Privacy policy

This policy explains how Kova handles information when you create an account, run a business in the workspace, or open a public store. It is written for the Kenya Data Protection Act, 2019.

Kova is the service. The business owner remains responsible for the customer information they choose to keep in Kova, including leads and WhatsApp conversations that continue outside Kova.

When you create an account, we hold your name, email address, and a password that is stored so it cannot be read back.

When you set up a business, we hold the details you enter: the business name, description, industry, location, phone, email, and WhatsApp number, plus the Business Brain you write (profile, audience, brand, goals, and policies).

When you sell, we hold product photos, names, prices, descriptions, and the public store page. When you use Talk to Kova, we hold the messages in that workspace and the drafts Kova prepares. When you record a lead, we hold the name, source, and notes you save.

A public store shows the product and business details you publish. Anyone with the link can open that page.

We use this information to run your account, publish the store, prepare listings and posts, keep leads, and write the morning brief from your own business records. We also use it to keep the service secure and to answer a request you send us.

Product photos, business context, and the text you submit can be sent to the AI provider described on the AI usage page, so Kova can draft a listing, a post, a reply, or a brief. Market research uses publicly available web pages.

Sign-in uses one essential cookie, described on the cookies page. Kova does not set advertising or analytics cookies.

We keep account and business information while the account is open. After you close the account, we keep what we still need for security, a dispute, or a legal duty, and then delete or de-identify the rest.

You can review and edit your business, products, and policies in the workspace. You can ask to access, correct, or delete the personal information we hold about your account. Send that request from the email on your Kova account and put Privacy in the subject.

If you store a customer’s details as a lead, you are the person they dealt with. Handle that information in line with your own duty to them.

The sign-in refresh credential is stored in an HttpOnly cookie so page scripts cannot read it. The short-lived access token stays in memory for the session. Use a unique password and sign out on a shared device.

If this policy changes, the date at the top of the page changes with it. Continued use of Kova after that date means the updated policy applies.