Privacy policy

1. The consent statement

This is the exact statement you tick when submitting:

I am 18 or older and I agree to the Maoni Hub Privacy Policy, including my personal data being stored and processed outside Kenya (in the United States and Canada), where legal protections for personal data may differ from Kenyan law.

2. Taking part

• Taking part is voluntary, and open to anyone aged 18 or over.
• Each person may make one submission per consultation.
• Submitting involves verifying a phone number or email address with a one-time code.
• You can stop at any point before submitting — nothing reaches us until you verify and submit.
• Once submitted, a submission cannot be amended or withdrawn.
• Please be accurate in what you tell us.

3. What we collect

• To verify you: the phone number or email address you confirm with a one-time code when you submit, when you verified it, and a record of your consent. These live in a separate, locked-off system.
• What you submit: your position on the consultation and on each question you answer, any comments you write, and — if you submit for an organisation — your memorandum, who your organisation represents, and any documents you attach.
• About you (all optional): six questions — sex, age group, county and constituency, plus urban or rural, and disability status — each with a “Prefer not to say” option. Sex and disability status are sensitive personal data under Kenyan law, and we explain below exactly why we ask.

What we do not collect: your name, your ID number, your photo, or your precise location. We do not store IP addresses, and we use no analytics or tracking cookies.

4. Why we collect it

• Your contact detail — to verify that each person takes part once, to send you a confirmation receipt upon submission, and to message you when there is an update on a consultation you took part in.
• Your answers and comments — to put the public’s views in front of the committee running the consultation, and to be counted in the published results.
• The optional questions about you — so the committee can see whether different groups of people experience a law differently: whether females and males, older and younger people, different counties, and persons with disabilities are saying different things. That comparison is a large part of why this platform exists.

The legal basis for all of this is your consent — the box you tick before submitting. We do not use your information for advertising, profiling, or any purpose not listed here.

5. What is required and what is optional

• Required: a working phone number or email address (this is how we make sure each response counts once — without one, we cannot accept a submission), your overall position on the consultation, and the consent tick.
• Optional: every question about you, every per-clause question, and every comment box. Choosing “Prefer not to say” or skipping a question has no consequence — your submission carries exactly the same weight.

6. Where your data is stored

Maoni Hub stores and processes data outside Kenya, in two countries:

• United States — the databases holding your contact details (in their own separated system) and your submissions, and the file storage for uploaded documents.
• Canada — the computer that groups submissions into themes. It is a single machine owned and operated by Daylight; submissions never go to a third-party or commercial AI service.

Kenyan law protects data processed abroad only if safeguards are in place, and legal protections in the US and Canada differ from those in Kenya — which is why the consent tick names this transfer. Our safeguards: every provider we use is bound by a written data-processing agreement, all data is encrypted in transit and at rest, and access is restricted as described under “Security”.

7. Who processes your data

Service providers process data on our instructions; none of them may use it for their own purposes:

• Hosting and storage — Supabase (databases and uploaded documents; contact details and submissions in separated systems) and Vercel (the website).
• Messages and verification — Twilio (phone verification codes, WhatsApp and SMS; we never see or store phone codes ourselves), Meta (WhatsApp delivery) and SendGrid (email).
• Traffic — Cloudflare directs visitors to the site; network providers handle your IP address in passing, and we do not store it.

8. How your comments are analysed and used

Your words stay yours. By submitting, you give the committee and Daylight permission to analyse your submission, group it with others, and publish it or extracts from it — always without your identity — as part of the consultation’s results and the committee’s response.

Software, including AI, assists with this grouping — it never decides what the committee does with your input; people do. Analysis methods may be refined from consultation to consultation.

9. How long we keep it

Submissions to a consultation become part of a permanent public-participation record. A committee’s published response has to remain checkable against what the public actually said — including years later — so we do not delete submissions on a schedule, and this policy makes no time-limited deletion promise. Your contact details are kept for as long as the record they vouch for, so that your consent and your submission’s authenticity can always be demonstrated.

What is published never includes your contact details: results appear in aggregate, and any quoted material appears without identity, under the committee’s editorial review.

10. The public audit log

Every consultation runs on the record. Key events — a consultation opening, each submission being received, the committee’s response being published — are written to a public audit log built append-only: entries are added, never edited or removed. Entries show tracking references, never who you are. Anyone can inspect the log — including counting the submissions a consultation received — and your tracking reference lets you confirm, any time, that your own submission is on the record.

11. The record and legal proceedings

Public participation in law-making is a constitutional right in Kenya, and this record exists to uphold it. It can serve as evidence — including in legal proceedings — that consultation genuinely happened and of what the public actually said.

In the rare case that a court or legal process requires it, the link between a submission and the person who made it can be reconstructed. That is an exceptional step, taken only where the law requires it and handled with the care the law demands for your personal data.

12. Your rights

Under Kenya’s Data Protection Act you have the right to ask what we hold about you, to correct it, to object to processing, and to ask for deletion. To exercise any of them, email support@maonihub.ke. We assess every request individually and respond to all of them. Be aware that these rights are not absolute: because submissions form a permanent record of a public process, a request to delete a submission after it has been made may be refused on those grounds.

13. Security

We protect your data with appropriate technical and organisational measures under the Act. The one worth explaining: your contact details and your answers live in two separately-permissioned systems, and the part of the platform that handles submissions has no technical ability to read who you are — the separation is enforced by the database itself, not by policy. All data is encrypted in transit and at rest.

14. Who is responsible

Maoni Hub is operated by Daylight Build Inc. Daylight Build Inc. is the data controller, registered as a data controller with the Office of the Data Protection Commissioner — registration number 437-6943-4351, valid to 19 August 2028.

Our Data Protection Officer can be reached at support@maonihub.ke — mark your message “for the Data Protection Officer”.