photographs you chose, only for that visit. We copy them into your album, where they are kept like any photograph you upload, and nothing else in your Google Photos is ever seen. We do not keep the permission Google gives us: it expires within the hour and is never stored.
Connecting your Google Drive. If you connect your own Google Drive, Album may create and write the files for your album's copy there, and cannot see any other file in your Drive. You can disconnect it in Settings, or from your Google account, at any time.
We use what we receive from Google only to do what you asked: bring your chosen photographs into your album, or keep a copy of your album in your Drive. We do not use it for advertising, we do not sell it, we do not use it to train any artificial intelligence, and people at Album do not look at it unless you ask us to for support or the law requires it.
Album's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Some of the companies above are outside Kenya, so running the service means your information is processed outside Kenya. The Data Protection Act allows this where there are appropriate safeguards, and we require our suppliers by contract to protect your information to the standard the Act demands. OpenStreetMap, a free public service, has no contract with us, which is why all it is sent is the position of a photograph, never the photograph, a name or an email address.
Your photographs themselves are held outside Kenya. If that matters to you, say so before you buy and we will tell you exactly where things stand.
| What | How long |
|---|---|
| Your album and everything in it | While you have an album with us |
| An album that is unpaid and private | 12 months, then a last letter, then we delete it |
| An album you ask us to delete | Removed at once. Gone from the backups within 90 days |
| Records of payment | 7 years, which is what Kenyan tax law requires |
| Registrant details for a domain name | While the name is registered through us, and 2 years after it ends, in case the registration is ever questioned. Then the person is removed from them: the name, address, telephone and email go, and only the record that a name was registered stays, for our accounts. A name ends when it runs out and is not renewed (including when your album moves to another name), when it could not be registered (counted from the last time we tried or changed its order, or from when you paid if the name was taken before we could order it), or when its album is deleted (counted from 400 days after the deletion, the longest a name we renewed could still run). If you never paid and no name was registered, they are removed 1 year after you gave them |
| Sign-in codes | Each works for 10 minutes, and is deleted within a day |
| Records of signing in and of changes in an album | 1 year. Two kinds are kept for as long as the album exists: the record of something somebody agreed to or chose (an owner's details given through our form, which holds the name, email and telephone they gave, when they agreed, and the IP address and browser they used, as proof that they agreed; who may see a private section, and every request to open private records after a death and its answer), and the few notes the album needs to keep working (that it was cancelled, a letter about an unpaid album, a renewal of its domain name or a change to its order, that the app was installed) |
| Our own team's record of what they did in our operating tools | 1 year. For anything about money (a renewal, a refund, a payment to a seller, a name bought or renewed, a seller approved or stopped) and for the record that an album was deleted or its address changed, 7 years, which is what Kenyan tax law requires |
| A record that a public page was visited | 90 days |
| Email we have exchanged with you, and messages from our contact form | 2 years after the conversation ends |
| A copy of an email we sent you | 12 months |
| Your address on our list for occasional emails | Until you unsubscribe. After that we keep the address with a note that you unsubscribed, so that we never write to it again by mistake, unless you subscribe again yourself. Buying an album later does not put you back on the list. Ask us and we will delete it altogether |
| An application to sell Album that we approved | While you sell Album, and 7 years after, because we paid you and tax law asks us to keep the records. If we stop your selling, we delete your ID or passport number, and any copy of your ID or passport you sent us, 7 years after the day we stopped it. A KRA PIN, if we asked for one, is a tax record and stays with the records of what we paid you for the same 7 years; the rest of the record stays as long as the law asks |
| An application to sell Album that we declined | Your ID or passport number, and any copy of your ID or passport or KRA PIN you sent us, is deleted the moment we decline it. The rest of the application (your name, email and M-Pesa details, and our reason) is kept 1 year from our answer, in case you ask us about it |
| An application to sell Album that nobody has answered | If it waits 90 days, we close it as declined and write to you. Your ID or passport number, and any copy or KRA PIN you sent us, is deleted at that moment, and the rest is kept as we keep a declined application: 1 year from that day. Until then it is kept so that we can answer it |
Backups are kept so that a mistake or a failure can be put right. When something is deleted it goes from the live service immediately, and works its way out of the backups within 90 days. That delay is deliberate: a backup that forgets as fast as the thing it is backing up is not a backup. Once a week an encrypted copy of the database, photographs and other files is also kept for up to 15 days with GitHub, Inc. (owned by Microsoft), outside our main provider, in case that provider fails.
