Privacy policy

1. Our role

For personal data about visitors to our website, people who contact us, prospective customers, and the administrators and users of customer accounts (for account, security and billing purposes), we are the data controller.

For the content that a customer's organisation puts into the platform (strategies, goals, board papers, comments, uploaded files, and personal data about its own people and directors), the customer is the controller and we are its data processor. We process that data only on the customer's documented instructions, under our terms and a data processing agreement. If you are an employee, director or member of a customer organisation and have questions about that data, please contact your organisation first.

2. Personal data we collect

Depending on how you use Diranta, we collect:

• Contact and enquiry details: name, work email, phone number, organisation, role and the message you send through our contact form, demo requests or email.
• Account data: name, email address, role, department, profile photo (optional), login and security data (such as hashed passwords, sessions and sign-in events), and notification preferences.
• Customer Content entered by you or your organisation: strategic plans, objectives, key results, tasks, board papers, resolutions, signatures, comments, uploaded files and the personal data they contain.
• Billing data: billing contact, organisation legal and tax details (such as KRA PIN), invoice and payment records (bank or M-Pesa references). We do not store full card numbers.
• AI usage data: the prompts and context sent to AI features, the generated output, and usage records (feature, time, size and the charge for AI usage).
• Technical and usage data: IP address, device and browser type, pages and features used, approximate location, and diagnostic and error logs. We use cookies and similar technologies (see Cookies).
• Recruitment data: if you apply for a role, the details in your application.

3. How and why we use personal data

We use personal data for these purposes, relying on the legal bases shown:

• To provide, secure and support the platform, manage accounts, and send service messages such as invitations, notifications and invoices (contract, and our legitimate interest in running a secure service).
• To respond to enquiries, schedule demos and manage our sales pipeline (legitimate interest, or steps taken at your request before a contract).
• To bill customers and keep financial records (contract and legal obligation).
• To operate AI features at your organisation's request (contract), and to monitor AI usage for billing, budgets and abuse prevention (contract and legitimate interest).
• To understand how the website and application are used, fix errors and improve the product (legitimate interest, or consent for non-essential analytics cookies where required).
• To detect and prevent fraud, abuse and security incidents, and to comply with law and enforce our terms (legitimate interest and legal obligation).
• To send product news and marketing you have asked for or are likely to value. You can unsubscribe at any time (consent or legitimate interest, as the law requires).

4. AI features and your content

When an authorised user uses an AI feature, relevant content from the organisation's workspace is sent to our AI model providers to produce the response. We send only what the feature needs, and apply the same access permissions the user already has.

We do not use Customer Content to train AI models, and we require our AI providers not to use it to train theirs [confirm against each provider's current API terms and data-retention settings]. Providers may keep inputs and outputs for a limited period to prevent abuse, as set out in their terms.

AI output can be wrong. Please review it before relying on it. We keep records of AI requests and outputs so that customers can audit and report on them [confirm retention period].

5. Who we share personal data with

We do not sell personal data. We share it only with:

• Service providers that help us run Diranta and act on our instructions: cloud hosting and storage [provider, region]; AI model providers [for example OpenAI and DeepSeek; confirm the live list]; email delivery [provider]; website analytics [for example PostHog]; payment and banking partners [provider]; and customer relationship and support tools [provider].
• Other people in your organisation, according to the roles and permissions your administrators set. Board and committee content is visible only to those with access.
• Professional advisers, auditors and insurers, under confidentiality.
• Authorities, courts or other parties where the law requires it or to protect rights, safety and security.
• A buyer or investor in a merger, acquisition, financing or sale of our business, under confidentiality, with notice to you where required.

6. International transfers

Our providers may process personal data outside Kenya, including in [regions to confirm]. Where we transfer personal data out of Kenya or the EEA/UK, we do so only as the law permits, using safeguards such as contractual clauses, adequacy decisions or your consent. [Confirm hosting region and any Office of the Data Protection Commissioner transfer requirements.]

7. How long we keep personal data

Customer Content is kept while the customer's account is active. After termination, customers can export it for [30] days, then we delete it from active systems and, within [90] days, from backups, unless the law requires otherwise.

Other data is kept only as long as needed: for example enquiries for up to [24] months after the last contact, billing records for [7] years for tax and audit purposes, audit and security logs for [12] months, and AI request logs for [●] months. [Confirm each retention period.]

8. Security

We protect personal data with technical and organisational measures that include encryption in transit and at rest [confirm], role-based access controls, audit logging, segregated customer data, secure development practices, and regular reviews. No system is perfectly secure. If a breach affecting personal data occurs, we will notify affected customers and the authorities as required by law. More detail is on our security page.

9. Cookies and similar technologies

We use essential cookies to keep you signed in and secure the service. With your consent where required, we use analytics cookies to understand website use. You can change cookie settings in your browser or through the cookie notice [if implemented]. Blocking essential cookies will stop parts of the application from working.

10. Your rights

Under the Kenya Data Protection Act, 2019, and similar laws, you may have the right to:

• Be informed about how your personal data is used, and ask for access to it.
• Ask us to correct inaccurate or incomplete data.
• Ask us to delete personal data, or to restrict or object to its processing, in certain circumstances.
• Receive your personal data in a portable, commonly used format.
• Withdraw consent at any time, where we rely on it, without affecting earlier processing.
• Object to direct marketing and to decisions based solely on automated processing that significantly affect you. We do not make such decisions.

11. Exercising your rights and complaints

To exercise a right, write to us at [email protected]. We will respond within the time the law sets [confirm: 30 days], and may need to verify your identity. If your data is Customer Content, we will usually pass your request to the customer, as the controller, or help them respond.

If you are unhappy with how we handle your data, please tell us first. You also have the right to complain to the Office of the Data Protection Commissioner in Kenya (odpc.go.ke), or to the data protection authority where you live.

12. Children

Diranta is a business service and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you think a child has given us personal data, please contact us and we will delete it.

13. Changes to this policy

We may update this policy as our service or the law changes. We will post the new version here with its date, and notify customers' administrators of material changes in advance.

14. Contact us

Diranta [registered office address to be added] · Data protection contact: [email protected] · [Data Protection Commissioner registration number, once registered]