Privacy policy.

Who we are

Tua is a technology product studio based in Nairobi, Kenya. This policy covers the personal data we collect through tua.co.ke, principally through the "Send a brief" contact form.

What we collect

When you submit the contact form, we collect the name and email address you provide, the company or project name and stage you optionally give us, and the text of your brief.

We also automatically record the IP address your request came from. This is used only to rate-limit and screen the form against automated spam, not to identify you personally.

Why we collect it

To read your brief, reply to you, and, where it looks like a fit, arrange a call — this is the entire purpose of the form. IP addresses are kept briefly and solely to stop automated abuse of a public form.

We do not use anything you submit for advertising, and we do not build marketing profiles from it.

Who we share it with

We use a small number of processors to run this site and respond to you. None of them are permitted to use your data for their own purposes:

• Vercel — hosts the site and, as with any web host, sees standard request logs including IP addresses.
• Resend — delivers the email notification that tells us a brief has arrived, which includes what you submitted.
• A database provider — stores your submission durably so we do not lose it if email delivery fails.
• Upstash — briefly holds a counter tied to your IP address, purely to detect and block spam submissions.

We do not sell your data, and we do not share it with anyone else.

Cookies and tracking

This site does not set cookies and does not run analytics, advertising, or tracking scripts of any kind. The only data involved is what your browser sends as part of a normal request, and what you type into the contact form.

How long we keep it

We keep brief submissions for as long as reasonably necessary to respond to you and for our own business records. Rate-limiting data tied to your IP address expires automatically after a short window. You can ask us to delete your submission at any time — see "Your rights" below.

Your rights

Kenya's Data Protection Act, 2019 gives you a number of rights over your personal data. You can ask us to:

• confirm what personal data we hold about you, and access a copy of it
• correct any of it that is inaccurate or incomplete
• delete it, where there is no good reason for us to keep it
• restrict or object to how we use it
• provide it to you in a portable format

To exercise any of these, email us using the address below. You also have the right to lodge a complaint with Kenya's Office of the Data Protection Commissioner (ODPC) if you believe we have mishandled your data.

Security

Data submitted through this site travels over an encrypted connection and is stored in an access-controlled database. No method of transmission or storage is completely secure, but we take reasonable, industry-standard steps to protect what you share with us.

Changes to this policy

We may update this policy as the site or our practices change. The date at the top of this page reflects the last update.