Privacy Policy

Last updated: 4 November 2026

Who we are

ComplyBora is operated from Nairobi, Kenya. Contact: info.complybora@gmail.com, +254106158885. ComplyBora is an independent platform and is not a government agency.

What we collect

• Account data: your email address and a password. Passwords are handled by Google Firebase Authentication; we never see or store them in readable form.
• Profile data you choose to give: account type, business name and county (the last two are optional).
• Messages: your name, email and message when you use the contact form, delivered through Formspree.
• Technical data: basic logs (such as IP address and browser details) created by our hosting provider to run and secure the site.

We do not ask for your KRA password, M-Pesa PIN or one-time codes, and you should never send them to us.

Why we use it

To create and secure your account, show your workspace, reply to your messages, and protect the service from abuse. We do not sell your data and we do not use advertising trackers or analytics at this stage.

Who processes it

• Google (Firebase): sign-in, database and hosting.
• Formspree: contact-form delivery.

These providers may process data outside Kenya. We choose providers with published security practices and will update this page if we add services such as payments (Safaricom M-Pesa), email delivery or AI features.

How long we keep it

Account data is kept while your account is active. Contact messages are kept only as long as needed to respond and keep records. You can ask us to delete your data at any time.

Your rights

Under the Kenya Data Protection Act, 2019 you may ask to access, correct or delete your personal data, or object to certain processing. Email us and we will respond within a reasonable time. You may also complain to the Office of the Data Protection Commissioner.

Cookies and storage

We use only essential browser storage to keep you signed in. We do not use advertising cookies.

Children

The service is for adults and businesses. It is not directed at anyone under 18.

Security

We use encrypted connections, access rules on stored data and security headers. No system is perfectly secure; tell us promptly if you suspect a problem.

Changes

We will update this page when our practices change and show the date above.