Privacy Policy

1. Introduction
Nyota Imara Technologies ("we," "our," or "us") respects your privacy and is committed to protecting your personal data. This Privacy Policy outlines our practices regarding the collection, use, and disclosure of your information when you use our websites, applications, and the Nyota Core ecosystem, including Nyota ID. We comply strictly with the guidelines set by the Office of the Data Protection Commissioner (ODPC) in Kenya.

2. Information We Collect
We collect various types of information to provide and improve our services:

• Account Data (Nyota ID): When you create an account, we collect your email address, first name, last name, phone number, date of birth, and profile picture (avatar).
• Authentication Data: We utilize secure One-Time Passwords (OTPs) and JSON Web Tokens (JWTs) to authenticate your sessions.
• Device & Telemetry Data: To prevent fraud and secure your account, we collect device fingerprinting data (via FingerprintJS) during login and signup events.
• Usage & Analytics Data: We collect generalized usage metrics via Google Analytics, as well as infrastructure routing and performance data via Cloudflare and Vercel.

3. How We Use Your Data
We use your personal data to:

• Provide, operate, and maintain the Nyota platform (including Mail, SMS, and Websites).
• Authenticate your identity across our ecosystem using Nyota ID.
• Log telemetry data to detect and prevent unauthorized access or fraudulent activity.
• Send administrative emails (e.g., OTPs, security alerts, billing notices).
• Comply with legal obligations under Kenyan law.

4. Data Sharing and OAuth Consent
Nyota acts as an Identity Provider (IdP). If you use Nyota ID to log into third-party applications, you will be presented with an OAuth Consent Screen.

• Explicit Consent: We will never share your data with a third-party application without your explicit approval.
• Scopes: Depending on the application, you may be asked to share your identity verification status, email address, or basic profile info (Name and Avatar).
• Revocation: You can revoke third-party access at any time from your Nyota Accounts Dashboard.
• Infrastructure Partners: We share necessary routing and analytics data with our secure infrastructure partners (Vercel, Cloudflare, Google Analytics, Supabase).

5. Cookies and Tracking
We use cookies to maintain your authenticated sessions across the Nyota ecosystem (nyotaimara.com and its subdomains). We also use analytics cookies to understand how visitors interact with our site. You can control cookie preferences through your browser settings.

6. Your Rights Under the ODPC
Under the Data Protection Act (2019), you possess the following rights regarding your personal data:

• Right to be Informed: To know what data we collect and how it is used.
• Right to Access: To request a copy of the personal data we hold about you.
• Right to Rectification: To request correction of inaccurate or incomplete data.
• Right to Erasure: To request the deletion of your personal data (subject to legal retention requirements).
• Right to Object: To object to the processing of your data for marketing purposes.

7. Data Security
We implement enterprise-grade security measures, including data encryption in transit and at rest, secure API routes, and advanced device fingerprinting to safeguard your information. However, no electronic transmission over the internet is 100% secure.

8. Contact Us
If you have questions, concerns, or wish to exercise your data subject rights, please contact our Data Protection Officer at:

• Email: privacy@nyotaimara.com
• Address: Nairobi, Kenya