Privacy Policy
This policy explains what Verisha processes when you use its Kenyan legal, tax, land and firm tools, why we process it, who may receive it, and how to exercise your rights.
- Effective
- 30 August 2026
- Last updated
- 30 August 2026
- Policy version
- 2026-08-30
The short version
- We do not sell personal data.
- KRA, land-registry, identity and marketing uses are feature-specific and controllable.
- AI output is information, can be wrong, and must be checked before you act.
- Account controls let you manage consents, request an export or request deletion.
Scope and our role
This policy applies to the Verisha website, web and mobile applications, API, messaging channels and support interactions that link to it. “Verisha”, “we” and “us” mean the operator of those services. Verisha is the data controller for people who use the service directly.
When a law firm or organization submits client, employee or end-user data, that organization may be the controller and Verisha may process the data on its instructions. In that case, contact the organization first for a request about data it controls; we will assist it as required.
Data we process
The data depends on the features and channels you choose. Required fields are identified at collection; if you do not provide them, the relevant account, search, filing, payment or delivery may not work.
| Category | Examples | Typical source |
|---|---|---|
| Account and contact | Name, email address, phone number, authentication identifier, language, role, organization or firm, team membership and notification preferences. | You, your identity or sign-in provider, or a firm administrator who invites you. |
| Questions and work content | Questions, prompts, documents, contract text, matter notes and memory, land parcel references, seller contact details, tax details and returns, uploaded images, voice or audio, support tickets and feedback. | You, your firm or an authorized integration. |
| Identity and sensitive data | Where you choose a relevant feature: national ID, passport, alien card or KRA PIN details; identity-check results; facial or liveness evidence; financial, property, tax or client information. We only request these where the feature needs them. | You, a person you are authorized to represent, or the selected official or identity service. |
| Service and transaction records | Searches, reports, watches, tax filings, generated agreements, wallet and firm-credit activity, quotes, purchases, invoices, payment status and provider references, consents, accepted policy version, audit records, API keys and webhook configuration. | Created as you use the service and by payment or official-service providers. |
| Device, security and usage | IP address, browser and device information, session and push tokens, request and error logs, rate-limit and fraud signals, page or feature events and performance measurements. Product events use categorical properties and are designed not to include legal text, document contents, parcel, tax or contact data. | Your device, our systems and security or analytics providers. |
| Public and connected-source data | Legislation, judgments, Gazette notices and other public records; and, only for the feature you request, records or status returned by land, tax, business, vehicle, court or identity systems. | Official publications, public records, connected services and authorized searches. |
Purposes and lawful bases
We process only for an identified purpose and lawful basis under the Data Protection Act, 2019. More than one basis may apply to a record, and we do not rely on consent where the processing is required to perform a service you requested or meet a legal obligation.
| Purpose | What we do | Lawful basis |
|---|---|---|
| Provide the service | Create and secure your account; answer questions; generate, save and deliver requested reports, documents and filings; run searches and watches; provide team, API and support features. | Performance of our contract or steps you request before entering it. We use consent where the feature expressly requires it. |
| Official connections and optional features | Connect to KRA, Ardhisasa or another selected service; request registered-owner approval; use identity, voice, marketing or auto-top-up features. | Your specific consent, your instructions, and/or contract necessity depending on the feature. You can withdraw an optional consent, but this does not undo processing already lawfully completed. |
| Payments and records | Show a price before charge, process a top-up or purchase, maintain the wallet or firm pool, issue records, prevent duplicate charges and handle reversals or disputes. | Contract necessity and compliance with tax, accounting, anti-fraud and other legal obligations. |
| Safety, support and improvement | Authenticate requests, prevent abuse, investigate incidents, resolve support issues, measure reliability and understand privacy-safe feature use. | Our legitimate interests in a secure, reliable and useful service, after considering your rights; and legal obligations where applicable. |
| Service communications and marketing | Send sign-in links, receipts, requested reports, security and service notices, support replies and, only where allowed, product updates or offers. | Contract necessity or legal obligation for service messages; consent or another lawful basis required by law for marketing. Marketing can be switched off or unsubscribed from. |
We do not sell personal data. If we ever propose a new incompatible purpose, we will give an appropriate notice and obtain consent where the law requires it.
Public and official sources
Verisha indexes or searches public and official material such as Kenya Law legislation and judgments, Kenya Gazette notices and other legally available records. A free parcel snapshot uses available public signals; it is not a land-registry search and does not establish ownership or a clean title.
An official land search, KRA action or other connected-service request sends only the information needed for that request. Where registered-owner consent is required, the search does not proceed without that consent. Disconnecting or revoking an optional connection stops future access but cannot reverse an official action already completed.
Public availability does not remove every privacy duty. We use public-record data only for relevant product purposes and provide a channel to raise an accuracy, context or rights concern.
AI and automated processing
Verisha uses AI to retrieve relevant sources and generate plain-language answers, risk signals, summaries, document analysis, extractions, drafts, transcriptions and voice responses. The selected prompt, content and source context may be sent to the active AI or speech provider for that request.
When a question asks about recent developments, and the feature is configured, Verisha may run a separate rolling-window search of jurisdiction-specific official sites and current news. Before that search, the query is shortened and obvious personal or matter identifiers are removed. Search snippets are isolated from reviewed legal authority: they can flag a possible update, but they cannot by themselves verify a legal claim, citation or confidence score.
Voice providers are replaceable and are used only when their feature is configured. Microphone audio, transcript text and the minimum session instructions needed for transcription or speech may be sent to the selected provider. Long-lived provider keys stay on Verisha servers; preview voice models, voice cloning, provider search and provider conversation-history retention are off unless separately reviewed and enabled.
AI output may be incomplete, outdated or wrong. It is information, not legal, tax, valuation or investment advice, and it does not replace a licensed advocate or an official record. Verify citations, current law and official records before acting.
The service does not use AI by itself to decide whether you have a legal right, receive credit, obtain employment or qualify for a government service. Where applicable law gives you rights concerning a solely automated decision with legal or similarly significant effect, you may request an explanation, correction and human review through the contact routes below.
Transfers outside Kenya
Verisha is built in Kenya, but some infrastructure and specialist providers process data in the European Union, the United Kingdom, the United States or other countries used by their networks and sub-processors. The main application database is configured in an EU region; that does not mean every service or transmission stays in the EU.
For a transfer outside Kenya, we use the mechanism that applies to the transfer: appropriate contractual, technical and organizational safeguards; necessity for your requested contract or a legal claim; or explicit informed consent where required, particularly for sensitive personal data. We document transfers and assess provider safeguards as required by Kenyan law.
How long we keep data
We keep personal data only while reasonably necessary for the stated purpose. The actual period depends on the record, whether your account or a requested service remains active, legal and contractual duties, dispute and fraud risk, and secure backup cycles. We periodically review whether continued storage is necessary and then delete, anonymize or restrict data as appropriate.
