What we do with your information

We build websites, web apps, mobile apps, and the AI and automation behind them. The studio is deliberately small: the person who writes the code is the person you talk to, which also means he is the person who handles anything you send.

Kenya's Data Protection Act 2019 is the law this page is trying to keep. It calls whoever decides what happens to personal data a data controller, and whoever handles it on someone else's instructions a data processor. For our own enquiries and invoices we are the controller. For data inside a system we build for you, you are the controller and we are the processor.

Ferrin must decide whether the studio has to register with the Office of the Data Protection Commissioner, and then say the answer here in one plain sentence. This page claims no registration, certification or accreditation of any kind, because none has been stated.

To reach us about anything on this page, write to support@noxeratech.com or use the contact page.

In practice that is:

• Your name, or a business name.
• An email address, a WhatsApp number, or a phone number — whichever one you used to reach us.
• The contents of the message itself: what you want built, roughly when, roughly what budget.
• If you sign up on the journal page to hear when the first post goes up: your email address, and nothing else.
• If you send a brief from the contact page: the brief goes to WhatsApp or email as you choose. A copy of the same brief goes straight to the studio's own backend, where it is kept as an enquiry so it cannot get lost.
• Anything you attach or share later while we quote and build: briefs, logos, copy, spreadsheets, screenshots, access details.
• If we work together, the ordinary paperwork of a job — invoices, payment references, and the records our tax obligations require.

We do not ask for an identity number, a date of birth, health information, religion or anything else the Act treats as sensitive. If you send something like that anyway, we will ask you whether you meant to.

Payment details. Money reaches us through M-PESA or a bank, and those services keep their own records under their own rules. We see what any recipient sees — the reference, the amount and the name on the payment. We do not hold card numbers, and there is nowhere on this site to type one.

There is no advertising pixel, no session identifier and no visitor counter. Nothing on this site is stored on your device and nothing here builds a profile of you. The cookies page says the same thing in more detail, and tells you how to check for yourself rather than taking our word for it.

Two honest footnotes:

• Fonts. The typefaces on this site are fetched from Google's font servers. No cookie is set by that request, but your browser has to contact Google to get the files, and that request reveals your IP address and the browser you are using. If we move the fonts onto our own server, this paragraph goes away.
• Server logs. Whoever hosts this site sees the requests that reach it, in the ordinary way every web server does. That is the host's record, not ours, and we do not sit and read it.

Ferrin must decide which host serves noxeratech.com, then name it here, say what it logs, say how long the host keeps those logs, and say whether the log data leaves Kenya. Until that is written down, this section is incomplete.

The Act asks for a lawful basis for each use. Ours, in plain words:

• Answering an enquiry. You asked us a question. Replying to it is the obvious reason we have your address.
• Doing the work. Once there is an agreement, we hold what we need to deliver it. That is the contract between us.
• Invoices and books. A business has to be able to show what it was paid and by whom. That is a legal obligation, not a choice.
• Showing our work. We would like to say who we built for. We only do that when you agree, and you can change your mind later. The work page shows one project anonymised with sample data precisely because that client's real data is not ours to show.

We do not send marketing email. The one list that exists is the journal signup: people who asked for a single email when the first post goes up. That address is used for that one email and nothing else, and you can ask us to remove it at any time.

Ferrin must decide what happens to the journal signup list after that first email is sent — kept for later posts only with a fresh yes, or deleted — and write it here.

Building an app means holding the keys to it for a while. If your system stores customer names, orders, bookings or records of any kind, we will have seen them. Three rules cover that:

• We use it only to build, test and fix the thing you asked for.
• We do not copy it anywhere it does not need to be, and we prefer to test on made up data whenever made up data will do the job.
• At handover, the accounts, the database and the credentials go into your name. After that, access we no longer need is access we should no longer have.

Under the Act you are the controller of that data and we are your processor, which means a proper written agreement between us should say exactly this — who may touch it, what happens if there is a breach, and what we do with it when the work ends.

Ferrin must decide whether a short data processing agreement is signed with every client as standard, and attach the template. This paragraph is a promise until then; a signed page is what makes it a duty.

