⚖️ Immani Legal Info

Privacy Policy

Last updated: 10 September 2026

This Privacy Policy explains how Immani ("we", "us", "our") collects, uses, stores, and protects your personal data when you use legal.immanihub.com ("Immani Legal Info", "this platform"). We are committed to complying with the Kenya Data Protection Act, 2019.

1. Who We Are

Immani Legal Info is operated by Immani, a platform operating under the immanihub.com domain. Immani provides three services:

• immanihub.com — dispute resolution platform
• legal.immanihub.com — free legal information (this platform)
• blog.immanihub.com — articles and updates

Immani is the data controller for the personal data collected on this platform. Our ODPC (Office of the Data Protection Commissioner) registration is in progress under the immanihub.com entity.

2. What Data We Collect

We collect the following personal data when you use this platform:

• Phone number — used for login via SMS OTP (one-time password). We collect your phone number to verify your identity and create your account.
• OTP codes — 4-digit verification codes sent to your phone. These are stored temporarily and deleted after verification or expiry.
• Chat history — the questions you ask and the responses the AI gives. This is stored to maintain your conversation history across sessions.
• Session tokens — authentication tokens that keep you logged in. These expire after 30 days.
• Uploaded documents — if you upload documents for analysis, comparison, or chat, the text content of those documents is processed by the AI.
• Payment data — if you purchase a subscription (hour, daily, weekly, or monthly pass), we process your M-Pesa transaction via Safaricom's Daraja API. We store the transaction reference, amount, and tier purchased. We do not store your M-Pesa PIN.
• Usage data — the number of questions you ask per day, used to enforce free tier limits and subscription entitlements.

3. How We Use Your Data

We use your personal data for the following purposes:

• To authenticate you via SMS OTP and manage your login session
• To store and display your chat history so you can revisit conversations
• To process documents you upload for analysis, comparison, or chat
• To process M-Pesa payments for subscription purchases
• To enforce free tier limits and subscription entitlements
• To improve the quality and accuracy of the legal information provided
• To maintain the security and integrity of the platform

4. Legal Basis for Processing

We process your personal data on the following legal bases under the Data Protection Act, 2019:

• Consent — you provide your phone number voluntarily to create an account and use the platform
• Performance of a contract — processing is necessary to provide the service you requested (chat, document analysis, drafting)
• Legitimate interest — maintaining security, preventing abuse, and improving the service
• Legal obligation — retaining records as may be required by Kenyan law

5. Data Retention

We retain your personal data for the following periods:

• OTP codes: Deleted after verification or 5 minutes after generation, whichever comes first
• Session tokens: Deleted after 30 days or when you log out, whichever comes first
• Chat history: Retained until you delete the conversation. You can delete any conversation at any time using the delete button in the sidebar
• Uploaded documents: Document text is processed in memory for the current session. Court judgments you upload are analyzed privately and are NOT saved to any shared knowledge base. Your documents remain private to you. Personal documents (contracts, letters, etc.) are not permanently stored unless you explicitly save them
• Payment records: Retained for 7 years as required for financial record-keeping under Kenyan tax law
• Usage data: Reset daily. Historical usage data is not retained beyond the current subscription period

6. Data Sharing and Third Parties

We do not sell, rent, or trade your personal data. We share data with the following third-party service providers only as necessary to operate the platform:

• Mobile Sasa — sends SMS OTP messages to your phone number. They receive your phone number and the OTP code only
• Safaricom M-Pesa (Daraja API) — processes M-Pesa payments. They receive your phone number and payment amount. We do not share your chat content or documents with Safaricom
• Cloudflare — hosts our database (D1), key-value storage (KV), and AI processing (Workers AI). Cloudflare processes data on its global infrastructure. See Cloudflare's Privacy Policy

We do not share your chat content, uploaded documents, or personal data with any other third party. We will only disclose your data if required by law, court order, or lawful request from Kenyan authorities.

7. Cross-Border Data Transfer

Your personal data is processed on Cloudflare's global infrastructure, which may include servers located outside Kenya. We rely on Cloudflare's data protection safeguards, including their compliance with international data protection standards. By using this platform, you acknowledge that your data may be transferred to and processed in countries outside Kenya.

8. Your Rights Under the Data Protection Act

Under the Kenya Data Protection Act, 2019, you have the following rights:

• Right to be informed — you have the right to know what data we collect and how we use it (this policy)
• Right of access — you can request a copy of all personal data we hold about you
• Right to rectification — you can ask us to correct inaccurate personal data
• Right to erasure — you can ask us to delete your personal data. You can also delete conversations yourself at any time
• Right to object — you can object to our processing of your data for specific purposes
• Right to data portability — you can request your data in a structured, machine-readable format

To exercise any of these rights, email us at support@immanihub.com. We will respond within 30 days.

9. Data Security

We take the following measures to protect your personal data:

• All data in transit is encrypted using HTTPS/TLS
• Passwords and sensitive credentials are stored as encrypted secrets, not in code
• Access to admin functions is restricted and authenticated
• We use Cloudflare's security infrastructure, including DDoS protection and Web Application Firewall
• OTP codes expire after 5 minutes and are rate-limited to prevent abuse

Despite these measures, no system is 100% secure. If a data breach occurs that affects your personal data, we will notify you and the Office of the Data Protection Commissioner within 72 hours, as required by Section 43 of the Data Protection Act, 2019.

10. Children's Data

This platform is not directed at children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

11. Your Choices

You can exercise the following choices at any time:

• Delete conversations — use the delete button next to any chat in the sidebar
• Log out — this deletes your current session token
• Request data deletion — email support@immanihub.com to have all your data deleted
• Stop using the platform — you can stop using the platform at any time

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page and update the "Last updated" date above. We encourage you to review this page periodically.

13. Complaints

If you believe we have not handled your personal data in accordance with this policy or the Data Protection Act, 2019, you have the right to lodge a complaint with the Office of the Data Protection Commissioner:

• Website: www.odpc.go.ke
• Email: complaints@odpc.go.ke

← Back to Immani Legal Info