Privacy Policy

This Privacy Policy describes how Clarika ("Clarika", "we", "us") collects, uses, and protects personal data when you use our document intelligence platform and related services (the "Service").

Draft template: This document is pending review by Kenyan counsel and may change before final publication.

1. Who we are

Clarika provides a B2B document extraction and workflow platform. For the purposes of the Kenya Data Protection Act, 2019 ("Kenya DPA"), Clarika acts as a data controller for account and billing data we collect directly from you, and as a data processor when we process documents and extracted data on your instructions.

Contact: security@clarika.co.ke

2. Data we collect

We may collect:

• Account data: name, email address, workspace membership, role, authentication identifiers
• Profile data: optional phone number for verification, notification preferences
• Document and extraction data: files you upload, schemas, extracted fields, review decisions, pipeline configuration
• Usage and technical data: API requests, error logs, device/browser metadata, IP address (for security and rate limiting)
• Analytics data (optional): product usage events when you accept analytics cookies (see Section 8)
• Support communications: messages you send to our support team

We do not intentionally collect special categories of personal data unless you include them in uploaded documents. You are responsible for ensuring you have a lawful basis to upload document content.

3. How we use data

We process personal data to:

• Provide, secure, and improve the Service
• Authenticate users and enforce workspace access controls
• Run extractions, pipelines, and human-in-the-loop review workflows
• Send transactional emails (verification, notifications, onboarding)
• Monitor errors and service health
• Comply with legal obligations

Lawful bases (Kenya DPA): performance of contract, legitimate interests (security, product improvement), consent (where required, e.g. optional analytics), and legal obligation.

4. Sharing and sub-processors

We use third-party sub-processors to host infrastructure and provide OCR, LLM, email, and monitoring services. A current list with regions and purposes is published at /legal/sub-processors.

We do not sell personal data.

5. International transfers

Some sub-processors are located outside Kenya (including the United States and the European Union). Where required, we implement appropriate safeguards such as standard contractual clauses or equivalent mechanisms approved under the Kenya DPA and guidance from the Office of the Data Protection Commissioner (ODPC).

6. Retention

We retain data for as long as your workspace is active or as needed to provide the Service, comply with law, resolve disputes, and enforce agreements. Document source files may be deleted after a configurable retention window. You may request deletion subject to contractual and legal limits.

7. Your rights

Under the Kenya DPA, you may have the right to:

• Access your personal data
• Rectify inaccurate data
• Object to or restrict certain processing
• Request erasure where applicable
• Lodge a complaint with the ODPC

Workspace administrators should contact us for data subject requests relating to end users in their organization. Individual users may contact security@clarika.co.ke.

8. Cookies and analytics

We use essential cookies for authentication and session management. Optional analytics cookies (PostHog, EU region) are used only after you accept the cookie banner. We do not enable session recording by default.

9. Security

We implement technical and organizational measures including encryption in transit, access controls, audit logging, and PII scrubbing in error monitoring. See SECURITY.md for vulnerability reporting.

10. Changes

We may update this policy. Material changes will be communicated via the Service or email. The version and effective_date at the top of this page indicate the current draft revision.

11. Contact

Questions about this policy: security@clarika.co.ke