Xcobean ID — Privacy Policy

Xcobean ID (id.xcobean.com) is the single sign-on service operated by Xcobean Limited (Nairobi, Kenya). It lets you use one account across Xcobean products (AjiraVerify, NannyImara, billing and others). This policy explains what we collect and why, under the Kenya Data Protection Act, 2019.

What we collect

Account details you provide: name, and any of email, phone number, or password.
National ID — optional; only if you choose to add/verify it for a product that requires identity verification.
Voiceprint (biometric): optional; only if you choose to set up Voice ID as a sign-in factor. This is an encrypted mathematical model of your voice (a numeric "voiceprint"), not a recording of you. The short audio clip you record is used only to compute that model and is then discarded; we do not keep the audio.
Social login identifiers if you sign in with Google or LinkedIn (your provider account id, email, name, profile photo).
Login metadata: timestamps and the product you signed into, for security and audit.

Why we use it

Solely to authenticate you and enable single sign-on across the Xcobean product you choose to access. Lawful bases: your consent and performance of our service to you. Your voiceprint, if you set one up, is used only to confirm it is you at sign-in or before a sensitive action (multi-factor authentication).

Voice ID (biometric data)

Under the DPA 2019 a voiceprint is sensitive personal data, so we process it only with your explicit, opt-in consent, which you give when you set up Voice ID and can withdraw at any time. We store only the encrypted voiceprint model, never the audio. Your voiceprint stays within Xcobean ID: it is never shared with the products you sign into (only the yes/no result of your sign-in is), and it is never used for advertising or sold. Verification is performed on our own systems. You can remove Voice ID at any time in your security settings, which deletes the voiceprint immediately.

Sharing

When you sign in to a Xcobean product, we share a minimal identity token (your stable account id, and the name/email/phone/National ID you have on file) with that product only, so it can recognise you. This token never contains your voiceprint or the audio. We do not sell your data or share it for advertising.

Retention & security

We keep your identity record while your account is active. Passwords are hashed; the voiceprint is encrypted at rest and the enrolment audio is discarded once the model is computed; connections are encrypted (TLS). You can request deletion at any time, and you can remove Voice ID on its own without closing your account.

Your rights

Under the DPA 2019 you may access, correct, or delete your data, withdraw consent, and lodge a complaint with the Office of the Data Protection Commissioner (ODPC). Contact privacy@xcobean.com.

Xcobean Limited, Nairobi, Kenya · privacy@xcobean.com · Last updated 2026-06-04