Privacy Policy

• For merchants and visitors to keni.co.za, Keni is the responsible party. We decide why and how your information is processed.
• For customers of merchant stores, the merchant is the responsible party and Keni is their operator. We process your information on the merchant's behalf, only to run their store, and not for our own purposes. Questions about how a store uses your information should go to that merchant first. We will help them respond.

From merchants:

• Account details: your name, email address, phone number and password (stored hashed, never in plain text).
• Business details: business name, store name, address and contact details.
• Store content: products, services, prices, images, videos, text, and your orders and bookings.
• Billing: your subscription, AI credit and domain purchase history, your credit usage, and the payment references Paystack returns. Your card details are entered with Paystack. Keni never sees or stores your full card number.
• Payment connection: the API keys for your own payment provider account, stored encrypted.
• AI use: the instructions, prompts and files you give our AI features, and what they produce.
• Support: messages and reports you send us.

From customers of merchant stores (on the merchant's behalf):

• Name, email address, phone number and delivery address.
• Order and booking details, and account details if you create an account.
• Conversations with a store's chatbot.
• Payment: card details are entered with the merchant's payment provider, not with Keni. We receive only the payment reference and status.

From visitors to keni.co.za:

• Your email address, if you join our waitlist.
• What you send through the Report Issue form: your description, an optional email address and an optional screenshot.

From everyone: technical information such as IP address, browser type and pages visited, used for security, to keep the Service running, and to show merchants how their store is performing. We use cookies that are needed to keep you signed in and the Service secure.

• To provide the Service: running your account and store, processing orders and bookings, and powering the features you use.
• To bill you: charging your subscription and keeping billing records.
• To keep Keni safe: preventing fraud, abuse and unauthorised access, and enforcing our Acceptable Use Policy.
• To contact you: service messages such as receipts, security alerts and changes to our terms, and responses to your support requests.
• Marketing: product news and waitlist updates, only where you have agreed or where the law allows it for existing customers. Every marketing email has an unsubscribe link.
• Legal obligations: keeping records the law requires, and responding to lawful requests.

We do not sell personal information.

• When you use an AI feature, we send the information that feature needs, such as your prompt, product details or image, to our AI providers to generate the result.
• A store's chatbot uses that merchant's product information to answer customer questions. Conversations are stored so the merchant can review them.
• We do not use your content or your customers' data to train AI models.

We share personal information only with service providers that help us run Keni, under agreements that require them to protect it and use it only for that purpose:

• Google Cloud: hosting, database and file storage, in the Johannesburg region.
• Paystack: subscription, AI credit and domain payments to Keni. Store payments are handled by each merchant's own payment provider.
• Resend: sending email.
• AI providers (such as Google, OpenAI and fal.ai): generating AI results.
• domains.co.za and the ZA Central Registry: your registrant details, when you buy a domain through Keni, as needed to register it.

We may also disclose information where the law requires it, to protect people from fraud or harm, or as part of a sale or merger of our business, in which case this policy continues to apply.

Our main data is stored in South Africa. Some of our service providers, including our AI and email providers, process information in other countries such as the United States. We only use providers that are bound by data protection terms or laws giving protection substantially similar to POPIA, as section 72 of POPIA requires.

• All connections to Keni are encrypted with TLS.
• Passwords are hashed, and payment provider keys are encrypted at rest.
• Access to production systems and secrets is restricted to what each part of the system needs.
• If a security breach affects your personal information, we will notify the Information Regulator and you, as POPIA requires.

No system is completely secure, but we take reasonable technical and organisational steps to protect your information.

• Account and store data: for as long as your account is open.
• After your account closes: deleted or anonymised within a reasonable period, except where we must keep it longer by law.
• Billing and financial records: 5 years, as required by South African tax law.
• Customers' data held for a merchant: for as long as the merchant's store is active, or until the merchant deletes it.
• Waitlist emails: until you unsubscribe or Keni launches to you.

Under POPIA, you have the right to:

• ask whether we hold personal information about you, and for a copy of it;
• ask us to correct or delete information that is wrong, out of date or no longer needed;
• object to the processing of your information in certain circumstances;
• withdraw your consent where we rely on it, and unsubscribe from marketing at any time; and
• complain to the Information Regulator at inforegulator.org.za.

To exercise these rights, email team@keni.co.za. We may need to confirm your identity first. If you are a customer of a merchant store, we will pass your request to that merchant and help them respond.

Keni is not intended for anyone under 18, and merchants must be 18 or older. We do not knowingly collect personal information from children.

If we change this policy in a way that materially affects you, we will tell you by email or in the Keni dashboard before the change takes effect. The "last updated" date above shows when it last changed.