We monitor how people use all of our websites: wpfoss.ke, wpfoss.com, partners.wpfoss.ke, rank.ke, every.ke, eadirectory.com, album.ke, album.africa, nipecode.ke, onduu.ke, ujiajiri.ke and insurepap.com. We do it to see what works, fix what does not, keep accounts safe and measure our marketing.
What we record: the pages opened, where the visitor came from, the kind of device, and the actions taken. On Album, where there are accounts, that also includes records of signing in (which account, and when).
Our own records. When a public page of album.africa or album.ke is opened we write one line to our own database: the page, the country, the website that sent you (if any) and a one-way code made from your address, browser and the date, which changes every day, so a person can be counted for a day but not followed across days. No IP address is stored in it. It is kept 90 days. The public demo albums keep a similar record of what visitors try, for 90 days. Inside a family album we record what a family does (uploads, invitations, sign-ins), never which photograph anybody opened. Our own team's actions in our operating tools are recorded too. How long each is kept is in "How long we keep things" above.
Our servers also forward each page view to our own server at wpfoss.ke, so we can see in one place how people use all our sites. The forwarding happens on our server, not in your browser: no script is added to the page, and nothing is set or stored in your browser. We recognise a returning visitor during one day by a scrambled code made from your IP address and browser, made at wpfoss.ke, which changes every day; we never store your IP address. These records are deleted after 365 days. This covers our public marketing pages only, never an album.
Google Tag Manager always loads on our public pages. It decides which tools may run and sets no cookies itself.
Tools that run only after you press Accept:
Google and Meta process this information under their own policies, and may process it outside Kenya.
Your choice. The first time you visit, a bar asks you to Accept or Reject. Nothing in that list runs until you press Accept. You can change your mind at any time with Cookie settings, at the bottom of our pages. Pressing Reject later stops the tools from running again, but cookies they already set stay until you clear them in your browser.
The cookies we set ourselves. We use as few as we can.
| Cookie | What it is for | How long |
|---|---|---|
album_session | Keeps you signed in to your album | 30 days |
album_device | Remembers that you have signed in on this device, so a sign-in code can always be sent to you here | 180 days |
admin_session, album_team_pass | For our own team only: keeps them signed in to our operating tools, and lets them test a purchase | 7 days, and 6 hours |
partner_session | Keeps a partner signed in to their own page | 12 hours |
album_ref | Remembers which referrer sent you, so the right person is credited if you buy. It holds only their name, it is signed so it cannot be altered, and no web page can read it | 365 days |
album_ad | Only if you arrived by one of our adverts: remembers which advert, so we can tell which adverts lead to an album. It holds the advert's name and the click number Google or Facebook added to the link, it is signed so it cannot be altered, and no web page can read it. Never set where the law asks us to ask you first | 90 days |
__Host-album_drive_nonce | Only while you connect your Google Drive: makes sure the same browser that started it is the one that finishes it | 10 minutes |
We remember your cookie choice in your browser's own storage under the name
cookieConsent, which is not a cookie. Google Tag Manager sets no
cookies itself. The tools it runs set theirs only after you press Accept.
Inside an album we use only the cookies that keep you signed in and recognise your device, and, for 10 minutes while you connect Google Drive, the last one in the table.
Other companies' cookies. The forms that check you are a person, and the card payment box, run code from the companies that provide them, and those companies may set their own cookies on that page. When you press play on a video, YouTube may set its own. We do not control those.
If something ever goes wrong. If personal information is lost or exposed, we will report it to the Office of the Data Protection Commissioner within 72 hours of becoming aware of it, as the Act requires, and we will tell anybody affected without undue delay, in plain words, including what we are doing about it.
Under the Data Protection Act 2019 you may:
Write to hello@album.ke. We answer within 30 days, and we do not charge for it. We may need to check that you are who you say you are before handing over somebody's records.
If we get it wrong, tell us first and we will try to put it right. You can also complain to the Office of the Data Protection Commissioner, at https://www.odpc.go.ke. You do not need our permission and you do not have to come to us first.
You must be 18 or over to hold an album. A school album holds photographs of its students, most of them children. The children in it are not our users: their images are held by the school that owns the album, inside a private album only invited people can open, and we hold them on the school's instructions.
The school is responsible for having the consent the law asks for, including a parent's or guardian's consent for a child, under the Data Protection Act 2019.
If you are the parent or guardian of a child whose photographs are in an album, or you are now an adult and would like images of your own school days removed, tell the school that owns the album. If that is not possible, write to us and we will help.
If we change anything that matters, we will email you before it takes effect. The date at the top of this page always says when it last changed.
WP FOSS LIMITED, trading as Album. Laiboni Centre, 4th Floor, Nairobi, Kenya. Last updated 3 November 2026.
