Cookies Policy

This Cookies Policy explains how DiasporaShield (“DiasporaShield”, “we”, “us”) uses cookies and similar browser storage technologies when you visit our public website or use the DiasporaShield web platform as an investor, developer, professional, analyst or administrator.

DiasporaShield is an investment intelligence, risk management and verification platform for diaspora and foreign investors in Kenyan and wider African real estate. Because the platform handles identity documents, title records, verification reports and payments, the cookies we use are chosen for one main purpose: keeping your account and your session secure. We do not use cookies to show you advertising or to follow you across other websites.

This policy should be read together with our Privacy Policy, which explains how we collect, use and protect personal data more broadly, and our Terms of Use.

A cookie is a small text file that a website stores in your browser and that the browser sends back to that website on later requests. Cookies can be set by the website you are visiting (first-party cookies) or by another service whose content appears on the page (third-party cookies). They can last only until you close your browser (session cookies) or for a set period (persistent cookies).

We also use two closely related browser technologies, which this policy treats in the same way as cookies:

• Local storage, which keeps small pieces of data in your browser on this device until they are deleted by the platform, by signing out, or by you.
• Session storage, which keeps data only for the lifetime of a single browser tab and is erased automatically when that tab is closed.

Unlike cookies, local and session storage are never sent to our servers automatically. The platform reads them in your browser only when it needs them.

• Strictly necessary and functional only. Every cookie and storage item we set either keeps you securely signed in, protects the sign-in process, or remembers a choice you made on the platform.
• No advertising or cross-site tracking. We do not set advertising cookies, retargeting pixels or social media tracking cookies, and we do not sell or share cookie data with advertisers.
• No third-party analytics cookies. We measure how the platform is used (for example, which onboarding steps are completed or how many verifications are requested) through first-party records created on our own servers when you take an action, not through analytics cookies placed in your browser.
• Third parties only where you use them. Payment and sign-in providers set their own cookies only when you choose to use them, as described in section 6.

The table below lists every cookie the DiasporaShield platform sets. All of them are first-party cookies, set either by our website or by our API service when you sign in with Google, Apple or Facebook.

The di_auth cookie is limited to our own site (SameSite=Strict) and is marked Secure on encrypted connections. The token cookies are limited so they are not sent with requests started by other websites (SameSite=Lax).

In addition to cookies, the platform keeps the following items in your browser. None of them contain payment card details, identity document images or the content of your uploaded files.

Some trusted providers set their own cookies when, and only when, you use a feature that relies on them. These cookies are controlled by the provider, not by DiasporaShield, and are governed by the provider’s own cookie and privacy policies.

Stripe (card payments)

When you open a card payment page, for example to pay for a verification, a consultation with a professional or a subscription plan, the page loads Stripe’s secure payment form. Stripe may set cookies (such as __stripe_mid and __stripe_sid) to detect and prevent payment fraud. Your card details are entered directly into Stripe’s form and never pass through or get stored on DiasporaShield’s servers.

Flutterwave and M-Pesa

If you pay through Flutterwave, you complete the payment on Flutterwave’s secure checkout, which may set its own cookies under Flutterwave’s policies. M-Pesa payments are confirmed on your phone through an STK push prompt and do not place any cookies in your browser.

Google, Apple and Facebook sign-in

If you choose to sign in or register with Google, Apple or Facebook, you are taken to that provider’s own sign-in page, where the provider may set or read its own cookies. DiasporaShield receives only the information needed to create or match your account (your name, email address and a unique account identifier from the provider) and does not receive your provider password.

To protect accounts, the platform records certain details on our servers each time you sign in, including your browser and operating system, your IP address and an approximate location derived from it. We use this to show you your active sessions and devices in your security settings, to let you sign out other devices, to lock an account after repeated failed sign-in attempts, and to alert you when your account is accessed from a new device.

These details are kept on our servers as part of your account’s security records rather than in a tracking cookie, and they are never used for advertising.

DiasporaShield is operated from Kenya and serves investors living in many countries. We use cookies in line with the Kenya Data Protection Act, 2019 and, for users to whom they apply, the UK GDPR, the EU General Data Protection Regulation and the related rules on electronic communications.

• Strictly necessary cookies and storage are used because they are essential to provide the service you have asked for, including secure sign-in and fraud prevention. Consent is not required for these.
• Functional cookies and storage (such as your theme, sidebar and Learning Centre progress) are set only in response to something you do on the platform, and simply remember that choice for you.
• Third-party cookies from payment and sign-in providers are set only when you actively choose to use those services.

If we ever introduce cookies that are not strictly necessary, such as optional analytics, we will update this policy first and ask for your consent before setting them.

You remain in control of cookies and browser storage at all times:

• Sign out. Signing out of DiasporaShield deletes your sign-in cookies and tokens from the browser and revokes the session on our servers.
• Skip “Remember me”. If you do not tick it when signing in, your session ends when you close your browser. We recommend this on shared or public computers.
• Sign out other devices. From your security settings you can review every active session and end any you do not recognise.
• Use your browser settings.All modern browsers let you view, block or delete cookies and site data, usually under Settings, then Privacy or Security. Deleting “site data” for DiasporaShield also clears local and session storage.

We will update this policy whenever we add, remove or change a cookie or storage item, or when the law requires it. The “Last updated” date at the top of this page always shows when it last changed. Where a change is significant, for example if we were to introduce any cookie that requires your consent, we will notify signed-in users through the platform before the change takes effect.

If you have any questions about this Cookies Policy or how we use cookies, or if you wish to exercise your data protection rights, please contact us:

• Email: [email protected]
• Online: our contact page