Privacy

What we know about you, and why

LipaStream is operated by Olitera Limited, a company registered in Kenya. This policy explains what we collect, why we need it, who else sees it, and how long we keep it. It is written to be read, not to be survived.

Last updated 15 September 2026

The short version

If you are watching an event, we know your phone number and which events you paid for. That is all. We never ask a viewer for a name, an email address or a password, because your M-Pesa number is the whole of your account.

We do not sell data, we do not run advertising, and there are no third-party trackers or analytics on this site.

What we collect

If you watch an event

• Your phone number. You type it to pay, and it is how we recognise you afterwards. It is the only identifier we hold for you.
• Your payment. The amount, whether it succeeded, the M-Pesa receipt number, and the confirmation message Safaricom sends us.
• What you have access to. Which event, and when that access expires.

If you run events

• Your phone number, and a name and photo if you choose to add them.
• The name registered to your M-Pesa number, where Safaricom returns it to us during a payment.
• Your events, their prices, and your commission terms.
• Your payouts — amounts, dates, and whether each one reached you.
• Broadcast details for your streams, including the keys your encoder uses.

If you join the waitlist

Only what you typed into the form: your name, phone number, and optionally an email address, what brings you here, and what you would stream.

Signing in

We send a six-digit code by SMS. We store a one-way hash of that code rather than the code itself, along with how many times it has been tried. It stops working after five minutes or five wrong attempts, whichever comes first.

What we do not collect

• Your M-Pesa PIN. You enter it on your own handset, on Safaricom’s prompt. It never touches us and we could not see it if we wanted to.
• Card numbers or bank details. We do not take card payments.
• Your location, contacts, or anything else from your device.
• Advertising identifiers, or any tracking that follows you to other sites.

Who else sees it

Three companies are involved in making the service work. Each receives only what it needs to do its part.

• Safaricom handles every payment and payout through M-Pesa. They receive the phone number paying and the amount, and tell us whether it worked. Safaricom is responsible for your data in its own right under its own terms, not ours.
• Africa’s Talking delivers the SMS containing your sign-in code. They receive the number and the message. Only people who run events receive these.
• Cloudflare hosts the site, stores our database, and delivers the video. Technical records such as IP addresses pass through them in the ordinary course of serving a website.

We may also disclose information where the law requires it, or to establish or defend a legal claim. We will not hand over your data for any other reason.

What is stored on your own device

To save you typing your number again, your browser keeps your M-Pesa number and a key that unlocks the events you have paid for. These sit in your browser on your device — clearing your browser data removes them, and you can simply enter your number again.

We do not use cookies for tracking or advertising.

How long we keep it

• Access to an event — seven days after the event, which is the replay window your ticket buys.
• Sign-in codes — five minutes.
• Payment and payout records — kept for as long as Kenyan tax and company law requires us to keep financial records. These are the evidence that money moved, so we cannot delete them on request.
• Waitlist details — until you ask us to remove you, or until we have finished onboarding and no longer need the list.

Your rights

Under the Kenya Data Protection Act 2019 you can ask us to show you what we hold about you, correct it if it is wrong, delete it, stop using it in a particular way, or send it to you in a portable form.

Email [email protected] from the address you gave us, or message us from the phone number we hold, and we will respond within thirty days. The one thing we usually cannot delete is a completed payment record, for the reason above.

If you think we have handled your data badly, you can complain to the Office of the Data Protection Commissioner of Kenya. We would rather you told us first so we can fix it.

Security

Sign-in codes are hashed. Access to a stream is checked on every single request rather than trusted once. Video is served through signed links that expire, so a copied link stops working. We are a small team and we do not pretend to be immune to everything, but nothing here is left to chance.

Children

LipaStream is not intended for anyone under 18, and we do not knowingly collect their information. If you believe a child’s data has reached us, tell us and we will remove it.

Changes

If we change this policy we will update the date at the top. If a change meaningfully affects what we do with your data, we will tell the people it affects directly rather than relying on you to re-read this page.

Contact

Olitera Limited — [email protected]