Privacy Policy

1. Introduction

Apta ("we", "our", or "us") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and protect information when you use our AI-powered customer operations platform ("the Platform").

We operate in compliance with the Kenya Data Protection Act, 2019 and applicable data protection regulations.

2. Who We Are

Apta is a multi-tenant SaaS platform providing AI-powered customer operations services to businesses (our "Clients") across Africa. Our registered business operates in Kenya.

For data protection inquiries, contact us at: privacy@zidiai.co

3. Data We Collect

Account Data (from our Clients):

• Business name and industry
• Administrator name and email address
• Account credentials (passwords stored encrypted)
• Subscription plan and billing information

Customer Data (collected on behalf of our Clients):

• WhatsApp phone numbers
• Names and email addresses (when provided)
• Conversation history and messages
• Lead qualification data (budget, location, timeline)
• Customer lifecycle stage and tags

Usage Data:

• Platform usage logs and analytics
• API request logs
• Error and performance data

4. How We Use Your Data

• To provide and operate the Apta platform
• To power AI-driven customer conversations on behalf of our Clients
• To qualify and score leads for our Clients' businesses
• To send service notifications and platform updates
• To improve our AI models and platform performance
• To comply with legal obligations
• To detect and prevent fraud or abuse

We do not sell your personal data to third parties. We do not use your data for advertising purposes.

5. Data Storage & Security

Your data is stored on secure cloud infrastructure (Supabase/PostgreSQL) hosted in the Asia Pacific region. We implement the following security measures:

• Encryption at rest and in transit (HTTPS/TLS)
• JWT-based authentication with secure token management
• Role-based access control
• Tenant data isolation — each Client's data is strictly separated
• Audit logging of all data access and modifications

6. Data Sharing

We share data only with the following trusted service providers necessary to operate the platform:

• OpenAI — AI language model processing (messages processed but not stored by OpenAI)
• Meta (WhatsApp) — message delivery via WhatsApp Business API
• Supabase — database and authentication infrastructure
• Railway — backend hosting
• Vercel — frontend hosting

All service providers are contractually bound to protect your data and use it only for the specified purposes.

7. Your Rights (Kenya Data Protection Act 2019)

Under the Kenya Data Protection Act, you have the right to:

• Access — request a copy of your personal data
• Correction — request correction of inaccurate data
• Deletion — request deletion of your personal data
• Portability — request your data in a portable format
• Objection — object to processing of your data
• Withdraw consent — at any time, without affecting prior processing

To exercise these rights, email us at privacy@zidiai.co. We will respond within 21 days.

8. Data Retention

• Account data: retained for the duration of the subscription plus 90 days after termination
• Conversation data: retained for 12 months then automatically deleted
• Billing records: retained for 7 years as required by Kenyan tax law
• Audit logs: retained for 12 months

9. WhatsApp & End Customer Data

When our Clients use Apta to communicate with their customers via WhatsApp, those end customers' data is processed on behalf of our Client (who is the Data Controller). Our Clients are responsible for ensuring they have appropriate consent from their customers to use AI-powered communication tools.

10. Cookies

Our platform uses only essential cookies necessary for authentication and session management. We do not use tracking or advertising cookies.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of significant changes via email. Continued use of the platform after changes constitutes acceptance of the updated policy.

12. Contact & Complaints

For privacy concerns or to exercise your rights:

• Email: privacy@zidiai.co
• WhatsApp: +254 790 615419

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke