Privacy Policy

Apptuned Limited (“Apptuned”, “we”, “our”, “us”) is a company incorporated in Kenya. We operate the website at apptuned.app and the SaaS applications available through it. Our registered address is Upperhill Business Park, Nairobi, Kenya.

For data protection enquiries, contact us at: hello@apptuned.app

2.1 Data you provide directly

• Contact form submissions: name, email address, phone number, organisation name, enquiry message, and areas of interest.
• Newsletter sign-up: email address and optional first name.
• AI chat conversations: the text of messages you send to our AI assistant, linked to an anonymous session ID (not to your identity unless you choose to share it).
• Account information (if you create an account): name, email address, and hashed password.

2.2 Data collected automatically

• Usage data: pages visited, time on page, clicks, and scroll depth — collected via privacy-respecting analytics (no cross-site tracking).
• Technical data: browser type, device type, operating system, referring URL, and approximate geographic region (country/city level only — never precise location).
• Cookies: we use strictly necessary session cookies and optional analytics cookies. We do not use advertising or behavioural-profiling cookies. See Section 9 for details.

2.3 Cognitive assessment data (where applicable)

If you use Apptuned’s AI cognitive assessment products, we collect your responses to assessment questions and generate a cognitive strengths profile. This data is classified as sensitive personal dataunder Kenya’s Data Protection Act 2019 and special category data under GDPR. We process it only with your explicit consent and strictly for the purpose of providing your results.

We never sell your personal data. We share it only with trusted sub-processors necessary to deliver our services:

• Supabase (database hosting) — EU-based servers, SOC 2 Type II certified.
• Resend (email delivery) — for transactional emails only; compliant with CAN-SPAM and GDPR.
• OpenAI / xAI (AI inference) — chat messages may be processed by the AI provider to generate responses. We use data minimisation: we never send your name or contact details to AI providers.
• Vercel (hosting) — global CDN; data processed in accordance with GDPR Standard Contractual Clauses.

All sub-processors are bound by Data Processing Agreements (DPAs). We review them annually.

• Contact enquiries: 3 years from last contact, then deleted.
• Newsletter subscribers: until you unsubscribe, then deleted within 30 days.
• Chat logs: 12 months (for quality improvement), then anonymised.
• Assessment results: kept for the duration of your account or until you request deletion.
• Account data: until account deletion, then purged within 30 days.

Under Kenya’s Data Protection Act 2019 and, where applicable, the EU GDPR, you have the right to:

• Access a copy of your personal data.
• Correct inaccurate data.
• Delete your data (“right to be forgotten”).
• Restrict processing in certain circumstances.
• Data portability — receive your data in a machine-readable format.
• Object to processing based on legitimate interests.
• Withdraw consent at any time (where processing is consent-based).
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya.

To exercise any right, email hello@apptuned.app. We will respond within 30 days.

• All data in transit is encrypted with TLS 1.3.
• Data at rest is encrypted using AES-256.
• Database access uses Row Level Security (RLS) and least-privilege service roles.
• Admin access requires multi-factor authentication.
• We conduct regular dependency audits and penetration tests.
• No sensitive neurodiversity data is stored in browser localStorage or session storage.

As a Kenyan company serving a global audience, some of your data may be processed outside Kenya (e.g. by Vercel’s global CDN or OpenAI’s servers in the US). Where such transfers occur, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) and adequacy decisions where available.

We use three categories of cookies:

• Strictly necessary: session management, dark/light mode preference, accessibility settings. These cannot be disabled.
• Analytics (optional): anonymous page-view counts using privacy-first tools. No cross-site tracking. You can opt out in the accessibility settings panel.
• Preference: language, theme, and accessibility settings stored locally.

We do not use advertising, retargeting, or social media tracking cookies.

Our website is not directed at children under the age of 16. Where our educational products are used with young people, this is done through institutional agreements with schools or guardians who are responsible for obtaining appropriate parental consent. We do not knowingly collect personal data directly from children.

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top and, for material changes, notify registered users by email. Continued use of the site after changes constitutes acceptance of the updated policy.

For privacy-related questions or to exercise your rights, contact our Data Protection Officer at: