Privacy Policy

Kuza is the data controller for personal data processed through the platform, operated in connection with the PAH Kenya agricultural resilience initiative. [Insert the registered data controller entity name, physical address and Office of the Data Protection Commissioner (ODPC) registration number here before this document is treated as final.]

• Account data: name/organisation name, email address, password (hashed), user type, county/village/town, language preference.
• Profile data: farm size, years of experience, crops/products, interests, credentials (for experts), submitted documents and links.
• Farm records you choose to enter: fields, crops, activities, inputs, harvests, soil records, water profiles, journal entries.
• Community content: posts, discussions, comments, messages, reports you submit.
• AI conversations: questions you ask Kuza AI and the answers given, plus minimal context (user type, county, crops, interests) used to personalise answers.
• Usage data: pages viewed, features used, weather lookups, AI usage counts, device/browser information, approximate location if you grant it.

We process your data to provide the service you asked for (contract performance), to keep the platform safe and comply with law (legal obligation and legitimate interest), and, where required, with your consent (for example, precise location or optional cookies). You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Your Kuza Farm Score is computed from data you already provided for other platform features (farm records, verification status, engagement). It is computed for your own account only, is not shared with third parties by Kuza, and is not used to make any automated decision that produces legal or similarly significant effects on you. When you use Kuza AI, your question, facts Kuza AI has remembered about you, and a summary of your farm records (such as your county, farm name, crops, soil and activity records) are sent to a third-party AI model provider, through the Lovable AI gateway, so that it can write an answer. We do not send your email address, phone number or account identifiers. Kuza AI asks for your permission before you first use it, and nothing is sent if you decline. Please do not type personal details into a question that you do not want processed.

• Service providers who host our infrastructure and database (Supabase) and, if you use Google sign-in, Google as the authentication provider strictly to complete that sign-in.
• Other Kuza members, limited to what you choose to make visible on your community profile, posts, or discussions.
• A third-party AI model provider, reached through the Lovable AI gateway, which processes the content of your Kuza AI questions and the farm context described in section 4 to generate answers, and only after you have agreed to use Kuza AI.
• Law enforcement or regulators, only where legally required.

We do not sell personal data. We do not share your Farm Score or private messages with any third party, including lenders, without your explicit action to do so yourself. AI conversation content is shared only with the AI provider described above, to produce your answers.

Our infrastructure provider may process and store data outside Kenya. Where this occurs, we rely on contractual and technical safeguards intended to provide a level of protection consistent with the Data Protection Act, 2019 and comparable international standards.

Under the Data Protection Act, 2019 (and, for users in the EEA/UK, the GDPR), you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data (most fields are editable directly in your Kuza profile and settings).
• Request deletion of your data, subject to any legal retention obligation.
• Object to or restrict certain processing.
• Request a copy of your data in a portable format.
• Lodge a complaint with the Office of the Data Protection Commissioner (Kenya) or your local supervisory authority.

To exercise these rights, use your account settings where possible, or contact us using the details published on the platform. You can delete your account and its data yourself in Settings; if you cannot sign in, see how to request deletion.

We retain personal data for as long as your account is active, and for a limited period afterward as needed for legal, security, or dispute-resolution purposes, after which it is deleted or anonymised.

Kuza is intended for users old enough to independently manage an agricultural account under Kenyan law. We do not knowingly collect data from young children.

We apply access controls (Row Level Security on our database), encrypted transport, and role-based administrative access. No system is completely secure; we will notify affected users and, where required, the ODPC, in the event of a data breach likely to result in risk to your rights.

See our Cookie Policy for details of what we store in your browser and why.

We will update the "last updated" date above when this policy changes and, for material changes, provide a more prominent notice.

Data protection questions and rights requests can be sent to the contact details published on the Kuza platform or by the PAH Kenya project team.