1. Introduction
Chatzuri Ltd. ("Chatzuri", "we", "our", or "us") operates the Chatzuri platform — a cloud-based service for building and deploying AI agents for customer support, sales, and user engagement, accessible at https://chatzuri.com.
This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our website and services. It also describes your rights regarding your data and how to exercise them.
By using Chatzuri, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use our services.
2. Data Controller
Chatzuri Ltd. is the Data Controller responsible for your personal data.
Chatzuri Ltd.
Nairobi, Kenya
Privacy Team: privacy@chatzuri.com
General: hello@chatzuri.com
3. Regulatory Compliance & Certifications
Chatzuri is committed to the highest standards of data protection and regulatory compliance. We operate in accordance with the following frameworks and certifications:
Office of the Data Protection Commissioner — Kenya
Registered and certified under Kenya's Data Protection Act, 2019 (Act No. 24 of 2019). Chatzuri is regulated by the Office of the Data Protection Commissioner (ODPC), Kenya.
Kenya Data Protection Act, 2019
All personal data collected from users in Kenya (and globally) is processed in compliance with the Kenya DPA, 2019, which mirrors GDPR principles.
GDPR (EU) 2016/679
We comply with the General Data Protection Regulation for users in the European Economic Area and the United Kingdom.
Google API Services User Data Policy
Our use of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.
4. Google User Data — OAuth & Limited Use
Chatzuri's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
When you sign in to Chatzuri using Google OAuth, we request access to the following Google account information:
- Name: To personalise your account and display your name in the dashboard.
- Email address: To create your account, send service notifications, and identify you across sessions.
- Profile picture: To display your avatar within the Chatzuri interface.
We do NOT:
- ✕Share Google user data with third parties for advertising purposes.
- ✕Use Google user data to train AI or machine-learning models.
- ✕Allow humans to read your Google account data, except with your explicit permission or as required by law.
- ✕Store Google access tokens beyond what is necessary to provide the service.
Google user data is used only to authenticate you and provide the Chatzuri service. You may revoke Chatzuri's access to your Google account at any time via Google Account Permissions.
5. What Personal Data We Collect
We collect the following categories of personal data:
Account Data
Examples: Name, email address, password (hashed), profile picture, job title, company name.
Purpose: To create and manage your account.
Usage Data
Examples: IP address, browser type, operating system, pages visited, session duration, click events.
Purpose: To improve the platform and diagnose issues.
Agent & Conversation Data
Examples: AI agent configurations, knowledge base content, conversation logs.
Purpose: To operate and deliver the Chatzuri service.
Payment Data
Examples: Billing name, email, last four digits of card (processed by Stripe). We never store full card numbers.
Purpose: To process subscription payments.
Communications
Examples: Support emails, feedback messages.
Purpose: To respond to enquiries and improve the service.
6. Legal Basis for Processing
We process your personal data under the following legal bases:
- Contractual necessity: Processing required to deliver the Chatzuri service you have subscribed to.
- Legitimate interests: Fraud prevention, platform security, and service analytics — provided these do not override your rights.
- Legal obligation: Processing required to comply with applicable laws (e.g., tax, ODPC Kenya, GDPR).
- Consent: Marketing communications and cookies (you may withdraw consent at any time).
8. Data Security
We implement robust technical and organisational measures to protect your data:
TLS encryption for all data in transit
AES-256 encryption for data at rest
Role-based access control (RBAC)
Rate limiting and DDoS protection
Regular security audits and penetration testing
AWS infrastructure (SOC 2 compliant)
No AI training on your data
Retrieval-Augmented Generation (RAG) — your data is never used to fine-tune models
9. Data Retention
We retain your personal data for as long as your account is active or as needed to provide the service. Upon account deletion, personal data is deleted within 30 days, except where we are required to retain it by law (e.g., financial records for 7 years under Kenyan tax law). Anonymised aggregate data may be retained indefinitely for analytics purposes.
10. Your Rights
Under the Kenya Data Protection Act, 2019, the GDPR, and other applicable laws, you have the following rights:
Right of Access
Request a copy of the personal data we hold about you.
Right to Rectification
Request correction of inaccurate or incomplete data.
Right to Erasure
Request deletion of your data ("right to be forgotten").
Right to Restrict Processing
Ask us to limit how we use your data.
Right to Data Portability
Receive your data in a structured, machine-readable format.
Right to Object
Object to processing based on legitimate interests or for direct marketing.
Right to Withdraw Consent
Withdraw consent at any time for consent-based processing.
Right to Lodge a Complaint
File a complaint with the ODPC Kenya or your local supervisory authority.
To exercise any of these rights, email privacy@chatzuri.com. We will respond within 30 days.
12. Children's Privacy
Chatzuri does not knowingly collect or process personal data from children under the age of 18. If you believe a child has provided us with their data, contact us at privacy@chatzuri.com and we will delete it promptly.
13. International Data Transfers
Your data may be processed in countries outside Kenya, including the United States (via AWS us-east-1). We ensure appropriate safeguards are in place for such transfers, including standard contractual clauses and compliance with the ODPC Kenya guidelines on cross-border data transfers.
14. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via email or a prominent notice on our website at least 30 days before the changes take effect. Continued use of Chatzuri after that date constitutes acceptance of the updated policy.
15. Contact Us
For any questions, concerns, or data rights requests related to this Privacy Policy, please contact:
Chatzuri Ltd. — Privacy Team
Nairobi, Kenya
Email: privacy@chatzuri.com
You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya at www.odpc.go.ke.