Privacy Policy

Version v1_2026-05-15 · Last updated 15 May 2026

Draft pending Kenyan legal review. This Policy is in effect for the pilot launch in Meru and Kirinyaga counties. The text will be re-versioned (and you will be asked to re-accept) once it has been reviewed by Kenyan legal counsel and Panda has been registered with the Office of the Data Protection Commissioner (ODPC) under §18 of the Data Protection Act 2019.

1. Who we are & the law that applies

Panda is a horticulture planning and logging tool operated by Upstate Web Co., acting in Kenya under its sister-brand Shira. We are the data controller for personal data processed through Panda. This Policy describes the personal data we collect, why we collect it, how we share it, how long we keep it, and the rights you have under the Kenya Data Protection Act 2019 ("DPA 2019"). If any part of this Policy conflicts with a non-waivable right you have under that Act, the Act prevails.

2. What we collect

Account data — your name, email, phone (optional), county, sub-county, farm name. Required to operate your account.
Farm records — crop, season, acreage, planting / harvest dates, costs, yields, supplier and buyer names. These are your records; we host them so you can access them across devices.
Disease detection — photographs you upload, the model's diagnosis, your opt-in flag for training. Photographs are stored on Cloudflare R2.
Technical data — IP address, browser / device, language, timezone, when you logged in, when you accepted these policies. Captured for security and for the DPA 2019 §30 burden of proof on consent.
Communications — messages you send to support, including attachments.

3. Lawful basis (DPA 2019 §30)

Performance of a contract. Account and farm-record processing is necessary to deliver the service you signed up for.
Consent. Disease-photo training, marketing email, and analytics cookies (when introduced) rely on your specific opt-in. You can withdraw at any time.
Legal obligation. Tax-relevant records (cost and revenue entries) are retained for the period required by the Income Tax Act §23 (currently five years).
Legitimate interest. Fraud prevention, error logging, and aggregate analytics for product improvement, balanced against your rights.

4. How we share data

We do not sell your data. We share with the following processors, each only to the extent strictly necessary:

Hetzner Online GmbH (Germany) — primary hosting for the API and database.
Cloudflare, Inc. (USA / global edge) — DNS, edge caching, R2 object storage for disease photographs.
Resend, Inc. (USA) — transactional email (verification, password reset, receipts).
Sentry (USA) — error monitoring; we do not send identifiable personal data to Sentry, only error stack traces and an opaque user identifier.
Plant disease AI provider (planned, not yet active) — once activated, photographs flagged for training will be sent to a third-party plant-pathology model provider. We will re-version this Policy and re-prompt for consent before any data leaves Panda for this purpose.
Mobile-money providers — when paid tiers launch, transactional data will pass through Safaricom Daraja for M-Pesa. Safaricom's own privacy notice applies to that processing.

5. Cross-border transfers (DPA 2019 §49)

Hetzner stores your data primarily in Germany (EU); Cloudflare's edge network and Resend operate from multiple jurisdictions including the USA. Where data is transferred outside Kenya, we rely on adequacy regimes (EU GDPR) or contractual safeguards. You may request the specific safeguards in place by writing to dpo@shira.farm.

6. Retention

Account & farm records: while your account is active, plus 5 years for tax-relevant records.
Disease photographs: 30 days after deletion request; opted-in photographs retained while opt-in remains in force.
Server logs (IP, request paths): 30 days.
Backup snapshots: 30 days rolling.

7. Your rights (DPA 2019 §§26–35)

You have the right to:

access the personal data we hold about you;
request correction of inaccurate data;
request deletion of your data (subject to legal-retention exceptions);
object to processing based on legitimate interest;
withdraw consent (e.g. for disease-photo training) at any time;
data portability (export your records in a structured format);
lodge a complaint with the Office of the Data Protection Commissioner.

To exercise any of these rights, write to dpo@shira.farm. We will respond within 30 days (DPA 2019 §29).

8. Complaints & the regulator

If you are not satisfied with our handling of your data, you may complain to the Office of the Data Protection Commissioner:

Office of the Data Protection Commissioner
P.O. Box 30920–00100, Nairobi, Kenya
Phone: +254 20 4900800
Email: info@odpc.go.ke
Website: odpc.go.ke

9. Breach notification (DPA 2019 §43)

If we discover a personal-data breach likely to result in risk to you, we will notify the ODPC within 72 hours of becoming aware of it, and notify affected users without undue delay where high risk is involved. Suspected breaches: security@shira.farm.

10. Children

Panda is not directed at users under 18. We do not knowingly collect data from children. If you believe a child has provided personal data, contact us and we will delete it.

11. Changes

We re-version this Policy when our practices or the law change. The version above is canonical; the application will prompt you to re-accept the updated Policy before continuing if the version changes.

12. Contact

Data Protection Officer: dpo@shira.farm
Security incidents: security@shira.farm
General: support@shira.farm