Privacy Policy

1. Information we collect

Information you give us

• Account information. Your first and last name, your mobile number and, if you choose to add it, your email address. You also choose a PIN, which we store only as a one-way hash that can't be turned back into the PIN.
• Farm information. Your farm's name and, if you add one, a description of its location in your own words. The places on your farm (such as cages, trays and rooms), your batches and their stages, feeding records, moves, splits and harvest weights, and who recorded each one.
• Team information. Who belongs to a farm, their role (owner, manager or worker) and whether they receive SMS alerts.
• Communications. What you tell us when you call, email or message us, or fill in our waitlist or partner forms.
• Agreements. When you rent or buy a kit or join our pilot, we keep the signed agreement, which includes your name, phone number, farm location and payment records. Rental and instalment agreements also record a national ID number.

Information collected when you use the Services

• Verification codes. One-time codes we text you when you sign up or reset your PIN. They expire after 5 minutes.
• Usage and device information. The version of the app you use and when you last used it; your device's IP address, which our servers receive with every request; and failed sign-in attempts, which we count to protect your account.
• Crash reports. If the Android app crashes, Google Firebase Crashlytics sends us a report of what went wrong, your phone's model and Android version, and an identifier for that installation of the app. We don't attach your name, phone number or farm records to crash reports.
• Information stored on your phone. The app keeps your profile, a copy of your farm and records waiting to be sent, so you can keep recording without signal. Your sign-in session is stored encrypted.

Information from sensors

A Mkuu-lima sensor measures the air temperature and humidity in a cage, the temperature of the substrate in its trays and, where fitted, its battery level. It sends these readings to our servers over Wi-Fi on a schedule set for your farm. Each sensor is identified by its hardware address and a secret key we issue to it. Readings are linked to your farm, so we protect them like the rest of your information.

Information from other people

A farm owner may invite someone to join their farm by entering that person's mobile number. If the number doesn't have an account yet, we text it an invitation. If you received an invitation you didn't expect, you can ignore it or contact us and we'll remove it.

Information we don't collect

We don't collect your phone's location, your contacts, photos or files, advertising identifiers, or payment card details. Nothing is paid inside the app.

2. How we use information

We use information to:

• Provide the Services: create and run your account, show your farm and its conditions, keep your records, and work out when to alert you.
• Send you messages: verification codes, alerts when conditions on your farm need attention and when they're back to normal, invitations to join a farm, and confirmations such as when an account is deleted.
• Keep the Services secure: verify your phone number, lock an account after repeated wrong PINs, limit how many codes can be sent, and keep a record of changes to accounts and farm records.
• Support you: answer your questions, fix problems and tell you when an update to the app is needed.
• Improve the Services: fix crashes, and study combined figures from many farms, with names removed, to improve how farms raise Black Soldier Fly.
• Meet our legal obligations: for example, keeping business and tax records.

We process information to perform our agreement with you, for our legitimate interests in running and protecting the Services, to comply with the law, and with your consent where we ask for it. You can withdraw consent at any time.

We don't sell your information, use it for advertising, or make decisions about you by automated means alone.

3. How we share information

With your farm team

People on the same farm see each other's names, roles and the farm's records. The farm's owner also sees team members' phone numbers.

With our staff

Our staff who install sensors and support farms can see accounts and farm records, to set up equipment and help you. Every change they make is recorded.

With service providers

We use these companies to run the Services on our behalf. They may use your information only to provide their service to us.

For legal reasons

We may disclose information if we believe in good faith that the law, a court order or a government authority requires it, or to protect the safety, rights or property of our users, the public or Rethink Organic.

In a business transfer

If Rethink Organic is involved in a merger, acquisition or sale of assets, your information may be transferred as part of that transaction. We'll tell you before it becomes subject to a different privacy policy.

Combined, de-identified information

We may publish or share findings from many farms combined, such as average harvests, in a form that can't reasonably identify you or your farm. We'll ask your permission before publishing photos, your name or results from your farm.

4. Your choices and rights

Under Kenya's Data Protection Act, 2019 you have the right to be informed about how we use your information, to access it, to correct it, to have it deleted, to object to its use, and to receive your information in a format you can use elsewhere.

• SMS alerts: each person can switch their own alerts on or off in the app, under Me → My SMS alerts.
• Export: owners and managers can download a farm's records in the app, under the farm's Settings → Export data.
• Delete your account: in the app, under Me → Account → Delete my account, or by contacting us. Delete your account explains what is deleted and what is kept.
• Other requests: contact us. We'll confirm it's you by texting a code to your account's number, and reply within 30 days.

You can also complain to the Office of the Data Protection Commissioner (odpc.go.ke).

5. How long we keep information

We keep information only as long as we need it for the purposes in this policy, or as the law requires.

Things you delete in the app, such as a farm, a place, a batch or a record, are kept for 7 days in case they were deleted by mistake, and are then removed.

6. How we protect information

We use safeguards designed to protect your information, including:

• encryption in transit (HTTPS) between the app, the sensors and our servers;
• PINs and sensor keys stored only as one-way hashes;
• your sign-in session stored encrypted on your phone, and accounts locked after three wrong PINs;
• access limited to the farms each person belongs to, by their role; and
• a record of changes to accounts and farm records.

No system is completely secure. If a breach puts your information at risk, we'll notify you and the Data Commissioner as the law requires.

7. International transfers

Our servers are in Belgium and Ireland, and some providers process information in other countries. When we transfer information outside Kenya, we use providers bound by strong data protection laws, such as the European Union's General Data Protection Regulation, and contracts that require them to protect it.

8. Children

The Services are intended for adults running farms. They aren't directed to anyone under 18, and we don't knowingly collect information about children.

9. Cookies and similar technologies

This website doesn't use cookies, analytics or advertising trackers. The Mkuu-lima app stores information on your device, as described in section 1, only so that it works.

10. Changes to this policy

We may update this policy from time to time. We'll change the effective date at the top and, if the changes are significant, tell you in the app and ask you to accept them before you continue.

11. Contact us

Have a question about this policy or your information? Contact us.