Privacy policy
This text describes, in plain language, what personal data Kijito Citation Lab collects when you write through this site, what it is used for, how it is handled and what rights the law gives you. Kijito Citation Lab is a small four-person research lab with no marketing department.
Who is responsible
Kijito Citation Lab is a small lab studying how AI answers cite, borrow and misplace authority when they describe Kenyan businesses. For the purposes of Kenya's Data Protection Act, 2019, the data controller for the personal data described below is the operator of the site aicitationskenya.com. For any privacy question or to exercise a right, write to hello@aicitationskenya.com.
What is collected
When you send the contact form, Kijito Citation Lab receives:
- Your name and email address — so we can reply to you by name.
- The message you write: your citation question, a prompt example, the business or place involved and any public sources you choose to share — only what you decide to include.
This data is used only to answer your request. You are not added to any mailing list, and your data is not shared with third parties (except the payment processor described below, where applicable). Kijito Citation Lab also stores the date and time the form was sent, together with a SHA-256 digest of your IP address plus a salt — this protects the form against automated submissions. The IP address itself is never logged, nor are browser fingerprints or device metadata.
What is not collected
- No tracking cookies are used. The analytics tool works without cookies and stores no per-user identifier.
- No remarketing pixels, marketing-automation tags or ad-network trackers are active.
- There is no automated profiling, and no automated decision producing legal effects on you.
- Personal data is neither sold nor transferred to commercial partners. That is not the revenue model.
Legal basis for processing
Messages sent through the form are processed under section 30 of the Data Protection Act, 2019, because the processing is necessary to take steps at your request before responding to you. The IP digest, which protects the form against abuse, relies on the lab's legitimate interest in keeping the site secure. Payment-status data, where it exists, is processed because it is necessary to complete a transaction you have started.
How long data is kept
- Form messages: kept during the related work plus 24 months, to preserve the context of the exchange; they are then deleted. Messages that lead to no work are kept for 12 months and then deleted.
- Payment records: kept for the period required by applicable tax and accounting law, then deleted.
- IP digests: kept for 90 days — long enough for abuse protection — then deleted.
- Email exchanges: kept while the relationship is active, or for 24 months after the last contact — whichever is longer.
Your rights
Under the Data Protection Act, 2019, you can request access to your data, its correction, its erasure, the restriction of its processing, or object to its processing, and you may ask to receive it in a portable form. For any of these requests, write to hello@aicitationskenya.com. A reply follows within a reasonable time. If you consider that the processing does not comply with the law, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (the Kenyan data protection authority).
International transfers
The infrastructure serving this site is located in European Union (Germany). When additional processors (email provider) operate outside Kenya, those transfers rely on the safeguards required by the Data Protection Act, 2019 and on the protections published by the recipient.
Changes to this notice
This notice is updated when data-processing practices change significantly. The "Updated" date at the top of the page marks the version in force. Substantive changes are flagged on the site home page for 30 days, so returning visitors can see them.