Privacy Policy

Information we collect

• Donations. When you donate through the Site, we collect your name (optional), email address (required), phone number (optional, used for M-Pesa), and the amount and frequency of your gift. Your card or mobile money details are entered directly with our payment processor, Paystack — we never see or store them.
• Applications. When you apply for an opportunity or program through the Site, we collect the details you submit (such as your name, email, phone number, and any documents you upload, e.g. a CV) so we can review your application and contact you about it.
• Contact form. The form on our Contact page does not submit data to us directly — clicking "Send message" opens your own email app addressed to info@afosi.org. We only receive what you choose to send from your own email account.
• Chat assistant. Messages you send to the AFOSI website assistant are sent to OpenAI to generate a response and are checked against OpenAI's moderation system before we reply. We rate-limit use of the assistant by IP address to prevent abuse.
• Accessibility interpreter widget. The Site loads a sign-language interpreter widget, provided by Signvrse, to make our content accessible to Deaf and hard-of-hearing visitors. It runs as a script from Signvrse's own servers and reads the page's visible text to generate the interpretation. We have not independently verified everything this third-party widget does beyond that; see Signvrse's own privacy policy for details of how it handles data.
• Cookies and tracking. We do not use cookies, advertising trackers, or third-party analytics on the Site ourselves. The accessibility widget above is a third-party script and may set its own cookies or local storage as part of how it runs. Separately, we use limited browser-local storage on your own device (sessionStorage) so our homepage loading animation doesn't replay on every page you visit — this data stays on your device and is never sent to us.

How we use your information

We use the information above to:

• Process donations, issue receipts, and keep accounting records
• Review and respond to program and opportunity applications
• Respond to questions sent to info@afosi.org
• Operate the website chat assistant
• Meet our legal, financial, and reporting obligations

We do not use your information for third-party advertising, and we do not sell personal information.

Who we share it with

We share personal information only with the service providers that help us run the Site and our programs, and only for the purposes above:

• Paystack — processes donation payments and card/mobile money details
• Supabase — stores site content and application data
• Resend — delivers the email notification that alerts our team to a new application
• OpenAI — processes messages sent to the chat assistant to generate a reply
• Signvrse — provides the sign-language interpreter widget and processes the Site's visible page content to generate its interpretation

Each of these providers processes data under their own security and privacy standards. We do not share your information with anyone else except where required by law.

International transfers

Some of the providers listed above may process or store data outside Kenya. Where that happens, we rely on providers with their own security and compliance standards for handling personal data across borders.

Data retention

We keep donation records for as long as necessary for accounting, audit, and legal compliance purposes. We keep application data for as long as needed to evaluate the application and, if you're selected, to administer your involvement with us. You can ask us to delete your information at any time, as described in Section 6 below, and we will do so unless we're required to keep it for a legal or accounting reason.

Your rights

Under Kenya's Data Protection Act, 2019, you have the right to:

• Know what personal information we hold about you
• Ask us to correct inaccurate information
• Ask us to delete your information, subject to Section 5 above
• Object to how we use your information
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya

To exercise any of these rights, email us at info@afosi.org.

Children's privacy

The Site's donation, application, and contact forms are not directed at children. If you believe a child has given us personal information through the Site, contact us and we will delete it.

Security

We don't store card or mobile money credentials — these are handled entirely by Paystack under their own security standards. We restrict access to the systems that hold donor and applicant data and keep account credentials and API keys out of our public codebase.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal or operational reasons. The "Effective date" above will be updated accordingly. Continued use of the Site after changes are posted constitutes acceptance of the revised policy.

Contact us

Questions about this Privacy Policy, or requests relating to your personal information, can be sent to: