Privacy Policy - Akili Suite

Section 01

Who We Are

Akili Suite is an intelligence-first legal practice management platform developed and operated by Akili Suite Ltd, a company incorporated in Kenya ("we", "us", or "our").

For the purposes of the Kenya Data Protection Act, No. 24 of 2019 (KDPA) and the EU General Data Protection Regulation (GDPR), Akili Suite Ltd is the Data Controller in respect of personal data collected through this website and the Akili Suite platform.

Company

Akili Suite Ltd

Jurisdiction

Nairobi, Kenya

Data Protection Email

operations@akilisuite.com

General Contact

hello@akilisuite.com

Section 02

Data We Collect

We collect the minimum personal data necessary to provide the Akili Suite platform. The categories of data we process are:

Category	Examples	Source
Identity Data	Full name, job title, role within a law firm	Provided by you at registration or by your firm administrator
Contact Data	Email address, phone number	Provided by you or your firm
Account & Authentication Data	Hashed magic-link tokens, session identifiers, login timestamps	Generated automatically by our system
Professional Data	Matters, case notes, milestones, documents you upload, messages sent through the platform	Provided by you or your firm in the course of using the platform
Financial Data	Invoice amounts, payment status, billing reference numbers	Entered by firm administrators; payment card details are processed exclusively by Paystack and are never stored by us
Technical & Usage Data	IP address, browser type, pages visited, feature usage, error logs	Collected automatically via Cloudflare Analytics
Communications Data	Messages sent between advocates and clients within the platform (CCCC module)	Generated by users during platform use

We do not collect special category data (health, biometric, political, religious, or sexual orientation data) and our platform is not designed or intended to process it. If any such data is incidentally included in documents uploaded by users, it is stored encrypted and is never processed or analysed by us.

Section 03

Why We Collect It

We collect personal data for the following specific purposes:

To create and manage your account and your firm's tenant workspace on the platform
To authenticate users securely using passwordless magic links
To provide the core platform features: matter management, client portals, invoicing, document storage, messaging, and task management
To send transactional emails (magic links, invoice notifications, matter updates) that you have requested
To process subscription payments through our payment partner Paystack
To detect, investigate, and prevent fraud, abuse, and security incidents
To maintain audit logs for legal and regulatory compliance purposes
To improve the platform through aggregated, anonymised usage analytics
To comply with our legal obligations under Kenyan law and applicable international law

We do not use your data for advertising. We do not sell, rent, or trade your personal data to any third party for marketing purposes. Akili Suite products are ad-free by design.

Section 04

Legal Basis for Processing

Under the KDPA (Section 30) and the GDPR (Article 6), we must have a lawful basis for processing personal data. We rely on the following legal grounds:

Performance of Contract

Legal Obligation

Legitimate Interests

Processing Activity	Legal Basis
Providing the platform services and core features	Performance of contract (KDPA s.30(b), GDPR Art.6(1)(b))
Sending magic link authentication emails	Performance of contract
Marketing emails, product updates, newsletters	Consent (KDPA s.30(a), GDPR Art.6(1)(a)) - you may withdraw at any time
Processing billing and subscription data	Performance of contract
Maintaining audit logs and activity records	Legal obligation (KDPA s.30(c), GDPR Art.6(1)(c))
Security monitoring and fraud prevention	Legitimate interests (KDPA s.30(f), GDPR Art.6(1)(f))
Aggregated, anonymised analytics for product improvement	Legitimate interests

Section 05

How We Use Your Data

Akili Suite is a multi-tenant platform. This means your data is logically isolated within your firm's tenant workspace. Advocates at Firm A cannot access the data of Firm B under any circumstances. Tenant isolation is enforced at the database level on every query.

Your personal data is accessed by our systems in the following ways:

Automated processing - our platform automatically generates notifications, invoice reminders, and smart dunning messages based on your firm's data. No human at Akili Suite reads these messages.
AI Document Search - the Document Intelligence Centre (DIC) uses AI to enable semantic search across your uploaded documents. Your documents are processed only within your tenant's isolated context. Document content is never used to train external AI models.
Support access - our support team may access your account data only with your explicit permission and only for the purpose of resolving a support ticket you have raised. All support access is logged in the audit trail.
Platform improvement - we use anonymised, aggregated telemetry (never identifiable personal data) to understand feature usage and improve the product.

Section 06

Who We Share Your Data With

We do not sell or share your personal data with third parties for their own commercial purposes. We share data only with trusted sub-processors who help us deliver the platform, each bound by data processing agreements that are at least as protective as this policy.

Sub-Processor	Purpose	Location
Cloudflare	Infrastructure, CDN, D1 database, R2 storage, KV, Workers runtime, DDoS protection	USA (EU/global edge)
Resend	Transactional email delivery (magic links, notifications)	USA
Paystack	Payment processing and subscription billing	Nigeria / USA
Anthropic (Claude API)	AI-powered document search (DIC module) - document excerpts only, never full files	USA

Law enforcement disclosure. We will only disclose personal data to law enforcement or government authorities when legally compelled to do so by a court order, regulatory directive, or equivalent legal instrument. We will notify you of any such request unless legally prohibited from doing so.

Section 07

International Data Transfers

Our platform is built on Cloudflare's global edge infrastructure. This means that while your data is stored in Cloudflare's D1 database and R2 object storage, certain requests may be processed at edge nodes in jurisdictions outside Kenya and the EEA.

We ensure all international transfers are protected by one or more of the following safeguards:

Adequacy decisions - where the destination country has been recognised as providing adequate data protection
Standard Contractual Clauses (SCCs) - the EU Commission-approved SCCs are incorporated into our agreements with all US-based sub-processors
Data Processing Agreements - binding contractual commitments requiring equivalent protection to this policy

Under the KDPA Section 48, personal data of Kenyan data subjects may be transferred outside Kenya only where adequate safeguards exist. We comply with this requirement through the contractual mechanisms described above.

Section 08

Data Retention

We retain personal data only as long as necessary for the purposes described in this policy or as required by law.

Data Type	Retention Period	Reason
Account & profile data	Duration of subscription + 90 days after termination	Contract performance; export window for data portability
Matter & document data	Duration of subscription + 90 days after termination	Contract performance
Financial & billing records	7 years from transaction date	Kenya Revenue Authority requirements; Companies Act obligations
Audit logs	3 years	Legal obligation; fraud prevention
Magic link tokens	15 minutes (then invalidated)	Security
Session tokens	Until logout or 30 days of inactivity	Authentication
Anonymised analytics	Indefinitely	Product improvement - not personal data

On subscription termination, we will delete or anonymise all personal data within 90 days, unless we are legally required to retain it for longer. You may request earlier deletion under Section 09 below.

Section 09

Your Rights

You have the following rights under the KDPA and GDPR. You may exercise any of these rights by contacting us at operations@akilisuite.com. We will respond within 30 days.

Right of Access

Request a copy of all personal data we hold about you (KDPA s.26, GDPR Art.15).

Right to Rectification

Correct inaccurate or incomplete personal data (KDPA s.27, GDPR Art.16).

Right to Erasure

Request deletion of your data where it is no longer necessary (KDPA s.28, GDPR Art.17).

Right to Object

Object to processing based on legitimate interests or direct marketing (GDPR Art.21).

Right to Restriction

Request that we restrict processing of your data in certain circumstances (GDPR Art.18).

Data Portability

Receive your data in a structured, machine-readable format (KDPA s.29, GDPR Art.20).

Withdraw Consent

Where processing is based on consent, withdraw it at any time without affecting prior lawful processing.

Automated Decisions

Not to be subject to solely automated decisions that significantly affect you (GDPR Art.22).

Response timeframe. We will acknowledge your request within 5 business days and provide a full response within 30 calendar days. If your request is complex or involves a large volume of data, we may extend this by a further 30 days, and will notify you accordingly - in compliance with GDPR Article 12(3) and KDPA Section 32.

Section 10

Security

We implement technical and organisational measures appropriate to the risk of the processing, including:

Passwordless authentication - we do not store passwords. Access is granted exclusively via time-limited, cryptographically signed magic links (SHA-256 hashed tokens, 15-minute expiry)
Signed session tokens - sessions are cryptographically signed, individually revocable, and expire automatically
Tenant isolation - every database query is scoped to the authenticated tenant's ID at the application layer, preventing cross-tenant data access
Encryption at rest - all data stored in Cloudflare D1 (SQLite) and R2 (object storage) is encrypted at rest using AES-256
Encryption in transit - all communications use TLS 1.2 or higher; HTTP is not supported
Rate limiting - per-tenant rate limiting is enforced at the edge via Durable Objects to prevent abuse
Audit logging - all data access and modification events are recorded in an immutable audit log
Edge security - Cloudflare provides DDoS mitigation, WAF protection, and bot management at the network layer

Data breach notification. In the event of a personal data breach that is likely to result in risk to your rights and freedoms, we will notify the Office of the Data Protection Commissioner (ODPC) within 72 hours and affected data subjects without undue delay - in accordance with KDPA Section 43 and GDPR Article 33.

Section 11

Cookies & Local Storage

Akili Suite uses a minimal set of browser storage mechanisms necessary for the platform to function. We do not use advertising cookies or third-party tracking.

Name	Type	Purpose	Expiry
hb_access_token	localStorage	Stores your session JWT for authenticated API requests	Cleared on logout or 30 days of inactivity
hb_user	localStorage	Caches basic user profile to avoid repeated API calls	Cleared on logout
Cloudflare _cf_* cookies	Cookie	Essential security and DDoS protection - set by Cloudflare, not by Akili Suite	Session / 1 year

We do not use Google Analytics, Meta Pixel, or any other third-party tracking script. Aggregated platform usage analytics are collected via Cloudflare Analytics, which does not process personal data.

Section 12

Children's Privacy

Akili Suite is a professional legal practice management platform intended exclusively for use by law firms, legal practitioners, and their adult clients. We do not knowingly collect personal data from individuals under the age of 18.

If you believe a minor's personal data has been submitted to the platform, please contact us immediately at operations@akilisuite.com and we will delete that data promptly.

Section 13

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will:

Update the "Effective" date at the top of this page
Notify registered firm administrators by email at least 14 days before the changes take effect
Where required by law, obtain your renewed consent before processing your data under the new terms

Your continued use of the platform after the effective date constitutes acceptance of the updated policy. If you do not agree, you may close your account and request data deletion at any time.

Section 14

Contact & Complaints

For any privacy-related enquiry, request to exercise your rights, or complaint about how we handle your data, please contact our Data Protection team:

Data Protection Officer