Privacy Policy

This Privacy Policy explains how Let's Do IT Better ("LDIB", "we", "us", "our") collects, uses, discloses, and protects personal data, in accordance with Kenya's Data Protection Act, 2019 (Cap. 411C) ("the Act") and the Office of the Data Protection Commissioner's ("ODPC") Guidance Notes.

1. Who we are, and our two roles

LDIB is a multi-tenant platform: businesses ("tenants") sign up so we can build, host, and operate a website (and related services) for them, using a pipeline of AI agents and automated workflows.

We act in two distinct capacities under the Act, and this policy covers both:

• Data controller for the personal data of tenants themselves — the business owners and admins who sign up for LDIB, their account, billing, and support data, and their interactions with this website (including the AI chat assistant described below).
• Data processor for personal data belonging to a tenant's own end-customers (visitors and customers of the individual sites we host) — that data is processed on the tenant's instructions, under the tenant's own privacy policy, and the tenant remains the data controller for it. If you are a visitor to a site built on the LDIB platform and want to know how that specific site handles your data, check that site's own privacy policy, not this one.

Controller identity: Let's Do IT Better · Contact: ken@kenkagota.com · Registered legal entity name and number: NEEDS INPUT · ODPC Data Controller/Processor registration number: NEEDS INPUT — registration status not yet confirmed, per the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021.

2. What personal data we collect

• Account and signup data: business name, industry, contact name, email, phone, and a free-text description of what you want your site to be (used directly as an input to our AI site-generation pipeline).
• Billing data: payment method details and transaction history, processed through M-Pesa, ZamuPay, PayPal, or Loop (NCBA) — we do not store full card numbers ourselves.
• Support and communications: anything you send us via the contact form, email, or the AI chat assistant on this site.
• AI chat conversations: messages you send to "Kenny" (our AI chat assistant) and the responses generated — see Section 5.
• Usage and audit data: logs of actions taken on your account and by our automated agents on your behalf (for accountability and troubleshooting).
• Tenant mailbox data: if you use our tenant email hosting, mailbox metadata and initial credentials (see Section 6).

3. Why we process it, and on what legal basis

Under Act §30, we process your personal data on the following bases:

• Contract — to sign you up, generate and host your site, provision your mailbox, and bill you, we need to process your account, brand, and payment data. This is the primary basis for most processing described in this policy.
• Legitimate interest — to detect and follow up on overdue payments (see Section 7), and to maintain audit logs for security and accountability.
• Legal obligation — where record-keeping or disclosure is required by Kenyan law.

4. How AI is used with your data

We use third-party AI models to generate your site's content and to power the chat assistant on this website. Per the ODPC's AI Guidance Note (§4.1), here is exactly what's used, for what, and where the processing happens as of August 2026:

Human review: AI-generated site content and chat responses are not routinely reviewed by a person before you see them, unless you ask us to review something specific. If an AI-generated output affects a decision about your account (for example, an automated billing action — see Section 7), you have the right to request human review under Act §35 — see Section 9.

5. The "Kenny" AI chat assistant

The chat widget on this site is fully automated and currently powered end-to-end by DeepSeek. When you chat with Kenny:

• Your messages are sent to our workflow automation system (n8n) and from there to DeepSeek's API to generate a response.
• Conversations are associated with a conversation identifier so we can maintain context within a session.
• Retention period for chat logs: NEEDS INPUT — not yet defined. Until this is set, avoid sharing sensitive personal data in the chat that you wouldn't want retained indefinitely.
• Kenny is not a substitute for our human support team — you can always reach us directly at ken@kenkagota.com or via the contact form.

6. Infrastructure and service providers we use

The following providers process personal data on our behalf, as data processors, to run the platform:

• Supabase (database, authentication) — stores your account, tenant, and audit data.
• Cloudflare (hosting, DNS, bot protection, AI gateway) — serves this site and your generated site, and routes AI requests.
• Mailcow (self-hosted email server) — hosts your tenant mailbox if you use our email hosting; initial mailbox credentials are generated and emailed to you at setup — request a password change on first login.
• Google Cloud Platform — hosts the servers running Mailcow, our marketing-automation tool (Mautic), our accounting system (ERPNext), and our workflow engine (n8n).
• GitHub — stores the generated source code for your site.
• Resend — sends transactional emails on our behalf (account confirmations, site-live notifications, billing reminders).
• Payment processors — M-Pesa (Safaricom Daraja), ZamuPay, PayPal, and Loop (NCBA) process your billing transactions directly; we do not store full payment card numbers.

7. Automated decisions about your account

We use automated workflows to detect overdue payments and can flag or suspend an account for non-payment without a person reviewing that specific decision first. Under Act §35, you have the right not to be subject to a decision based solely on automated processing that significantly affects you, and the right to request that a person review it. If your account is ever suspended and you believe that decision should be reviewed by a person, contact us using Section 10 below and we will do so.

8. Where your data goes outside Kenya

Some of the processing described above happens outside Kenya. As of August 2026, personal data processed through this platform may leave Kenya for:

• United States — Google Cloud Platform (Mailcow, Mautic, ERPNext, n8n hosting), Google Gemini/Vertex AI, and (when reactivated) Anthropic Claude.
• European Union — our database provider (Supabase) hosts our primary database via an AWS region in the EU.
• China — DeepSeek, for AI chat and content-generation fallback processing.

NEEDS INPUT: a formal cross-border transfer assessment under Act §48/§49 (confirming adequate safeguards or an appropriate transfer mechanism for each jurisdiction above) has not yet been completed and documented. We are treating this as a priority open item — see our internal Data Protection Impact Assessment for this platform, which flags it as the largest compliance gap currently open.

9. Your rights, and how to exercise them

Under the Act, you have the right to:

• Be informed of how your data is used (this policy, and the AI-specific disclosures above).
• Access the personal data we hold about you.
• Rectification of inaccurate or outdated data.
• Erasure of data we no longer have a lawful reason to keep.
• Object to processing, including profiling.
• Data portability — receive your data in a structured, machine-readable format.
• Request human review of a solely-automated decision that significantly affects you (Act §35) — see Section 7.

We will respond as soon as reasonably practicable, and in any event within the timelines set by the Act and the Data Protection (General) Regulations, 2021. Use the form below, or email ken@kenkagota.com directly.

10. How long we keep your data

Under Act §39, we only keep personal data for as long as reasonably necessary for the purpose it was collected for. Specific retention periods, by category:

• Account and billing data: NEEDS INPUT — retention period not yet defined
• AI chat conversation logs: NEEDS INPUT — retention period not yet defined
• Audit/workflow logs: NEEDS INPUT — retention period not yet defined
• Data after account termination: see our Terms of Service, Section 6

11. Security

We use industry-standard technical and organisational measures appropriate to the risk, including encrypted transport (TLS), access controls, and audit logging. We do not claim any specific third-party security certification (e.g. ISO 27001, SOC 2) at this time — NEEDS INPUT if that changes.

12. Complaints

If you're not satisfied with how we've handled your data, you can lodge a complaint with the Office of the Data Protection Commissioner: complaint@odpc.go.ke, Britam Towers, 12th Floor, Hospital Road, Upperhill, Nairobi, or via www.odpc.go.ke.

13. Submit a data subject rights request

Use the form below to exercise any of the rights in Section 9. Tell us which right you're exercising and enough detail for us to identify your data. This isn't a placeholder — submissions go directly to our real contact channel and are handled by a person.