| Record category | Retention rule |
|---|---|
| Personal data exports | Download links expire after 15 minutes. Verisha revokes access and starts provider deletion within 24 hours. The private storage object is then permanently purged by the storage lifecycle after its 30-day deletion grace; no Verisha product flow can restore or download it during that grace period. |
| Account and active work | While your account is active and for as long as needed to provide the workspaces, reports, watches, filings, documents or memory you keep. Deleting an item or requesting account deletion starts the applicable deletion or restriction process. |
| Filed tax records | Generally for five years from the end of the reporting period to which the record relates under section 23 of the Tax Procedures Act, or a shorter period specified by another tax law. A record may need to remain longer for an amended return, proceeding, investigation or legal claim. |
| Payments and firm billing/audit | For the period reasonably needed for accounting, regulatory, fraud-prevention, dispute and legal-claim obligations. After account erasure, required payment and firm billing/audit records are retained only as lawfully necessary, with the live account identifier replaced or other identifiers minimized where possible and access restricted. They are not used for marketing or ordinary product personalization. |
| Marketing suppression | A minimal opt-out or suppression record is kept for as long as needed to honor your instruction and prevent account deletion, list imports or another workflow from accidentally re-enabling marketing. It is used only to suppress marketing, not to target it. |
| Support and communications | Until the request is resolved and for as long as reasonably needed to document the resolution, prevent repeat abuse or establish and defend a claim. |
| Security, cache and delivery data | Normally for short operational windows set by the relevant system, unless an incident, fraud investigation or legal obligation requires longer preservation. |
| Backups and de-identified data | Deleted data may remain in protected rotating backups until those backups are overwritten and is not restored except for recovery. Properly anonymized statistics that no longer identify a person may be kept for service and research purposes. |
Cookies and analytics
The web app uses an essential secure session cookie and Firebase browser persistence so you can remain signed in. Browser storage also remembers language and theme, pending sign-in or referral state, payment-return status and interface preferences. Clearing site data may sign you out or reset those preferences.
When configured, PostHog uses browser identifiers to measure explicit page, performance, acquisition and product events. It is configured for an EU endpoint, no person profiles, no automatic page or DOM capture, no session recording or heatmaps, and respect for the browser’s Do Not Track setting. Analytics is not used to send the content of your questions, documents, parcels, tax records or forms.
You can use browser controls to block or clear storage and enable Do Not Track. Strict blocking of essential authentication or payment-return storage may prevent those features from working.
Security
We use measures appropriate to the data and risk, including authenticated access, role and firm scoping, encrypted transport, private file links, processor contracts, rate limiting, audit records, redaction rules and access controls. Payment-card details are collected by the payment provider; Verisha does not store full card numbers.
No system is perfectly secure. Protect your device and sign-in method, use only authorized workspaces and tell us promptly if you suspect unauthorized access. If a personal-data breach creates a real risk of harm, we will investigate and notify affected people and the ODPC where Kenyan law requires.
Your rights and choices
Subject to the Data Protection Act and applicable exceptions, you may ask to be informed, access or receive a portable copy, object to or restrict processing, correct inaccurate or misleading data, delete data that should not be retained, withdraw consent, and seek review of a qualifying solely automated decision.
- Use Account → Privacy & data to manage KRA, Ardhisasa and marketing consents, request a data export or start an account-deletion request.
- For a correction, objection, restriction, complaint or request that is not available in the account, use Account → Help or the configured contact route below. State the right you want to exercise and the account or record concerned; do not send passwords or one-time codes.
- We may verify identity and authority before acting, especially for sensitive, firm or third-party data. We respond to an erasure request within fourteen days and follow the other request-specific periods in the General Regulations. We explain if a lawful exception, retention duty or another controller limits the request.
Read the ODPC’s official summary of data-subject rights.
Children and other people’s data
Verisha is not designed for children to create accounts or submit legal, land, tax, identity or payment information on their own. A person without legal capacity should use the service only through a parent, guardian or other person lawfully authorized to act for them.
If you submit data about a client, seller, owner, employee, child or any other person, you are responsible for having an appropriate authority and lawful basis and for giving any notice required. Registered-owner consent is collected separately where an official land process requires it. Contact us if you believe a child’s data was submitted without proper authority.
Contact, complaints and changes
For privacy questions or requests, use Account → Help. A visitor without an account can use the configured Contact links in the website footer.
If we do not resolve a data-protection concern, you may lodge a complaint with Kenya’s Office of the Data Protection Commissioner under section 56 of the Act. Use the official ODPC complaint form.
We may update this policy when the service, providers or law changes. We will publish the new date and version here and give an in-product notice or request renewed acceptance when a change materially affects your rights or the agreed service. Earlier acceptance remains recorded against its version.
Official legal sources
These primary sources inform this policy. The links open the official Kenya Law or ODPC publication; they are provided for transparency and do not replace legal advice.