Privacy Policy

1. Data We Collect

We collect the following categories of personal data when you use our Service:

• Identity Data: Full name, email address, phone number
• Business Data: Business name, type, location, operating details
• Usage Data: Login history, feature usage, AI query history
• Transaction Data: Order records, payment references, subscription details
• Device Data: Browser type, IP address (not stored long-term), device type

We do not collect sensitive personal data such as biometric data, health records, or political affiliations through our core platform.

2. How We Use Your Data

Your data is used for the following purposes:

• Providing and operating the ALAT Labs platform and AI services
• Processing AI queries to generate relevant business insights and responses
• Managing your account, authentication, and subscriptions
• Sending service notifications (not marketing, unless you opt in)
• Improving our AI models and platform features (aggregated, anonymized data only)
• Complying with legal obligations under Kenyan law

3. Data Storage

Your data is currently stored using:

• Google Sheets & Google Cloud — Primary data storage (US-based servers)
• AI Workflow Engine (self-hosted) — Workflow automation and processing

We are actively migrating to PostgreSQL database infrastructure for improved performance, security, and data sovereignty. We will notify users of any material changes to data storage practices.

4. AI Processing

Our AI features are powered by:

• Groq API — Language model inference (US-based)
• Ollama (self-hosted) — Local AI model processing
• Foundry AI — Custom AI pipeline orchestration

Important: Your business data is NOT used to train AI models. Queries are processed in real-time and responses are generated based on your specific context. We do not share your data with AI providers for their training purposes.

5. Mobile Money & Payments

Payment processing is handled by Safaricom (Mobile Money). We do not store your Mobile Money PIN or full payment credentials. We only store:

• Transaction reference numbers
• Payment amounts and dates
• Subscription status

Mobile Money transactions are subject to Safaricom's privacy policy and terms of service.

6. No Data Sales

We do not sell, rent, or trade your personal data to third parties. Your data is used solely to provide the Service. We do not engage in data brokerage or sell user profiles for advertising purposes.

7. Data Retention

We retain your data based on your subscription tier:

• Free accounts: 30 days after account closure
• Starter accounts: 90 days after account closure
• Growth accounts: 1 year after account closure
• Enterprise accounts: Unlimited, per contract terms

After the retention period, your data is permanently deleted from our systems. Active accounts retain data for the duration of the subscription.

8. Your Rights

Under the Kenya Data Protection Act 2019, you have the right to:

• Access: Request a copy of all personal data we hold about you
• Rectification: Correct inaccurate or incomplete data
• Deletion: Request deletion of your personal data ("right to be forgotten")
• Restriction: Restrict processing of your data in certain circumstances
• Portability: Receive your data in a structured, machine-readable format
• Objection: Object to processing of your data for certain purposes

To exercise any of these rights, contact us at hello@alatlabs.com. We will respond within 30 days.

9. Cookies & Local Storage

We use localStorage (browser-based storage) to maintain your session and preferences. We do not use tracking cookies, third-party analytics cookies, or advertising pixels. The data stored locally includes:

• Authentication session (alat_auth)
• User preferences and dashboard state

You can clear this data at any time by clearing your browser's local storage or logging out.

10. International Transfers

Some of our service providers are based outside Kenya:

• Google Cloud — United States
• Groq — United States

These transfers are necessary to provide the Service. We ensure that adequate data protection measures are in place in accordance with the Kenya Data Protection Act 2019. We are working toward establishing data processing within East Africa.

11. Security Measures

We implement the following security measures to protect your data:

• PIN hashing: User PINs are hashed before storage
• HTTPS: All data in transit is encrypted via TLS/SSL
• CORS protection: API endpoints are protected against cross-origin attacks
• Access controls: Role-based access to user data
• Regular audits: Periodic security reviews of our infrastructure

While we strive to protect your data, no method of electronic storage or transmission is 100% secure. We encourage you to use strong, unique PINs and protect your account credentials.

12. Contact Us

For privacy-related questions, data requests, or concerns, contact us at:

ALAT Labs Limited
Data Protection Officer
Nairobi, Kenya
Email: hello@alatlabs.com

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya.