Privacy notice
My name is Elias Mugo Quill. On my own, from Nairobi, Kenya, I track how AI answer engines name, cite or describe Kenyan businesses — local services, B2B firms, SMEs and sector specialists, across English and Swahili claims. This notice can stay short because the loop is short: one form, one inbox, one purpose. Below, in plain terms, is what that form passes on, where it goes, and what you can ask me about your own data.
Who handles your data
Everything this page is about goes through my hands only. I, Elias Mugo Quill, run kenya-geo-seo.com as a solo auditor: no team, no departments, one person reading every incoming message. Under Kenya's Data Protection Act, 2019, I am the data controller for it. If you have a question, or want to exercise a right of yours, the address is hello@kenya-geo-seo.com.
What is collected
Only one track reaches me, the form. It asks for three exact things and nothing else —
- Your name, so that the reply can address you the right way.
- Your email, so the reply knows where to return.
- A free-text message, where you describe the case — the business name, the website, the AI answer that felt wrong or incomplete, and the language, English or Swahili, where the gap shows up.
That's all. No account to set up, no login, no payment data typed in here, no profile built up quietly. The message comes into an inbox and stays a message there. To keep automated submissions away, I save the moment of sending together with a salted SHA-256 hash of the IP address it leaves from; the plain IP, any browser fingerprint and device traits I never keep.
What is not collected
It also matters to say what this site refuses to do on purpose:
- Zero tracking cookies, of any kind. Visits I count with self-hosted, cookieless, privacy-respecting analytics, served by a first-party proxy on this same domain; nothing migrates from one site to another and no visitor is recognised one by one.
- No advertising pixels, no remarketing labels, no marketing-automation trackers.
- No automated profiling and no automated decision that produces a legal effect on you.
- No sale, no rental, no sharing of personal data: there is no commercial machine here to feed them to.
Why the law allows it
The moment you send the form, handling your name, email and message rests on the lawful basis of steps taken at your own request ahead of any agreement, as recognised under Kenya's Data Protection Act, 2019. The IP hash, which protects the form from abuse, rests instead on the legitimate interest of keeping the form secure. Should a paid piece of work ever produce data on the status of a payment, the contractual basis would cover it.
How long it is kept
- Form messages and the email thread they grow into: kept while the work is open, then for a further 24 months so the exchange stays on record, and deleted afterwards. A message that leads nowhere is kept 12 months and then gone.
- IP hashes: kept 90 days, the span that's useful for reading a pattern of abuse, then deleted.
- Any payment receipts: where a paid piece of work generates them, I keep them only for the period tax and accounting demand, then delete them.
Your rights
Kenya's Data Protection Act, 2019 gives you the right to access your data, to have it corrected or deleted, to object to how it is used, and to be told plainly how it is handled. A single email to hello@kenya-geo-seo.com is enough to set any one of them in motion, and you'll have a reply within a reasonable period. If you believe your data has been handled badly, you may also raise it with Kenya's Office of the Data Protection Commissioner.
Where the data is hosted
The servers that carry kenya-geo-seo.com stand in European Union (Germany). In the rare case where a further processor (email provider) worked from outside Kenya, that transfer leans on standard contractual safeguards and on the additional protections that party publishes.
Changes to this notice
If the way I handle data changes into something that has weight, I rewrite this page to say so, and the "Updated" date at the top moves with it. A change that truly counts stays flagged on the home page for 30 days, so anyone passing back through the site won't risk missing it.