Ferrin must decide the exact rule for access after handover — deleted on the day, or kept for an agreed support window and deleted after. Write the number of days, not the word “promptly”.

We do not sell personal data, we do not rent it, and we do not hand it to anyone for advertising. What does exist is the ordinary set of tools a studio uses to operate: an email provider, a place where code is stored, and hosting for anything running online.

Three of those are worth naming honestly: email sent to us passes through our email provider, our public code lives on GitHub. The journal signup and the copy of each brief sent from the contact page are stored in a hosted database run by a company outside Kenya. Assume each of these is outside Kenya until this page names where it sits.

Data leaving Kenya. The Act sets conditions on moving personal data out of the country. Any tool hosted abroad means your data has left. We are not going to pretend otherwise.

Ferrin must decide and list, by name, every service that touches client or enquiry data — email, storage, hosting, backups, accounting — where each one keeps its data, and on what legal footing the transfer out of Kenya rests. A privacy notice with no named processors is not finished.

We would also hand over data if a Kenyan court or a lawful order required it. If that ever happened and we were allowed to tell you, we would.

The Act says personal data is kept no longer than is needed. That is easy to agree with and useless as an instruction, so a real notice puts numbers against it.

Ferrin must decide four retention periods and write them here as plain numbers of months or years: an enquiry that never became a project; project files after handover; invoices and accounting records, which a tax rule probably fixes for us; backups, which usually outlive everything else and are the ones people forget.

Until those numbers exist, the honest statement is this: we delete what we obviously no longer need, and we have not yet written a schedule that a reader can hold us to. You can ask us to delete something at any time — see your rights below.

The Data Protection Act 2019 gives you rights over your own data. In plain words, you may ask us:

• To show you. A copy of the personal data we hold about you and what we are doing with it.
• To correct it. If something is wrong or out of date, say so and we fix it.
• To delete it. Where we have no continuing reason to keep it. A tax record we are required to keep is the usual exception, and we will tell you if that is why we are saying no.
• To stop. You can object to a use, and withdraw consent you gave for something like being named as a client.
• To hand it over. A copy in a form you can take somewhere else.

Ask by writing to support@noxeratech.com or through the contact page. You will not be charged for asking, and asking will not cost you anything in how we treat you afterwards.

Ferrin must decide the reply time we commit to — and check whether the Act or its regulations already fix a deadline we must meet. State that number here rather than “as soon as possible”.

If we get it wrong. You can complain to the Office of the Data Protection Commissioner, Kenya's data protection regulator. You do not need our permission and you do not have to come to us first, although we would rather you did so that we can fix it. We deliberately do not print the ODPC's contact details here, because a wrong address in a legal page is worse than no address — look them up directly.

If something goes wrong at our end. If data we hold is lost or exposed in a way that could hurt you, we tell you and we follow whatever reporting the Act requires of us.

Plenty of companies write a paragraph here about military grade encryption. We are one person in Nairobi, so here is the honest shape of it instead: as few copies of your data as the work needs, one person with access, and no third party dashboard quietly holding a mirror of your project.

That is a real advantage and it is also a real risk, because one person is one person. A page like this should say precisely what protects your data.

Ferrin must decide and write the true list: how devices are locked and encrypted, where passwords live, whether two factor authentication is on for every account that touches client data, how backups are made and where they sit, and what happens to client projects if he is unavailable. Write only what is actually true on the day it is written.

Nothing here is designed for a child to use, and we do not knowingly collect a child's personal data through this site. If you believe a child has sent us something, write to support@noxeratech.com and we will delete it.

Some projects legitimately involve young people — a school system, a youth programme, a club. The Act treats children's data as needing extra care, and so do we: in that work, consent comes from a parent or guardian, we collect the least we can, and real names are kept out of anything shown publicly. That is exactly why the conference operations project on the work page is shown anonymised with sample data and always will be.

This version is dated 2026-10-01. When a lawyer has been through it, the date will change and so will most of the pink boxes. If a change affects something we are already doing for you, we tell you directly rather than expecting you to notice a date.

We keep no archive of old versions yet. If you need to know what this page said on a particular day, ask and we will dig it out of version control.