Privacy Policy

Last updated: 25 May 2026

This policy explains how Ushuru AI (“Ushuru”, “we”, “us”) handles your personal data when you use our WhatsApp service to reconcile and file Kenya Revenue Authority (KRA) income-tax returns. We process data in line with the Data Protection Act, 2019 of Kenya.

1. Who we are

Ushuru AI is an independent filing-assistance service. We are not affiliated with or endorsed by the KRA. You remain the taxpayer responsible for your return.

2. What we collect

• Identity & tax data — your KRA PIN, and the documents you forward (autopopulated ITR, General Ledger Report, P9s, withholding certificates).
• Contact data — the WhatsApp number you message us from, and your conversation with the assistant.
• Payment data — the M-Pesa number or PayPal details used to pay the filing fee. Card and M-Pesa PINs are handled by Safaricom/PayPal and are never seen or stored by us.

3. Why we use it (purpose & legal basis)

We use your data only to provide the service you asked for: to read your documents, reconcile your tax position, show you the result, and — once you approve — file your return and collect the fee. Our legal basis is your consent and the performance of our service to you. We do not sell your data or use it for advertising.

4. Who we share it with

• KRA — the figures of the return you approve, in order to file it.
• Payment processors — Safaricom (M-Pesa) and PayPal, to take payment.
• Infrastructure providers — vetted hosting and messaging providers (e.g. Meta WhatsApp) under confidentiality obligations.

We never sell, rent, or trade your personal data.

5. How we protect it

Documents and personal details are encrypted in transit and at rest. We practise data minimisation — keeping only what is needed to file — and figures shown to you are reconciled against KRA’s own records, never invented. If we ever offer login-assisted filing, any credentials are encrypted, short-lived, and never written to logs.

6. How long we keep it & deletion

We retain filing records for as long as needed to support your return and meet legal/tax record-keeping obligations, then delete them. You can ask us to delete your data at any time by messaging us on WhatsApp or emailing the address below; we honour requests subject to any retention the law requires.

7. Your rights

Under the Data Protection Act, 2019 you have the right to:

• be informed of how your data is used;
• access the personal data we hold about you;
• request correction of inaccurate data;
• request deletion (“erasure”) of your data;
• object to or restrict certain processing; and
• lodge a complaint with the Office of the Data Protection Commissioner (ODPC).

8. Cross-border processing

Some providers (for example PayPal and WhatsApp) may process data outside Kenya. Where this happens we rely on providers that offer appropriate safeguards for your data.

9. Changes & contact

We may update this policy and will post the new date above. Questions or requests? Reach us on WhatsApp, or email privacy@ushuru.ai.