Privacy Policy
This Privacy Policy explains how Volcha Enterprises Limited ("Volcha", "we", "us", "our") collects, uses, discloses, and safeguards personal data when you interact with Fundi Sensei, our AI-powered business assistant. It is published in compliance with the Kenya Data Protection Act, 2019 ("KDPA") and, where applicable, the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR, and the California Consumer Privacy Act / California Privacy Rights Act ("CCPA/CPRA").
1. Scope and who we are
This policy applies to fundi.volcha.co.ke and any subdomain operated by Volcha Enterprises Limited that links to this notice (collectively, "Fundi Sensei" or the "Service"). It does not apply to third-party websites linked from our pages; please read those sites' own policies.
Data Controller: Volcha Enterprises Limited, a company incorporated in Kenya under registration number PVT-XXXXXX, with its registered office at P.O. Box 14676-00100, Nairobi, Kenya. For GDPR purposes, our representative in the European Union can be reached at info@volcha.co.ke. For UK GDPR purposes, our representative can be reached at info@volcha.co.ke.
2. Personal data we collect
We collect the following categories of personal data:
- Identity & contact data: the email address you provide to start a chat, and (if you choose to share them) your name, phone number, company name, and preferred time to be contacted.
- Conversation data: the messages you send to Fundi Sensei, the AI's responses, the structured project brief the AI generates from your conversation, and the agent type assigned to your session.
- Session metadata: a randomly generated session identifier, timestamps of activity, message counts, and the status of the session (active, handed-off, or closed).
- Technical data: IP address, user agent, browser language, and request headers. We use the BotID service from Vercel/Kasada to detect automated abuse, which processes certain request signals. BotID is configured not to use cookies.
- Client-side storage: your email and session identifier are stored in your browser's
sessionStorageso the conversation can resume if you reload the page. We do not use marketing cookies or third-party tracking cookies.
We do not knowingly collect special categories of data (such as health, political opinions, religious beliefs, sexual orientation, or biometric data). Please do not share such information in chat messages.
3. How we use your data
We use your personal data for the following purposes:
- To operate Fundi Sensei and provide conversational AI responses to your questions.
- To generate a structured project brief when you reach the end of a discovery conversation.
- To notify the Volcha team via Telegram when you request a human handoff or reach the message limit, so a team member can follow up.
- To keep your conversation safe, prevent abuse, and protect the security of the Service.
- To comply with our legal obligations and respond to lawful requests from regulators and courts.
4. AI processing and Google Gemini
Fundi Sensei uses Google Gemini (currently the Gemini 3 Flash model family) via the Google AI Studio / Vertex AI API to generate responses. Your conversation messages are transmitted to Google LLC for the sole purpose of generating a response. Specifically:
- Your inputs and the AI's outputs are not used by Google to train its foundation models. This is the default under Google's Generative AI API terms for paid-tier and AI Studio keys.
- Google acts as our data processor under a Data Processing Addendum that includes the European Commission's Standard Contractual Clauses (SCCs) for transfers from the EEA/UK.
- Google may temporarily store prompts and responses for the purposes of abuse detection and service operation, in line with the Generative AI Terms of Service and the Google Privacy Policy.
- Fundi Sensei does not make automated decisions that produce legal effects or similarly significantly affect you (GDPR Article 22). When a conversation is handed off, a human Volcha team member reviews it before contacting you.
For full details on how the AI works, see our AI Disclosure.
5. Legal basis for processing
Under the KDPA and GDPR, we rely on the following legal bases:
| Purpose | Legal basis |
|---|---|
| Operating the chat and generating responses | Performance of a contract / your request to use the Service (KDPA §30(c); GDPR Art. 6(1)(b)) |
| Sending handoff notifications to the Volcha team | Our legitimate interest in responding to enquiries (KDPA §30(d); GDPR Art. 6(1)(f)) |
| Abuse prevention and security | Our legitimate interest in protecting the Service (KDPA §30(d); GDPR Art. 6(1)(f)) |
| Complying with legal obligations | Legal obligation (KDPA §30(b); GDPR Art. 6(1)(c)) |
6. How we share your data
We do not sell your personal data. We share it only with the following categories of recipients, solely to operate the Service:
| Recipient | Role | Data shared |
|---|---|---|
| Google LLC (Gemini API) | Processor | Conversation messages (for AI inference only) |
| Google LLC (Firebase / Firestore) | Processor | Email, session metadata, full conversation history, project brief |
| Exa.ai | Processor | Search queries derived from your messages, when the agent invokes the web search tool |
| Telegram Messenger LLP | Processor | Project brief and contact details, when a handoff is triggered |
| Vercel Inc. / Kasada (BotID) | Processor | IP address, user agent, request signals for bot detection |
We may also disclose data where required by law, to enforce our Terms of Service, or to protect the rights, property, or safety of Volcha, our users, or others.
7. International data transfers
Volcha is headquartered in Kenya. Because we use Google (US), Firebase (US/EU), and Exa.ai (US) as processors, your data may be transferred to and processed in the United States and the European Economic Area. We protect these transfers using:
- Standard Contractual Clauses approved by the European Commission, the UK ICO, and (for KDPA) the Office of the Data Protection Commissioner of Kenya;
- Data Processing Addenda with each sub-processor;
- Encryption in transit (TLS 1.2+) and at rest.
8. How long we keep your data
We retain personal data only for as long as necessary for the purposes set out in this policy:
| Category | Retention period |
|---|---|
| Active conversation data | For the lifetime of the session, plus 24 months of inactivity, after which it is anonymised or deleted |
| Project briefs and handoff records | 24 months from last interaction, for the purpose of providing follow-up services |
| Server logs (IP, user agent) | 30 days |
| Abuse signals collected by BotID | Per BotID's published retention window (see BotID documentation) |
You can request earlier deletion at any time, see your rights below.
9. How we protect your data
We use industry-standard technical and organisational measures to protect your data, including encryption in transit (HTTPS/TLS), encryption at rest in Firestore, least-privilege access controls for Volcha staff, API-key authentication for our external endpoints, and a Web Application Firewall with bot mitigation (BotID). No system is perfectly secure; if a breach affecting your data occurs, we will notify you and the relevant supervisory authority as required by law.
10. Your rights and how to exercise them
Subject to applicable law, you have the right to:
- Access the personal data we hold about you;
- Rectify inaccurate or incomplete data;
- Delete your data (right to be forgotten);
- Restrict or object to certain processing;
- Port your data in a machine-readable format;
- Withdraw consent where we rely on consent;
- Lodge a complaint with a supervisory authority.
See our full Data Subject Rights page for the step-by-step process, response times, and the contact addresses to use. You can also use the in-app controls to export or delete your data at any time.
11. Children's privacy
Fundi Sensei is a B2B service intended for business owners and decision-makers. It is not directed at children under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact info@volcha.co.ke and we will delete it promptly.
12. Changes to this policy
We may update this policy from time to time. When we do, we will revise the "Last updated" date at the top of this page and, for material changes, display a notice in the Service. The current version always supersedes previous versions.
13. Contact and complaints
For any question, complaint, or data-subject request, contact our Data Protection Officer:
Volcha Enterprises Limited, Data Protection Officer
Email: info@volcha.co.ke
Phone: +254 704 987 850
If you are not satisfied with our response, you may lodge a complaint with the Office of the Data Protection Commissioner of Kenya, or, where applicable, with your local supervisory authority in the EEA, the UK, or California.