Privacy Policy

1.1 Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Sensitive Personal Data" includes data revealing racial or ethnic origin, political opinions, religious beliefs, health data, biometric data, and financial information such as KRA PINs.
• "Data Controller" means LexReg Africa Ltd, which determines the purposes and means of processing personal data.
• "Data Processor" means any third party engaged by LexReg Africa to process personal data on our behalf.
• "User" or "You" means any individual or entity accessing or using the LexReg Africa platform.

2.1 Identity Data

• Full name, national ID number, passport number, date of birth, nationality, and photograph.
• Director and shareholder identification documents.

2.2 Contact Data

• Email address, phone number, postal address, and county of residence.

2.3 Business Data

• Business name, registration number, KRA PIN, entity type, industry classification, and shareholding structure.
• Incorporation documents, certificates of registration, CR12 forms, and board resolutions.

2.4 Financial Data

• Payment information processed through Paystack (M-Pesa, card, bank transfer). We do not store card details.
• Transaction history for services rendered.

2.5 Employment Data

• Employee contracts, casual worker agreements, and payroll-related documents uploaded for compliance tracking.

2.6 Technical Data

• IP address, browser type, device information, access logs, and session data.
• Cookies and similar tracking technologies for platform functionality and security.

2.7 Document Data

• All documents uploaded to the Document Vault, including leases, licenses, insurance certificates, and contracts.
• OCR-extracted text and AI-generated metadata for document indexing.

3.1 Direct Collection

• Information you provide during registration, onboarding, and platform use.
• Documents you upload for entity registration, compliance tracking, or legal audit services.

3.2 Automated Collection

• Optical Character Recognition (OCR) processing of uploaded documents using Google Document AI.
• AI-assisted data extraction and gap analysis using Google Gemini Flash and Anthropic Claude API.
• Server logs, analytics, and error tracking via Vercel Analytics and Sentry.

3.3 Third-Party Sources

• KRA PIN verification (mock/placeholder in Phase 1; third-party API integration in Phase 2).
• Business registration data from Business Registration Service (BRS) — user-facilitated, not direct integration.

5.1 Service Delivery

• Creating and managing entity profiles and compliance calendars.
• Generating board notices, minutes, and governance documents.
• Conducting legal audits and generating compliance gap reports.
• Tracking operational compliance (licenses, leases, insurance, employee contracts).

5.2 Communication

• Sending compliance reminders, deadline alerts, and renewal notifications.
• Service updates, maintenance notifications, and account-related correspondence.
• Marketing communications (only with explicit opt-in consent).

5.3 Security & Compliance

• Identity verification and fraud prevention.
• Audit logging and regulatory reporting.
• Data protection impact assessments and compliance monitoring.

5.4 Service Improvement

• Analysing platform usage to improve user experience.
• Training and refining AI/OCR models (anonymised data only).

6.1 Service Providers (Data Processors)

• Supabase (PostgreSQL): Cloud database and authentication services.
• Google Cloud (Document AI, Gemini Flash): OCR and AI document processing.
• Anthropic (Claude API): Document drafting and legal audit report generation.
• Paystack: Payment processing (M-Pesa, cards, bank transfers).
• OneSignal: Email, SMS, and push notifications.
• Vercel: Hosting and content delivery.

All processors are bound by Data Processing Agreements (DPAs) compliant with the Kenya Data Protection Act 2019.

6.2 Legal & Regulatory Disclosure

• Kenya Revenue Authority (KRA) for tax compliance verification.
• Office of the Data Protection Commissioner (ODPC) for regulatory oversight.
• Law enforcement or courts when required by valid legal process.

6.3 Business Transfers

In the event of a merger, acquisition, or asset sale, user data will be transferred subject to the same privacy protections outlined in this policy.

7.1 Technical Safeguards

• Encryption at Rest: All data stored in Supabase is encrypted using AES-256.
• Encryption in Transit: TLS 1.3 for all data transmission.
• Row-Level Security (RLS): Database policies enforce strict data isolation between tenants and users.
• Multi-Factor Authentication (MFA): Optional but strongly recommended for all accounts.
• API Key Rotation: Quarterly rotation of all third-party API credentials.

7.2 Organisational Safeguards

• Role-based access control (RBAC) with three defined roles: Super Admin, Business Owner, and Lawyer.
• Principle of least privilege — users access only data necessary for their role.
• Regular security audits and penetration testing.
• Staff training on data protection and confidentiality.

7.3 Incident Response

• Automated breach detection via Sentry and Vercel monitoring.
• 72-hour notification to ODPC and affected users in case of personal data breach.
• Documented incident response plan with defined roles and escalation paths.

8.1 Retention Periods

8.2 Soft Delete Mechanism

When a user or admin deletes data (entity, document, or account), the system:

1. Marks the record as deleted with a timestamp.
2. Hides the record from all UI views and API responses.
3. Retains the record in the database for 30 days (the "trash" period).
4. Permanently purges the record after 30 days via automated cron job.
5. Generates an audit log entry for every deletion and purge event.

11.1 Essential Cookies

• Session management and authentication.
• CSRF protection and security tokens.
• Save-as-draft functionality for onboarding forms.

11.2 Analytics Cookies

• Platform usage analytics (anonymised IP, page views, feature engagement).
• Error tracking and performance monitoring.

11.3 Marketing Cookies

• Used only with explicit consent for targeted communications.
• Users can manage preferences via the Cookie Consent banner.