Current record
privacy
AuditGava / privacy
Privacy Policy
How we handle your data — plainly and honestly
Overview
AuditGava ("we", "us", "the platform") is a civic technology project that makes Kenya's public financial data accessible. We are committed to treating your personal information with the same transparency we demand from government.
This policy explains what data we collect, why, and how we protect it. If anything is unclear, email us at auditgava@gmail.com.
1. Information We Collect
Newsletter Subscription
When you subscribe to our newsletter, we collect your email address only. We do not require your name, phone number, or any other personal information.
Account Registration (Optional)
If you create an account to use watchlist and alert features, we store your email address and a securely hashed password. We never store passwords in plain text.
Connected Social Accounts (Administrators)
When an authorised administrator connects a Facebook Page or Instagram account, we store the selected account identifiers, profile metadata, granted permissions, connection status, and encrypted authorisation credentials. We use these records to manage the connection and support separately approved publishing. Connecting an account does not itself publish content.
Usage Analytics
We use Vercel Analytics and Vercel Speed Insights to understand how visitors use the platform (page views, load times). These tools collect anonymised, aggregate data — no cookies, no personal identifiers, no cross-site tracking.
What We Do Not Collect
- We do not use advertising cookies or trackers
- We do not collect financial or payment information
- We do not collect location data beyond country-level (from IP)
- We do not access your contacts, camera, or microphone
2. How We Use Your Information
- Newsletter emails: To send weekly digests about new audit reports, budget updates, and economic indicators. We never share your email with third parties.
- Account features: To power your personal watchlist and data alerts.
- Analytics: To improve the platform — for example, understanding which county pages are most visited so we prioritise data quality there.
3. Where Your Data Is Stored
Your data is stored securely in a PostgreSQL database with encryption at rest and in transit. Our infrastructure is hosted on industry-standard cloud platforms with data centres in secure, audited facilities.
Database access is restricted via Row Level Security (RLS) policies. No one — including our team — can access your account data without proper authentication.
Private database recovery copies can include account and connected-account records. Disconnecting an account does not erase those copies. Recovery and retention must be handled separately from the live account records; a successful database restore is not evidence that every retained copy or deletion request has been resolved.
4. Data Sharing
We do not sell, rent, or trade your personal information. Period.
We may share anonymised, aggregate statistics (e.g., "10,000 people visited the Nairobi County page this month") in public reports about platform usage. These statistics never identify individuals.
We use hosting, database, and private media-storage providers to operate the platform. Connected Facebook and Instagram accounts also involve processing by Meta under its own policies. Provider-held records and copies must be considered separately from records in our application; removing a local connection does not confirm their deletion.
5. Your Rights
You have the right to:
- Unsubscribe from the newsletter at any time using the link in every email, or via our unsubscribe page.
- Request deletion of your account and associated data by contacting us at auditgava@gmail.com.
- Request a copy of any personal data we hold about you.
- Correct any inaccurate information.
For connected Facebook or Instagram data, you can use the same contact address to request removal. Disconnecting an account blocks its local connection. Requests to deauthorise an app or delete data are tracked separately; neither a disconnection nor an acknowledgement confirms that credential history, media, audit records, backups, or provider-held copies have all been erased. These categories require a separate review. We do not treat a pending request or a completed partial erasure as confirmation that the whole request is complete.
We will respond to any data request within 14 days.
6. Cookies
We use essential cookies only — specifically for authentication sessions (if you create an account). We do not use advertising, marketing, or cross-site tracking cookies.
7. Children's Privacy
AuditGava is a public information platform suitable for all ages. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
8. Changes to This Policy
We may update this policy from time to time. Material changes will be announced via our newsletter and posted on this page with an updated date. Continued use of the platform after changes constitutes acceptance.
9. Contact Us
Questions about this policy? Email auditgava@gmail.com