Privacy Policy

1. Introduction

CodeHive Inc. ("CodeHive", "we", "us" or "our") is a software engineering studio based in Nairobi, Kenya, providing web, mobile, AI, USSD and bulk SMS development, together with hosting, domain, email and related infrastructure services (collectively, the "Services"). This Privacy Policy explains how we collect, use, disclose, store and protect personal data when you visit our website, request a quote, engage us for a project, use our client portal, or otherwise interact with us.

This policy is written to align with the Kenya Data Protection Act, 2019 and the regulations issued under it, and reflects practices we apply consistently to clients across the region we serve. By using our website or Services, you acknowledge that you have read and understood this policy. If you do not agree with it, please do not use our website or Services, or contact us first with any concerns using the details in Section 15.

2. Information we collect

We collect information in three broad ways: what you give us directly, what our systems generate as you use our Services, and what we receive from trusted third parties who help us operate.

2.1 Information you provide directly

Contact and lead details — name, company, email, phone number, budget range and project description, submitted through our contact form, quote requests or careers applications.
Account credentials — email address and authentication data when you register for or sign in to the client portal (handled via our authentication provider, Supabase).
Project and billing information — scope documents, project requirements, uploaded files, invoices, installment schedules, and payment method details (e.g. M-Pesa, bank transfer or Pesapal transaction references) needed to deliver and bill for work.
Support communications — messages, support tickets, and attachments you send us through the portal, our public chat/assistant widget, email or phone.
Careers information — CVs, cover letters and related material submitted through our careers pages.

2.2 Information collected automatically

Usage data — pages visited, referring URLs, device and browser type, approximate location derived from IP address, and timestamps of activity on our website and portal.
Portal activity — actions taken on projects, invoices, tickets and notifications, used to keep your dashboard accurate and to maintain an audit trail of account activity.
Cookies and similar technologies — described in Section 5 below.
Chat and assistant interactions — messages you send to our on-site chat widget or AI assistant, which may be logged to improve response quality and follow up on unresolved queries.

2.3 Information from third parties

We may receive limited information from payment processors (for example, confirmation that a payment reference was successful), domain registries and hosting partners (for provisioning and renewal notices), and analytics providers, strictly to support delivery of the Services.

3. How we use your information

We use personal data only for purposes connected to running our business and delivering the Services, including to:

Respond to enquiries, prepare quotes and onboard new clients;
Deliver, maintain and support contracted projects, hosting, domains and related services;
Generate, send and reconcile invoices and payment records, including partial/installment payments;
Operate the client portal, including projects, tickets, messages and notifications;
Provide customer support and respond to messages sent via chat, the portal, email or phone;
Send transactional communications (invoice reminders, ticket updates, project status, security notices);
With your consent or where permitted, send occasional updates about our services, blog content or offers;
Monitor, secure and improve our website, portal and infrastructure, including detecting fraud, abuse or unauthorized access;
Comply with tax, accounting, contractual and other legal obligations; and
Evaluate applications submitted through our careers pages.

4. Legal basis for processing

Where the Kenya Data Protection Act, 2019 or a similar regional data protection law applies, we rely on one or more of the following legal bases for each processing activity:

Performance of a contract — to onboard you, deliver a project, provide hosting, or operate your portal account;
Consent — for optional marketing communications, non-essential cookies, and voluntary submissions such as careers applications;
Legitimate interests — to secure our systems, prevent fraud, improve our Services and respond to enquiries, balanced against your rights; and
Legal obligation — to meet tax, accounting, licensing and regulatory requirements.

You may withdraw consent-based processing at any time without affecting the lawfulness of processing carried out before withdrawal.

5. Cookies & tracking technologies

We use cookies and similar technologies (such as local storage) to keep you signed in, remember your language and currency preferences, and understand how our website and portal are used.

Strictly necessary cookies — required for authentication, session security and core site functionality; these cannot be disabled without affecting the site.
Preference cookies — remember choices such as language, currency and theme.
Analytics cookies — help us understand aggregate traffic and usage patterns so we can improve the site.

Most browsers let you refuse or delete cookies through their settings. Blocking strictly necessary cookies may prevent you from signing in or using the client portal.

We do not sell personal data. We disclose it only in the following circumstances:

Service providers — infrastructure, payment, communication and analytics partners who process data on our behalf under confidentiality and data-processing obligations (see Section 7);
Professional advisers — accountants, auditors or legal counsel, where necessary and under confidentiality;
Legal and regulatory bodies — where required by law, court order, or to protect our rights, property or safety, or that of our clients or the public;
Business transfers — in connection with a merger, acquisition or sale of assets, subject to equivalent protections for your data; and
With your direction — where you ask us to share information with a named third party (for example, a collaborator on your project).

7. Third-party service providers

We rely on a small number of established providers to run our website, portal and back office, including:

Supabase — authentication, database and file storage powering the client portal;
Payment facilitators — M-Pesa, Pesapal and our banking partners, used to process and confirm invoice payments;
Email and SMS delivery providers — used to send transactional notifications, invoices and support messages; and
Hosting and infrastructure providers — used to host our website, client portal and, where contracted, client applications and mailboxes.

Each provider is contractually restricted to using data only to provide the service we've engaged them for.

8. International data transfers

Some of the providers listed in Section 7 may process or store data outside Kenya. Where this occurs, we take reasonable steps to ensure the receiving party maintains a standard of protection consistent with the Kenya Data Protection Act, 2019 — including contractual safeguards and, where applicable, reliance on providers certified under recognized international frameworks.

9. Data retention

We retain personal data only as long as necessary for the purposes described in this policy, specifically:

Leads and enquiries that don't convert to a client relationship are retained for up to 24 months, then deleted or anonymized;
Client, project, invoice and payment records are retained for the duration of the engagement and thereafter for as long as required by Kenyan tax and company law (generally up to 7 years);
Portal accounts are retained while active; you may request deletion as described in Section 10, subject to records we must legally keep; and
Careers applications are retained for up to 12 months for consideration against future openings, unless you ask us to delete them sooner.

10. Your rights

Subject to applicable law, you have the right to:

Access the personal data we hold about you;
Correct inaccurate or incomplete data;
Request deletion of your data, subject to legal or contractual retention requirements;
Object to or restrict certain processing, including direct marketing;
Request a copy of your data in a portable format; and
Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us using the details in Section 15. We will respond within the timeframes required by applicable law. If you are not satisfied with our response, you may lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya, or the equivalent authority in your jurisdiction.

11. Data security

We apply technical and organizational safeguards appropriate to the sensitivity of the data we hold, including encrypted connections (HTTPS/TLS), role-based access control across our admin and portal systems, authenticated database access, and regular review of access permissions for staff. No method of transmission or storage is completely secure; if we become aware of a breach affecting your personal data, we will notify affected individuals and, where required, the relevant regulator, in line with our legal obligations.

12. Children's privacy

Our website and Services are directed at businesses and individuals aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

13. Third-party links

Our website, blog and portal may link to third-party sites (for example, social media profiles or partner tools). We are not responsible for the privacy practices of those sites, and we encourage you to review their own privacy policies.

14. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Services, or legal requirements. Material changes will be reflected by an updated "Effective" date at the top of this page, and where appropriate, we will notify active clients by email or through the portal. Continued use of our website or Services after changes take effect constitutes acceptance of the revised policy.

15. Contact us

Questions, requests, or concerns about this Privacy Policy or how we handle your data can be directed to:

admin@codehiveinc.com
🇰🇪 +254 741 649 050
🇹🇿 +255 782 551 407
Nairobi, Kenya — Serving East Africa

You may also read our Terms of Service for the terms governing use of our Services, or visit our contact page to reach us directly.