Weza Lens

Privacy Policy

Last updated: 11 June 2026

This Privacy Policy explains how Weza Designs & Innovations Limited ("Weza Lens", "we", "us", "our"), the operator of the Weza Lens application and the website wezalens.co.ke (the "Service"), collects, uses, and protects your personal data. We are the data controller for the personal data described here, and we process it in accordance with Kenya's Data Protection Act, 2019 (the "DPA") and its regulations.

Health & allergen note: Weza Lens gives AI-generated estimates for general information only. It is not medical or nutritional advice and may be inaccurate. Never rely on it for allergy-critical or medical decisions — always check the physical product label and consult a qualified professional.

1. Who we are & how to contact us

Data controller: Weza Designs & Innovations Limited, Beach Road, Nyali, Mombasa, Kenya (company registration number PVT-JZUGLZZ7). For any privacy question or to exercise your rights, contact privacy@wezalens.co.ke.

2. The personal data we collect

Category	Examples
Account data	Your email address and authentication details (managed by our auth provider).
Scan data	The analysis we generate from each scan (product name, score, nutrient breakdown, allergen notes, summary) and the date of the scan.
Label photos	The image you submit is stripped of embedded metadata (e.g. EXIF/GPS) and sent for AI analysis. We do not store the photo after processing — we keep only the resulting analysis.
Preferences (may be sensitive)	Health goals and dietary preferences you choose (e.g. "reduce sugar", managing a condition) and allergies you enter, used to personalise results. Some of this may be health-related and is treated as sensitive personal data (see section 4).
Billing data	Your plan and subscription status. Payments are processed by Pesapal; we do not collect or store your full card or mobile-money details.
Usage & technical data	Scan and message counts used to enforce limits; a server request log (including a request ID and approximate technical details) used for security and reliability; basic, cookieless analytics about page visits.
Feedback	Any feedback you submit, such as reporting an incorrect reading or a suggestion.

3. How we use your data & our legal basis

Purpose	Legal basis (DPA)
Analyse the labels you scan and show you results.	Performance of our agreement with you, and your consent.
Personalise insights to your goals, dietary preferences and allergies.	Your explicit consent (for any health-related preferences).
Provide accounts, history and paid features; take payment.	Performance of our agreement with you.
Keep the Service secure, prevent abuse, and enforce usage limits.	Our legitimate interest in operating a safe, sustainable service.
Send account and security emails (e.g. confirmation, password reset).	Performance of our agreement with you.
Understand and improve the Service.	Our legitimate interest; cookieless analytics requires no consent.

We do not use your data for automated decisions that produce legal or similarly significant effects on you. The health score is informational and you remain in control of your choices.

4. Sensitive personal data

Health goals, conditions you choose to record, and allergies are sensitive personal data under the DPA. We process them only to personalise your results, only with your explicit consent (given when you choose them), and you can edit or remove them at any time in the app, or withdraw consent by deleting your account.

5. Who we share data with (processors)

We do not sell your personal data. We use trusted service providers who process data on our behalf under contract:

Supabase — authentication & database.
Anthropic (Claude) — AI analysis of the label image/text and chat. The submitted image and product context are sent for analysis and are not used to train the model.
Vercel and Railway — application hosting.
Upstash — rate-limiting.
Resend — sending account & security emails.
Pesapal — payment processing for paid plans (an independent controller of your payment details).
Vercel Web Analytics — privacy-friendly, cookieless usage analytics (no personal profiles, no cross-site tracking).
Sentry — error monitoring to keep the Service reliable.

We may also disclose data where required by law or to protect our legal rights.

6. International transfers

Some providers above process data on servers outside Kenya. Where data is transferred outside Kenya, we rely on appropriate safeguards (such as the providers' contractual data protection commitments) as permitted by the DPA.

7. Cookies & local storage

We do not use advertising or cross-site tracking cookies. We use your browser's local storage to remember your session, theme, and language preference, and our analytics is cookieless. Because we do not set non-essential cookies, no cookie banner is required.

8. Retention

We keep your data while your account is active. When you delete your account, your data is removed — except a one-way hash of your email address and a count of free scans used, which we retain solely to prevent abuse of our free tier. This hash cannot be reversed to identify you. Limited security logs are kept for a short period and payment records are retained as required by law and by our payment provider.

9. Security

Data is encrypted in transit, access is restricted to what is needed to run the Service, secrets are held server-side only, and database row-level security ensures you can only access your own records. No method of transmission or storage is perfectly secure, but we take reasonable measures appropriate to the risk.

10. Your rights under the Data Protection Act

Access & portability: download all your data in-app (Account → Download my data).
Erasure: delete your account and associated data in-app (Account → Delete my account), subject to the free-tier hash described above.
Rectification: correct your preferences in-app, or contact us.
Object / restrict / withdraw consent: contact us or delete your account. Withdrawing consent does not affect processing already carried out.
Complain: you may lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya (odpc.go.ke). We'd appreciate the chance to resolve it first.

To exercise any right, email privacy@wezalens.co.ke. We will respond within the timeframe required by law.

11. Children

Weza Lens is intended for users aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has provided us data, contact us and we will delete it.

12. Changes & contact

We may update this policy; material changes will be posted here and, where appropriate, notified to you. Questions or requests: privacy@wezalens.co.ke.