Privacy Policy

Miliki is based in Nairobi, Kenya. We provide an AI-powered wealth diagnostic service for Kenyan individuals.

Data Controller: Miliki
Data Protection Officer: Brian Kuria
Email: dpo@miliki.app

Our registration status. Miliki is not currently registered with the Office of the Data Protection Commissioner (ODPC). We operate under the registration exemption for small data controllers in Regulation 13(2) of the Data Protection (Registration of Data Controllers and Data Processors) Regulations 2021 — our annual revenue and our headcount are both below the thresholds it sets. This affects only whether we appear on the ODPC register. It does not reduce any of your rights below, and it does not change our duties under the Kenya Data Protection Act. We monitor both thresholds and will register if we cross either one.

• Account data: name, email address, phone number, county
• Assessment data: your answers to financial diagnostic questions including income, spending, debts, savings, and financial behaviours
• Payment data: M-Pesa transaction references, payment amounts, payment status
• Report data: your AI-generated wealth diagnostic report including wealth score, constraint analysis, and action plan
• Usage data: login timestamps, page views, device information (no tracking cookies)

• To provide the wealth diagnostic service you requested (contractual necessity)
• To process your M-Pesa payment (contractual necessity)
• To send SMS reminders at day 28, 56, and 84 (legitimate interest)
• To improve our service (legitimate interest, anonymised)

Your financial data — including income, debts, spending patterns, and betting activity — is classified as sensitive data under the Kenya Data Protection Act (KDPA). We process this data only with your explicit consent, which you provide during signup via the consent checkbox.

• Your assessment answers are sent to Anthropic's AI API (Claude) for analysis. Anthropic processes data in the United States. Appropriate safeguards are in place per KDPA Section 48 (cross-border transfers).
• Your payment is handled by a third-party payment processor. We are moving from IntaSend to Paystack, which is becoming our main M-Pesa processor. Both are connected during the changeover: IntaSend stays in place as a fallback and holds the records of any payment made before the switch.
• Either processor receives the same limited details: your email address, your M-Pesa phone number, the KES 1,999 amount, and a payment reference. Your assessment answers and your report are never sent to a payment processor.
• Paystack is a Kenyan company, licensed by the Central Bank of Kenya as a payment service provider. It does, however, run some of its systems outside Kenya — its own policy gives the example of cloud servers in Ireland — so your payment details can be processed abroad. Paystack is bound to us by a data-processing agreement under the Kenya Data Protection Act, and uses Binding Corporate Rules for transfers between its own group companies. We are telling you this before the switch rather than after, as this policy promised.
• SMS reminders are sent via Africa's Talking, a Kenya-based communications provider. You can opt out of SMS reminders at any time by replying STOP to any reminder message. Once opted out, no further SMS reminders will be sent. Your phone number and opt-out preference are retained until you delete your account.
• Email notifications are sent via Resend, an email delivery service that processes data in the European Union (Ireland). Only your email address, first name, and a report link are sent — never your financial data or report contents.
• Our application is hosted on Vercel. Your data is stored in Kenya (see section 6); Vercel handles application requests only.
• If you sign in with Google, Google processes your sign-in identity (United States). You can instead use email or phone sign-in to avoid this.

• Your data is stored on servers located in Nairobi, Kenya (HostAfrica).
• Assessment conversation data (raw answers) is automatically deleted 90 days after report generation.
• You can delete your report at any time, and we delete it when you close your account. If you do neither, we keep it for 24 months — and we only remove it after that if you have also not signed in during those 24 months. We will not delete a report out from under someone who is still using it.
• Security logs (sign-in attempts, with your IP address stored only as a hash) are deleted after 90 days.
• Records of SMS reminders we have sent you are deleted 90 days after sending.
• Payment records are retained as required by Kenyan financial regulations.
• If you do not pay, your assessment data is automatically deleted.

Under the Kenya Data Protection Act 2019, you have the right to:

• Access: Download all data we hold about you — Settings → Download my data
• Correction: Request correction of inaccurate data by contacting us
• Deletion: Delete your account and all associated data — Settings → Delete my account
• Objection: Object to processing by contacting us
• Portability: Export your data in machine-readable format (JSON)
• Automated processing: Your report and wealth score are produced by automated AI analysis of the answers you give us. This is guidance, not a decision imposed on you — you choose what to act on. You can ask how your report and score were produced, or object to automated processing, by contacting our Data Protection Officer. This right is given to you by section 35 of the Kenya Data Protection Act, 2019.

We do not sell your data. We share data only with:

• Anthropic (AI processing) — United States, with safeguards
• Paystack (payments) — Kenyan company; some processing happens outside Kenya
• IntaSend (payments, being retired) — Kenya
• Africa's Talking (SMS) — Kenya
• Resend (email) — European Union (Ireland), with safeguards
• Vercel (application hosting) — data at rest stays in Kenya
• Google (sign-in, only if you use it) — United States

• All data is transmitted over HTTPS/TLS
• Passwords are hashed using bcrypt
• Database access requires authentication
• Rate limiting and account lockout protect against brute-force attacks
• Security headers (CSP, HSTS, X-Frame-Options) are enforced
• Login notifications alert you to new sessions

Brian Kuria (Founder & DPO)
Email: dpo@miliki.app
Response time: 7 days (per KDPA Regulations)

If you have a concern about how we handle your data, please contact our Data Protection Officer first at dpo@miliki.app — we aim to respond within 7 days.

You also have the right, under Section 56 of the Data Protection Act 2019, to lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Britam Towers, 12th Floor, Upper Hill, Nairobi. Email: info@odpc.go.ke.

We may update this policy from time to time. Changes take effect when posted on this page. We encourage you to review this page periodically.