Privacy Policy

Who We Are

Zayara Labs is a software development studio based in Nairobi, Kenya. We design and build websites, mobile applications, SACCO systems, health management platforms, point-of-sale systems, and school management systems for businesses across Kenya and East Africa.

For the purposes of this Privacy Policy, “Zayara Labs”, “we”, “us”, and “our” refer to Zayara Labs. “You” refers to any person who visits our website or submits a quote request or enquiry through our forms.

Data We Collect

We only collect data that you voluntarily provide when you fill in a quote request or contact form on our website. We do not purchase data lists or collect data from third-party sources.

Information you give us directly

• Full name — so we know who we are speaking with.
• Phone number / WhatsApp — so we can respond to your enquiry.
• Email address — if you choose to provide one, for written follow-up.
• Business name — to understand the context of your project.
• Project description, service interest, and budget range — so we can prepare a relevant quote.

Information collected automatically

• IP address — logged with each form submission for fraud and bot prevention.
• Browser user-agent string — logged to detect automated submissions.
• Page visited — we record which form on which page the enquiry came from.

We do not collect payment card details, national ID numbers, or any sensitive personal data as defined under the Kenya Data Protection Act 2019.

How We Use Your Data

We use the data we collect solely for the following purposes:

• To respond to your project enquiry or quote request via phone, WhatsApp, or email.
• To prepare and send you a tailored project proposal.
• To maintain a record of client interactions for business continuity.
• To detect and prevent fraudulent or automated form submissions (honeypot and rate-limiting checks).
• To improve our website based on aggregate, anonymised usage patterns.

We do not use your personal data for any automated decision-making or profiling. We do not send unsolicited marketing emails. We will only contact you in direct response to an enquiry you made, or to follow up on a live project.

Data Storage & Security

Your enquiry data is stored in two places:

• MySQL database on our web hosting server, accessed only by authorised Zayara Labs personnel via secure credentials.
• A flat-file log in a server directory that is blocked from public web access, kept as a backup in the event of database failure.

All data in transit between your browser and our server is protected by TLS/SSL encryption (HTTPS). Passwords and SMTP credentials are stored as server-side constants and are never exposed in public-facing code.

We apply reasonable technical and organisational measures to prevent unauthorised access, disclosure, alteration, or destruction of your personal data. However, no method of internet transmission is 100% secure, and we cannot guarantee absolute security.

Third-Party Services

Our website uses the following third-party services. Each has its own privacy policy.

Google Analytics & Google Ads

We use Google Analytics (GA4) and Google Ads to understand how visitors find and use our website. Google may set cookies and collect anonymised data about your visit. You can opt out via Google’s opt-out browser add-on. See Google’s Privacy Policy.

Microsoft Clarity

We use Microsoft Clarity for session recording and heatmaps to improve the user experience of our website. Clarity may collect mouse movements, clicks, and scroll behaviour in anonymised form. See Microsoft’s Privacy Statement.

Google Fonts

Our website loads fonts from Google Fonts. Google’s servers may log your IP address when fetching font files. See Google’s Privacy Policy.

Email delivery (PHPMailer / SMTP)

When you submit a form, your enquiry details are emailed to our team using our own SMTP mail server (mail.zayaralabs.com). The data included in that email is exactly the data you submitted in the form and is not shared with any other third party.

We do not sell, rent, or trade your personal data to any third party under any circumstances.

Cookies

Our website uses the following types of cookies:

• Session cookies — used only for rate-limiting on form submissions. These expire when you close your browser and contain no personally identifiable information.
• Analytics cookies — set by Google Analytics to track aggregate, anonymised page-view data.
• Advertising cookies — set by Google Ads to measure campaign performance.
• Clarity cookies — set by Microsoft Clarity for anonymised session analysis.

Most browsers allow you to refuse or delete cookies. Disabling analytics cookies will not affect the functionality of our website.

Your Rights

Under the Kenya Data Protection Act 2019, you have the following rights regarding your personal data:

• Right of access — you may request a copy of the personal data we hold about you.
• Right of rectification — you may ask us to correct inaccurate data.
• Right of erasure — you may ask us to delete your data, subject to any legal obligation we have to retain it.
• Right to withdraw consent — you may ask us to stop contacting you at any time.
• Right to lodge a complaint — you may lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya.

To exercise any of these rights, contact us using the details in Section 11.

Data Retention

We retain enquiry data for as long as is necessary for the purposes described in this policy, or as required by Kenyan law. In practice:

• Enquiries that did not result in a project are kept for 12 months and then deleted.
• Records relating to active or completed projects are kept for 5 years for accounting and dispute-resolution purposes.

You may request early deletion of your data at any time by contacting us at projects@zayaralabs.com.

Children’s Privacy

Our website and services are intended for business owners, managers, and adults aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18. If you believe a minor has submitted data to us, please contact us immediately so we can delete it.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. When we do, we will update the “Last updated” date at the top of this page. We encourage you to review this page periodically.

Continued use of our website after any changes constitutes your acceptance of the updated policy.

Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, please reach out:

To lodge a formal complaint, you may also contact the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke.