Privacy Policy

1. Introduction

This Privacy Policy explains how DataYetu (“we”, “us”) collects, uses, stores, and shares personal data when you use our websites and contributor platform.

We process personal data in line with the Data Protection Act, 2019 (Kenya) and, where applicable, other data protection laws. For this programme, Kenyan law is our primary compliance framework.

Effective date: 3 August 2026 (version 2026-08-03).

2. Data controller and contact

DataYetu is the data controller for personal data described in this Policy.

Privacy contact: hello@datayetu.com. You may also contact the Office of the Data Protection Commissioner (ODPC) in Kenya regarding your rights.

3. Personal data we collect

Account data: name, email, authentication identifiers (for example via Clerk), and organisation membership/roles.

Contribution data: text you type; audio you record or upload; optional metadata such as language, city, channel, or device context; timestamps; and technical file metadata (size, mime type, content hash).

Work activity: annotation/review labels, session timing, quality scores, issues you report, and pipeline stage for tasks you touch.

Payments data: reward ledger entries, withdrawal requests, blockchain wallet address, chain, and currency. We do not need your bank password; you provide a wallet address for stablecoin payouts.

Consent records: Terms/Privacy versions, hashes, URIs, and acceptance timestamps used for audit and provenance.

Technical logs: IP address, user agent, and security logs reasonably needed to operate and protect the service.

4. Purposes and lawful bases

Provide the platform and your account (contract / legitimate interests).

Collect, review, package, and commercialise datasets for AI training and evaluation, based on your consent and the Contributor Terms (consent / contract).

Pay compensation and prevent fraud (contract / legitimate interests / legal obligation where applicable).

Security, abuse prevention, and debugging (legitimate interests).

Legal compliance, including data protection and responding to lawful requests (legal obligation).

Provenance/audit systems (including TRACE-ready registration of non-identifying metadata) (consent / legitimate interests).

5. Commercial AI training use

When you contribute, you consent that your submissions and related annotations may be used to train and evaluate commercial AI systems and may be licensed to customers as part of DataYetu datasets.

Dataset exports use anonymised annotator/reviewer IDs. Public provenance records should not include your direct identifiers.

You should avoid including unnecessary personal data about yourself or others inside free-text or spoken contributions.

6. Sharing

Service providers that process data for us (hosting, storage, authentication, email, analytics) under appropriate agreements.

Customers and partners who license datasets—receiving contribution content and labels under commercial agreements, not your account email or wallet by default.

Professional advisers and authorities where required by law.

Blockchain networks if you withdraw stablecoins: wallet address and transfer details become visible on-chain according to that network’s public nature.

7. International transfers

Infrastructure or vendors may process data outside Kenya. Where we transfer personal data internationally, we take steps consistent with the Data Protection Act, 2019 (for example appropriate safeguards and necessity for contract performance).

8. Retention

Account and consent records are kept while your account is active and for a reasonable period afterward for audit, dispute, and legal compliance.

Approved contributions incorporated into dataset releases may be retained indefinitely as part of those products, consistent with the licence you granted.

Rejected or raw contributions may be deleted or de-identified on a shorter cycle, subject to security and abuse-prevention needs.

9. Security

We use access controls, encrypted transport (HTTPS), and least-privilege practices. No method of transmission or storage is perfectly secure; please use a strong password/auth method on your account.

10. Your rights (Kenya)

Subject to the Data Protection Act, 2019, you may have rights to access, correct, delete, restrict, or object to certain processing, and to withdraw consent where processing is consent-based.

Withdrawing consent does not affect the lawfulness of processing before withdrawal, and may not require deletion of contributions already licensed into released datasets where another lawful basis or contractual necessity applies—we will explain options when you request.

To exercise rights, email hello@datayetu.com. You may lodge a complaint with the ODPC.

11. Children

The contributor programme is not directed to persons under 18. We do not knowingly collect contributions from children.

12. Changes

We may update this Privacy Policy by posting a new version. Material changes affecting contribution processing will be surfaced for renewed acknowledgement where appropriate.