Privacy
Last updated 25 September 2026.
Album is operated by WP FOSS LIMITED, trading as Album, a company registered in Kenya.
We are registered with the Office of the Data Protection Commissioner under the Data Protection Act 2019, as Data Controller and Data Processor, registration number 507-1539-1BAA.
We are the data controller for your account: your name, your email address, your telephone number, what you paid and when. We are a data processor for what is inside your album: the photographs, the stories, the family tree and the private sections are yours, held on your instructions, and we do not decide what they are for.
Only what the service needs. We do not buy information about you from anybody and we do not build a profile of you.
| What | Why we have it | Lawful basis |
|---|---|---|
| Your name, email address and telephone number | To create your album, to let you sign in, to send you a sign-in code, and to write to you about your album and its renewal | Performing our contract with you |
| What you paid, when, and how, with the M-Pesa reference or the last four digits of a card | To take payment, to account for it, and to answer a question about a payment | Contract, and our legal obligation to keep accounts |
| The registrant details for a domain name: the registrant’s full name, postal address, town, county, country, email and telephone, and an organisation name where there is one | Because a domain name must be registered to a real, identified person. We pass them to our registrar and to KENIC for that purpose alone | Contract, and our legal obligation as a registrar’s customer |
| Everything inside your album: photographs and the information in them, names, dates, relationships, stories, documents | Because it is your album and this is what it is for | Contract. We hold it on your instructions |
| Sensitive information you choose to put in a private section: health records, a will, funeral wishes, notes about assets | Because a family asked to be able to keep them in one safe place | Your explicit consent, given by choosing to enter them. You can delete them at any time |
| Who you invite, and what each of them may see | To let the right people in and keep everybody else out | Contract |
| Records of signing in, and of changes made in your album | To show you who did what, and to notice somebody trying to get in | Our legitimate interest in keeping your album secure |
| A record that a page of our public website was visited: which page, the country, and a one-way code made from the address and browser that changes every day | To know whether anybody is reading our own pages | Our legitimate interest in understanding our own website. We do not store IP addresses and this cannot be traced back to a person |
What is never inside an album: no advertising, no tracking tags, no analytics of any kind. Family albums are not measured. What a family does inside their own album is not data we collect.
We use a small number of other companies to run the service. Each is given only what it needs to do its part, is bound to keep it confidential, and may not use it for anything of its own.
| Who | What they handle | Where |
|---|---|---|
| Our hosting and storage provider | Running the service, and storing your photographs | Outside Kenya |
| Our card payment processor | Card payments. Card details are entered with them and never reach us | Outside Kenya |
| Safaricom | M-Pesa payments. We receive the reference and the amount, never your PIN | Kenya |
| Our email provider | Sending email: sign-in codes, welcome letters, renewal reminders | Outside Kenya |
| Our domain registrar, and KENIC | Registering a domain name in your name. They receive the registrant details listed above. Some of those details may appear in the public registry record for the name, which is how domain registration works everywhere | Kenya |
| Only if you use it. Importing from Google Photos: we see only the photographs you choose, for that visit. Connecting your own Google Drive: we may write the files we create and nothing else. See "Photographs and files from Google" below | Outside Kenya |
If you want to know exactly who these companies are, write to hello@album.ke and we will tell you. The law asks us to describe who receives your information, which is what the table above does; it does not ask us to publish the list of suppliers we have built the service on, and we would rather not hand that to a competitor.
On album.africa only, our own public marketing pages use Google Tag Manager and Google Analytics, and ask first where the law requires consent. Our Kenyan site carries no analytics on any page, and no family album on any site carries any.
If somebody introduced you to Album and is paid a share, they can see that you are their customer: your family or album name, the email address and telephone number you gave when buying, your plan and your renewal date. They cannot open your album. Tell us and we will stop showing them your details.
We do not sell your information. We do not share it for advertising. We give it to the authorities only where the law actually requires it, and we tell you when we are allowed to.
Importing from Google Photos. When you press Import from Google Photos, you sign in to Google and choose photographs in Google's own picker. Album is given access only to the photographs you chose, only for that visit. We copy them into your album, where they are kept like any photograph you upload, and nothing else in your Google Photos is ever seen. We do not keep the permission Google gives us: it expires within the hour and is never stored.
Connecting your Google Drive. If you connect your own Google Drive, Album may create and write the files for your album's copy there, and cannot see any other file in your Drive. You can disconnect it in Settings, or from your Google account, at any time.
We use what we receive from Google only to do what you asked: bring your chosen photographs into your album, or keep a copy of your album in your Drive. We do not use it for advertising, we do not sell it, we do not use it to train any artificial intelligence, and people at Album do not look at it unless you ask us to for support or the law requires it.
Album's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Some of the companies above are outside Kenya, so running the service means your information is processed outside Kenya. The Data Protection Act allows this where there are appropriate safeguards, and we require every one of them by contract to protect your information to the standard the Act demands.
Your photographs themselves are held outside Kenya. If that matters to you, say so before you buy and we will tell you exactly where things stand.
| What | How long |
|---|---|
| Your album and everything in it | While you have an album with us |
| An album that is unpaid and private | 12 months, then a last letter, then deleted |
| An album you ask us to delete | Removed at once. Gone from the backups within 90 days |
| Records of payment | 7 years, which is what Kenyan tax law requires |
| Registrant details for a domain name | While the name is registered through us, and 2 years after, in case the registration is ever questioned |
| Sign-in codes | 10 minutes |
| Records of signing in and of changes in an album | 1 years |
| A record that a public page was visited | 90 days |
| Email we have exchanged with you | 2 years after the conversation ends |
Backups are kept so that a mistake or a failure can be put right. When something is deleted it goes from the live service immediately, and works its way out of the backups within 90 days. That delay is deliberate: a backup that forgets as fast as the thing it is backing up is not a backup.
We use as few as we can, and none of them follow you around the internet.
| Cookie | What it is for | How long |
|---|---|---|
album_session | Keeps you signed in to your album | 30 days |
album_device | Remembers that you have signed in on this device, so a sign-in code can always be sent to you here | 180 days |
album_admin, album_partner | The same, for our own staff and for partners | 30 days |
album_ref | Remembers which referrer sent you, so the right person is credited if you buy. It holds only their name, it is signed so it cannot be altered, and no web page can read it | 365 days |
On album.africa only, Google Tag Manager sets its own cookies on our marketing pages, and asks first where the law requires consent. Our Kenyan site sets none of those, and no cookie of any kind is used inside a family album beyond the one that keeps you signed in.
If something ever goes wrong. If personal information is lost or exposed, we will report it to the Office of the Data Protection Commissioner within 72 hours of becoming aware of it, as the Act requires, and we will tell anybody affected without undue delay, in plain words, including what we are doing about it.
Under the Data Protection Act 2019 you may:
Write to hello@album.ke. We answer within 30 days, and we do not charge for it. We may need to check that you are who you say you are before handing over somebody's family records.
If we get it wrong, tell us first and we will try to put it right. You can also complain to the Office of the Data Protection Commissioner, at https://www.odpc.go.ke. You do not need our permission and you do not have to come to us first.
You must be 18 or over to hold an album. A family album usually contains photographs of children, and that is what it is for: the children in it are not our users, and their images are held by their own family, inside a private album only invited people can open.
If you are the parent or guardian of a child whose photographs are in an album, or you are now an adult and would like images of your own childhood removed, tell the family who owns the album. If that is not possible, write to us and we will help.
If we change anything that matters, we will email you before it takes effect. The date at the top of this page always says when it last changed.
WP FOSS LIMITED, trading as Album. Laiboni Centre, 4th Floor, Nairobi, Kenya. Last updated 25 September 2026.
