Loading...
Here to Help!
Version 1.0.1 Effective date: 28 August 2026 Last updated: 28 August 2026
Husika operates the Husika public-participation website and is the controller of personal data described in this policy. You can contact Husika about privacy, legal questions or data rights at [email protected].
This policy covers the Husika public website, accounts and participation features. It does not cover the separate Husika Consulting website or third-party websites linked from Husika.
Depending on how you use Husika, we may handle:
Account and profile information: name, email, phone number, username, display name, password credential, verification state, optional demographic and location details, biography, profile image, links, participation points and privacy preferences.
Participation information: policy feedback, comments, survey answers, service reviews, event registrations, blog contributions, reports, likes, notification preferences and files you choose to upload.
Contact and subscription information: contact messages, subject, email, phone number, newsletter interests, communication channels and opt-in or opt-out state.
Technical and usage information: authentication tokens, language choice, anonymous-survey participant token or digest and, where collected, browser, operating system, device, IP address, request, activity and performance data.
Information from a sign-in provider: if you choose Google sign-in, Google may share profile and email information permitted by the sign-in flow.
A public profile may show your stable ID, username, display name, biography, profile image, participation points, member-since date and verified or bot indicators. It is not designed to show your email, phone number, national ID, exact date of birth, precise address, roles or account status.
Do not assume that policy feedback is anonymous. The current feedback form sends a guest's name and email, or uses account details for a signed-in user. An anonymous survey is a separate flow. Its participant cookie reduces repeat responses but does not prove one person has responded only once.
We use information to:
create, authenticate and manage accounts and profiles;
provide surveys, feedback, comments, events, subscriptions and other participation features;
respond to questions and send requested service or account messages;
administer, protect and maintain the service, prevent misuse and preserve platform integrity;
measure and improve technical performance and usage; and
process account export and deletion requests.
Depending on the activity, the processing basis may be your consent, providing the service you request, meeting a legal obligation, or Husika's legitimate interests in security and platform integrity after considering people's rights and interests. A single basis does not apply to every activity. Where processing depends on consent, you may withdraw it for future processing, although this does not undo processing already carried out.
The signed-in data-usage setting is not proof of consent for every activity or for technologies that run before sign-in.
Information you deliberately place on a public profile or in public content can be seen by visitors. Other records are available to authorised administrators where needed to operate the service. We may disclose information where Kenyan law requires it or where necessary to protect lawful processes, users or the service.
Current production and implemented services include:
Vercel: hosts frontend functions in the United States region `iad1`. Vercel's public-site experience runtime was not observed in the production review on 28 August 2026.
Cloudflare: provides edge delivery and security. Automatic Cloudflare Insights RUM injection is disabled. Any app-controlled RUM integration is optional and must remain off until the visitor grants analytics consent.
Azure Blob Storage: used for assets. The exact production storage region has not been verified.
Resend: an email-delivery integration exists. Its operational processing location for Husika has not been verified.
Google: Google OAuth is enabled. It is used only when you choose Google sign-in and may set Google cookies and share the information described in the sign-in flow.
AI assistant: the assistant interface is enabled. Active provider names and processing locations have not been verified. Do not enter secrets or sensitive personal information in the assistant.
No Google Analytics, PostHog, Segment or Mixpanel browser analytics was observed in the production review. No public document embeds were present at that time. This describes what was observed, not a guarantee that the service will never change.
Some processing may therefore occur outside Kenya. We do not claim that another country's laws are equivalent to Kenyan law. Contact [email protected] for current information about a provider, processing location or safeguards relevant to a transfer.
Husika and service providers use cookies, local storage and session storage for language, authentication, survey participation, temporary sign-in or comment state, interface preferences and the production technologies described above. The site presents optional analytics and experience choices before those categories can run. You can reject optional categories, accept them, or reopen Cookie preferences in the footer to change or withdraw your choice. Withdrawing consent stops future optional use and clears removable optional browser storage controlled by Husika.
See the Cookie Policy for names, purposes, observed lifetimes and browser choices.
Husika uses purpose-based retention: we keep information only for as long as it is reasonably needed for the purpose described, security and integrity, dispute handling, or a legal obligation. Retention differs by record type, and Husika does not claim a single complete automatic deletion schedule.
Implemented account tools work as follows:
a completed account-deletion request has a 30-day grace period by default;
completion anonymises specified account fields, closes the account and soft-deletes the user record;
permanent hard purge is a separate operator-triggered action and is not automatic; related records may remain where needed for integrity or a lawful reason;
an account-export artifact is marked as available for up to 48 hours by default, but automatic deletion of an expired artifact has not been demonstrated; and
user-activity cleanup has a 30-day default, but this is not a complete retention schedule.
If you download an export, protect it and delete your copy when no longer needed. You may ask [email protected] about the retention of a particular record or request follow-up on an expired export artifact or deletion request.
Signed-in users can update available profile information and use Settings → Privacy & Data to change the data-usage setting or request and track an account export or deletion. The current export gathers profile, event-registration, feedback, newsletter and blog information. It has not been demonstrated to include every record linked to you, so Husika does not describe it as a complete export.
Depending on the circumstances and Kenyan law, you may ask to access, correct, delete, restrict or object to processing of your personal data, or withdraw consent where consent is the basis. Email [email protected]. State what you need and provide enough information for Husika to verify the request without sending passwords or authentication tokens. Husika will explain any lawful limitation and respond within the period required for the request.
You may also raise a concern with the relevant Kenyan data-protection authority.
Husika is intended for adults aged 18 and over. If you are under 18, do not create an account or submit personal information through participation features.
New account creation requires a date of birth and the server applies the 18th-birthday boundary using the Africa/Nairobi calendar date. Missing, invalid, future or under-18 dates are rejected. Husika retains the birth year in the account record rather than the full date used for this eligibility check. Existing-account sign-in is not a new eligibility decision.
Husika uses measures such as access controls, hashed passwords and refresh tokens, encrypted stored social-provider tokens, protected anonymous-survey cookies, request throttling and restricted public-profile fields. No internet service is risk-free. Husika does not claim a compliance certification, audit result or level of security that has not been verified.
We may update this policy when the service or its data practices change. A new version will show its effective and updated dates. Material changes may also be highlighted through an appropriate service notice.
For privacy, legal or data-rights questions, email [email protected].