Privacy policy

Naivolabs (“Naivolabs”, “we”, “us”) is an applied AI systems company registered in Kenya, with its office at Mirhab, 15th Floor, East Wing, Nairobi, Kenya.

This policy explains what personal data we collect when you visit naivolabs.com, when you contact us, and when you use a system we have deployed for your organization. It also explains your rights and how to exercise them.

We handle personal data in line with the Kenya Data Protection Act, 2019 and, where it applies to you, the EU/UK General Data Protection Regulation. Where we process data on behalf of a client organization, that organization is the data controller and we act as a data processor under a written agreement.

Information you give us. When you submit a form, email us or book a call we collect your name, work email address, organization, the budget range you select and the content of your message. If you subscribe to our notes, we store your email address and the date you subscribed.

Information collected automatically. Our hosting infrastructure records standard server logs, IP address, user agent, requested path, timestamp and response status, for security and reliability purposes. These logs are retained for a short period and are not used to profile visitors.

Analytics. If you consent to analytics cookies, we collect aggregated, anonymised measurements such as page views, referrers, approximate country and device class. We do not use analytics to build individual profiles.

Information in systems we operate. When we deploy a system for a client, it may process the personal data of that client’s users, for example the content of a phone call, message or submitted document. In those cases the client determines what is processed and why, and this policy applies only to our role as processor. We do not use client data to train models.

We use three categories of cookies and local storage:

• Strictly necessary. Required for the site to load, to remember your cookie choice and to keep the site secure. These cannot be switched off and are set without consent because they are exempt.
• Analytics. Set only if you consent. They help us understand which pages are useful so we can improve the site.
• Marketing. Not currently used on this site. If we introduce them, they will be set only with your consent.

You can change or withdraw your choice at any time using the cookie preferences control in the site footer. Withdrawing consent stops future collection; it does not affect processing already carried out.

We rely on the following legal bases:

• Contract and pre-contract steps, to respond to an enquiry, prepare a proposal and deliver the services you engage us for.
• Legitimate interests, to keep the site secure, prevent abuse and improve our services, balanced against your rights.
• Consent, for analytics and marketing cookies, and for sending you our notes if you subscribe. You may withdraw consent at any time.
• Legal obligation, where we must retain records for tax, accounting or regulatory purposes.

We do not sell personal data. We share it only with service providers who help us run the business, and only to the extent they need it:

• Infrastructure and hosting providers that run this website and our clients’ deployments.
• Email and communication providers used to answer your enquiry or send our notes.
• Professional advisers where legally required.

Some providers may process data outside Kenya. Where that happens we put contractual safeguards in place, including standard clauses, and we assess the destination’s protections before transferring.

Enquiry and contact records are kept while we are in discussion and for up to 24 months afterwards, so we can pick up a conversation you return to. Newsletter subscriptions are kept until you unsubscribe. Server logs are kept for up to 90 days. Data processed on behalf of a client is kept according to that client’s instructions and the agreement between us.

We apply encryption in transit, least-privilege access, audit logging and role-scoped permissions across the systems we operate. Access to production data is limited to the people who need it to deliver the service, and is reviewed. Systems we build for clients ship with these controls as part of the deployment rather than as an add-on.

No system is perfectly secure. If a breach affects your personal data we will notify you and the Office of the Data Protection Commissioner within the timeframes required by law.

Subject to the applicable law, you have the right to:

• be informed about how your data is used, and to access a copy of it;
• have inaccurate data corrected;
• request deletion of data we no longer need;
• object to, or restrict, processing based on legitimate interests;
• withdraw consent at any time, without affecting prior lawful processing;
• receive your data in a portable format; and
• complain to the Office of the Data Protection Commissioner (Kenya) or your local supervisory authority.

To exercise any of these, email hello@naivolabs.com. We respond within 30 days and may ask you to verify your identity first.

This website is aimed at professionals and is not directed at children. We do not knowingly collect personal data from children through this site. Where a client deployment may involve children’s data, that is handled under the client’s instructions with additional safeguards and a written data processing agreement.

We review this policy at least annually and whenever our processing changes materially. The date at the top of the page always reflects the current version. If a change is significant, we will make it prominent on the site.

This document is provided for transparency and does not replace the data processing agreement in place with any client organization.