Privacy Policy

1. Who we are

OrnisNest is poultry farm management software. This policy explains what personal data we collect, why, who we share it with, how we protect it, and your rights under Kenya's Data Protection Act, 2019. It applies to our website, the OrnisNest app, and the emails and messages we send.

For your account and our website, OrnisNest is the data controller. For the records a farm enters, the farm owner decides what is recorded and who has access, and we process those records to provide the service. If you are a worker invited to a farm, the farm owner can see the records you enter.

2. Information we collect

• Account details: your name, email address, a securely hashed password and, if you choose, a phone number.
• Profile preferences: language, time zone and notification settings.
• Farm membership: the farms you belong to, your role, and invitations you send or receive.
• Farm records: farms, flocks, bird counts, eggs, feed, water, deaths and culls, weight samples, and who recorded each entry and when.
• Session and security data: your device and browser type, sign-in times and active sessions. We don't use your IP address to work out your location.
• Enquiries: what you send us through our forms, email or WhatsApp.
• Diagnostics: error reports and technical logs.

If a farm owner or manager invited you, they gave us your email address so we could send the invitation. We use it only for that invitation and, if you accept, to run your account. We don't collect sensitive personal data such as health or biometric data about people.

3. How we use information

• To create and run your account and provide farm records, dashboards and reports (performance of our contract with you).
• To send service emails such as invitations, password resets, security alerts and the reminders you turn on (contract).
• To keep the service secure, prevent abuse and fix errors (our legitimate interest in a safe, reliable service).
• To answer your enquiries (steps you asked us to take, or our legitimate interests).
• To send product news and tips, only with your consent, which you can withdraw at any time.

Your name, email and password are needed to create an account; without them we can't provide the service. Everything else is optional. No law requires you to give us this data.

4. Farm and operational data

Your farm records belong to you. We host and process them only to provide, secure and support the service. We never sell personal data or farm data, and we never use identifiable data for commercial purposes without your express consent. We may use aggregated, anonymised statistics that can't identify you or your farm to improve the product.

People with access to a farm, as set by its owner, can see that farm's records, including who recorded each entry. Other farms can't see your data.

5. Data storage and security

Our application servers and database are hosted in Germany (EU). Some of our service providers are based in the United States. We transfer data outside Kenya because it is necessary to provide the service you signed up for, and we rely on written data processing agreements, encryption in transit and our providers' security certifications as safeguards. You can ask us for details.

• Encrypted connections (HTTPS) for all traffic.
• Passwords stored only as secure hashes. Sign-in links and tokens are never stored or logged in readable form.
• Short-lived sign-in tokens and a secure, HttpOnly session cookie limited to sign-in.
• Access controls so each person sees only the farms they belong to, and a list of active sessions you can sign out of.

If a breach puts you at real risk of harm, we will notify the Data Protection Commissioner within 72 hours and tell you in writing what happened and what you can do.

We keep account and farm records while your account is active. If a subscription expires, records stay available read-only so you can view them or renew. When you ask us to delete your account or farm, we delete or anonymise the data within 30 days, except where the law requires us to keep it, such as billing records for tax purposes.

6. Sharing with third parties

We share personal data only with providers who help us run OrnisNest, under agreements that require them to protect it and use it only on our instructions:

• Render: application servers and background jobs (Germany).
• Our database host (Germany).
• Vercel: web app hosting and delivery.
• Resend: sending emails (United States).
• Sentry: error monitoring (United States).
• Payment providers, such as Safaricom M-PESA, once paid plans are live.

We may also disclose data where the law or a court order requires it. If OrnisNest is sold or merged, your data may move to the new owner under this policy, and we will tell you first.

7. Your rights and choices

Under the Data Protection Act, 2019 you have the right to be informed about how we use your data, to access it, to correct it, to have data we're no longer entitled to keep deleted, to object to processing including direct marketing, to withdraw consent, and to receive your data in a machine-readable format to move it elsewhere.

To use any of these rights, contact us through the Contact page. We may need to confirm your identity first. If you're unhappy with how we handled your data, you can complain to the Office of the Data Protection Commissioner (odpc.go.ke).

OrnisNest is a business tool for people aged 18 and over. We don't knowingly collect data from children.

8. Cookies

The OrnisNest app uses one essential cookie that keeps you signed in securely. The service can't work without it, so it doesn't need consent. If we add other cookies, we will update this section and ask for your consent where the law requires it.

9. Changes and contact

If we make material changes to this policy, we will tell you by email or in the app before they take effect. For any privacy question or request, contact the team through the Contact page.