Your information, handled with care.

Information we handle

When you sign in, Clerk manages your authentication information and session. Our booking database links your account using your Clerk user ID. When you reserve a trip, we collect your name and contact phone number, the expedition you choose, and your booking reference and status.

For instalments and payment verification, we record the M-Pesa transaction reference you submit, the amount, payment status and relevant administrative notes. We do not ask for your M-Pesa PIN, one-time payment codes or card details. Making a reservation does not itself transfer money.

Our hosting and authentication providers may process IP addresses, browser/device information, session cookies and security or error logs. If you contact us, we also receive the information you choose to share. Trip photographs may identify participants.

Why we use it

We use booking and contact information to reserve your place, organise the expedition, send practical trip updates, reconcile payments and show your own reservations and instalment progress under My Trips. Your phone number is a contact detail; it does not give anyone access to your account or another person's bookings.

We process information needed to arrange and perform your booking, meet applicable legal and accounting obligations, and pursue legitimate interests such as account security, fraud prevention and resolving disputes. Where an optional use requires consent, including identifiable promotional photographs or marketing, we seek that consent separately. Booking a trip is not consent to unrelated marketing or publication of your image.

Who receives information

Authorised Alala staff can access information needed to manage trips and payments. Our service providers include Clerk for customer sign-in, Vercel for website hosting and image storage, and Neon for the PostgreSQL database. Their processing is also described in their own privacy notices.

We may share the minimum necessary participant information with guides, transport operators or venues when needed to provide a trip, or with authorities when legally required. We do not sell customer personal information.

WhatsApp is an optional external communication service. Opening a WhatsApp link takes you to that service. If you join a community or group, your profile or phone number may be visible to others depending on WhatsApp's settings. Joining a group is not required to reserve on this website; do not post payment references or private account details there.

Expedition photographs

Our full gallery and expedition details require a signed-in account. Gallery originals are served through an authenticated endpoint. Public trip covers and summaries remain visible to visitors. Signed-in members can still save or share images they can view. We seek permission before publishing identifiable participant photographs for promotional use. You can decline promotional photography without losing access to booking services, and you may ask us to remove a photograph of you by identifying the image or page.

Please avoid sending another person's photograph or personal details without their permission. Removing an image from our site does not automatically remove copies independently saved or shared by others.

Cookies and external services

We use authentication cookies and related browser storage to keep customers and administrators signed in and to support security. These essential cookies are used when you access sign-in and account features; blocking them may prevent those features from working. They are not advertising consent. The site does not currently implement advertising trackers or a separate marketing analytics tool. If we introduce optional tracking, we will explain it and offer a choice before it loads, with a way to change that choice.

Some pages request icon styles from Google Fonts and may display fallback images from Unsplash. Those requests can disclose your IP address and browser information to the provider. Links to WhatsApp and other external sites are governed by those services' own privacy notices.

Storage, retention and security

Service providers may process information outside Kenya, including in the United States. International transfers are subject to applicable Kenyan data protection requirements, including appropriate safeguards or another lawful basis. Contact us to ask about the providers and safeguards relevant to your information.

We retain account, booking and payment information for as long as needed to administer your trips, resolve disputes and meet applicable legal or accounting requirements. Optional promotional information is kept only while its purpose or permission remains valid. Deletion requests are assessed against these obligations; records in backups may persist until the relevant backup cycle expires.

We use access controls, authenticated sessions and encrypted network connections to help protect information. Customers can access their own bookings; authorised administrators manage reservations and payments. No online service can guarantee absolute security. Keep your sign-in details private and tell us promptly about suspected misuse.

Your choices and rights

Under Kenya's Data Protection Act, you may request information about our use of your data, access to your information, correction of inaccurate details, and deletion where applicable. You may also object to or request restriction of processing, request portability where applicable, or withdraw consent for optional uses. Withdrawing consent does not affect processing that was lawful before withdrawal.

Contact Alala using the private contact below. We may verify your identity before releasing or changing account information. Do not send passwords, M-Pesa PINs or unnecessary identity documents. You can also raise a concern with Kenya's Office of the Data Protection Commissioner (ODPC).

Our account and booking service is intended for adults. A parent or guardian should contact Alala directly about any proposed booking involving a child and any related privacy request.