Privacy Policy

Akubrecah ("we", "us", or "our") operates the website at akubrecah.com and its subdomains (the "Service"). We provide an independent third-party convenience service for retrieving Kenya Revenue Authority (KRA) PIN and Compliance Certificates. We are not affiliated with, endorsed by, or officially connected to the Kenya Revenue Authority.

For the purposes of the Kenya Data Protection Act 2019, Akubrecah acts as the Data Controller for personal data you provide through this Service.

Contact: privacy@akubrecah.com

We collect only the minimum data required to perform the requested service:

• Identity data: National ID number or KRA PIN number
• Contact data: Email address, phone number (when provided)
• Account data: Name, username, password (hashed) — stored via Clerk authentication
• Document data: National ID images uploaded for the Change Particulars service
• Usage data: Anonymous analytics via Vercel Analytics (no cookies, no personal identifiers)
• Session data: Temporary session tokens for CAPTCHA processing — deleted immediately after use

We do not collect: payment card data, biometric data, or sensitive personal data as defined under Section 2 of the Data Protection Act 2019.

We process your data solely for the following purposes (lawful basis in brackets):

• Retrieving your KRA PIN Certificate or Compliance Certificate from the KRA portal on your behalf [Performance of a contract / Your explicit consent]
• Processing Change of Particulars requests with KRA Support Portal [Your explicit consent]
• Maintaining your user account and authentication [Performance of a contract]
• Improving and monitoring the performance of our Service [Legitimate interest]
• Complying with legal obligations under Kenyan law [Legal obligation]

• Session data & CAPTCHA tokens: Deleted immediately after each request is processed (within seconds).
• ID document uploads: Deleted from our servers within 24 hours of the Change Particulars request being submitted to KRA.
• KRA retrieval results: Never stored. Results are generated and served directly to you in-session only.
• Account data: Retained while your account is active. You may delete your account at any time.

We do not maintain databases of KRA certificates, PIN numbers, or personal details retrieved through this Service.

We share your data with:

• Kenya Revenue Authority (KRA) — your ID/PIN is transmitted to KRA's systems solely to retrieve your requested document. We act as your authorised agent for this purpose.
• Clerk (clerk.com) — authentication provider. Processes account registration, login, and session management. Subject to their Privacy Policy.
• Supabase — database and file storage provider. Data stored in Supabase is encrypted at rest.
• Vercel — hosting provider. Collects anonymous performance analytics with no personal identifiers.

We do not sell, rent, trade, or otherwise disclose your personal data to any other third party for marketing or commercial purposes.

We implement appropriate technical and organisational measures to protect your data, including:

• HTTPS/TLS encryption for all data in transit
• AES-256 encryption for data stored at rest
• No logging or persistent storage of KRA credentials
• Immediate deletion of temporary session tokens
• Access controls limiting employee access to personal data

However, no internet-based service can guarantee absolute security. In the event of a data breach affecting your rights, we will notify you and the Office of the Data Protection Commissioner (ODPC) within 72 hours as required under Section 43 of the Data Protection Act 2019.

As a data subject, you have the following rights:

• Right to access — request a copy of your personal data we hold (Section 26)
• Right to rectification — correct inaccurate or incomplete data (Section 27)
• Right to erasure — request deletion of your data (Section 28)
• Right to restrict processing — limit how we use your data (Section 29)
• Right to data portability — receive your data in a portable format (Section 30)
• Right to object — object to processing based on legitimate interests (Section 31)
• Right to withdraw consent — at any time where processing is based on consent

To exercise any right, email us at privacy@akubrecah.com. We will respond within 21 days as required by law. You may also lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke.

This Service uses Vercel Analytics, which is cookieless and does not track individual users or store personal information. No advertising or third-party tracking cookies are used.

Authentication cookies set by Clerk are strictly necessary for logging in and maintaining your session. These cannot be opted out of while using the authenticated portions of the Service.

See our Cookie Policy for full details.

Your data may be processed in servers located outside Kenya (including the United States and European Union) by our third-party providers (Clerk, Supabase, Vercel). Where such transfers occur, we ensure appropriate safeguards are in place consistent with Section 48 of the Data Protection Act 2019.

We may update this Privacy Policy from time to time. Material changes will be communicated via a notice on our website and, where possible, by email to registered users. Continued use of the Service after the effective date constitutes acceptance of the revised policy.

For any privacy-related queries or to exercise your rights:

• Email: privacy@akubrecah.com
• Website: akubrecah.com
• Postal Address: Nairobi, Kenya