Skip to main content

Privacy Policy

Last updated: June 2026

1. Compliance with the Kenya Data Protection Act 2019

CivicAI is committed to protecting the privacy of Kenyan citizens and users of this platform. We process personal data in strict compliance with the Kenya Data Protection Act 2019 (KDPA). Our lawful basis for processing personal data is the consent obtained during registration, and the public interest of facilitating civic participation.

2. Data Minimization & Collection

We adhere to the principle of data minimization. We only collect the following personal data necessary to operate the platform and allow you to submit feedback:

  • Email address (for authentication and account management)
  • Full Name (optional, for displaying feedback attribution)
  • Citizen feedback comments and policy ratings

3. How Your Data is Used

Your email is used solely to authenticate your account and ensure unique feedback submissions. Your name and comments are displayed alongside the relevant policies to support transparent civic dialogue. We do NOT use your personal data for advertising or tracking purposes.

4. Sharing with Third Parties

We do not sell or share your personal data with any commercial third parties. To generate policy summaries, document text is processed using the Google Gemini API in a secure, anonymized manner. Speech synthesis is performed using edge-tts/gTTS, which do not store or process personal identifier details.

5. Data Retention & Your Rights

You have the right to access the feedback you have submitted at any time via your Profile page. You also have the right to request deletion of your account. Upon account deletion, all associated personal data and submitted feedback will be permanently removed from our databases (cascade deletion).

6. Data Breach & Security

We protect your data using secure industry standards including SSL/TLS encryption in transit and secure database RLS (Row Level Security) policies at rest. In the event of a data breach, we have a 72-hour notification target to alert affected users and the relevant data protection commissioner.