Privacy Policy

Data controller: Eighteen O Nine Limited, Kenya. Privacy contact: support@example.com.

In short. Enju Ya is a private family archive. We collect what is needed to run your account and your family's workspace, and nothing is public. We never sell personal information and we show no advertising. The family's own records belong to the family; we host them. People who are recorded in a tree without an account have rights too, and this policy tells them how to use them.

1. Who this policy covers

• Account holders: anyone with a Enju Ya login.
• People recorded in a family tree who do not have an account ("recorded people"): most people in any tree — deceased relatives, children, relatives who were never invited. If that is you, see section 9.
• Visitors to enjuya.com.

2. Our role, and your family's

Eighteen O Nine Limited is the data controller for account, billing, security and website data. For the content of a family's workspace — the records a family keeps about its own members — the family, acting through its custodian, decides what to record and why; Enju Ya hosts and processes those records on the family's behalf and under our Terms, and is responsible for keeping them secure, private to the family, and available to the people they are about. Under the Kenyan Data Protection Act most family records are "sensitive personal data" (family details, ethnicity, religion). Our Terms require the person adding a living relative to be entitled to do so.

3. What we collect

Category	What	Source	Why	Legal basis
Account	First and last name, email and/or phone, password (stored as a bcrypt hash), the age group you declared, language and timezone preferences	You	Run your account	Contract
Guardian consent	For members under 18: the parent's or guardian's email, and the time and internet address of their consent	You; your guardian	The law requires it	Legal obligation
Sign-in security	Last login time and address, browser, session records, two-factor settings, failed sign-in records	Automatic	Keep the account secure, detect abuse	Legitimate interests; legal obligation
Family records	People: names (incl. clan, baptism, religious and nicknames), gender, living/deceased, birth and death dates and places, notes; relationships incl. adoptive, step, former and polygamous marriages; tribe, clan, ethnicity, religion and other identities; disputed parentage recorded as parallel claims; sensitivity flags; stories; events; houses	Your family's members	Provide the archive: the tree, derived relationships, the printed chart, the timeline	See section 2 — the family's purposes; our processing to provide the Service
Uploads	Photos, voice recordings, PDFs, with captions and original filenames	Your family's members	Store and show them to your family	Same
Invitations	The email or phone the custodian enters for the invitee, the message, the role offered	Custodian	Let the invitee join as the right person	Legitimate interests of the family
Billing	Bill-to name, email, phone; invoices; the M-Pesa number used to pay; Paddle customer and transaction ids; receipts; coupon use. We never see or store card numbers — Paddle collects them on its own page.	You, Paddle, Safaricom	Charge, invoice, refund, reconcile, comply with tax law	Contract; legal obligation
Legal acceptances	Which version of the Terms and this policy you accepted, when, and from which internet address and browser	You	Prove the agreement	Legal obligation; legitimate interests
Support	What you send to support@example.com or the contact form (name, email, message)	You	Answer you	Legitimate interests
Audit and logs	Audit entries for sign-in, sharing, export, invitations, payments and deletions (with internet address and browser); server logs with the request address and URL (secrets removed)	Automatic	Security, fraud prevention, proving what happened	Legitimate interests; legal obligation
Website	The cookies listed in the Cookie Notice; if analytics is switched on for the public pages and you consent, Google Analytics usage statistics. No advertising trackers of any kind.	Automatic, with consent	Understand how the public site is used	Consent

We do not collect: government id numbers, card numbers, precise location, biometric templates (photos and recordings are stored as files; we do not run face or voice recognition), health records as a category (free text may contain what a family writes), or DNA data of any kind.

4. How we use information

To provide the Service; to send the emails the Service needs (confirmation, password reset, welcome, invoices, renewal and lapse notices, plan activation, account changes, succession notices, deletion notices); to secure it; to take payment and keep accounts; to answer you; to comply with law. We do not use your family's content for advertising, profiling, training models, or any purpose other than providing the Service to your family. We never show advertising inside the Service.

5. Who sees it

• Your family: members of your workspace, according to their role and the custodian's privacy settings. Share links the custodian creates show a read-only tree to anyone holding the link (only people marked open for sharing; optionally passcode-protected; expiring).
• Our processors (companies that process data for us under contract): Our servers and database are hosted by Hetzner Online GmbH in Finland. Uploaded files are stored on the same servers. Email is sent through ZeptoMail (Zoho Corporation). The current list, with locations, is on our Subprocessors page.
• Payment providers, as independent controllers: Paddle (card payments; it collects your email and card on its page; Merchant of Record; its own Privacy Policy applies) and Safaricom (M-Pesa; your phone number, the amount and the receipt).
• Analytics (public website only, with your consent): Google Analytics receives your internet address, device and the public pages you visit. It never runs inside your family workspace, and never on sign-in, password-reset or invitation pages. There are no advertising networks.
• Authorities, when the law requires and after checking the request is valid.
• A buyer of the business, if Enju Ya is sold, under the same promises.
• Our own staff cannot browse family content: the administration tools see accounts and invoices, not trees.

We never sell personal information and never share family content with advertisers.

6. Where data is kept and international transfers

Our servers and database are hosted by Hetzner Online GmbH in Finland. Uploaded files are stored on the same servers. Payment data goes to Paddle (UK, US and EU entities) and Safaricom (Kenya); email passes through our email provider, named on the Subprocessors page.

If you are in Kenya and our servers are outside Kenya, your data — including sensitive data — leaves Kenya. We rely on the explicit consent you give at signup and on contractual safeguards with our providers. You can withdraw that consent by closing your account.

If you are in the EU or UK, transfers to our providers outside the EU or UK rely on the safeguards in those providers' data-processing terms, including standard contractual clauses where required.

7. How long we keep it

Data	Kept
Your account	Until you delete it, then 30 days' grace (the date is shown on screen and emailed if you have an address; signing in cancels), then your name, contact details, credentials and two-factor settings are removed. Records of your consent and of security events are kept for their own periods below, tied to a reference that no longer identifies you.
Invoices and payment records	At least five years after the financial year, as Kenyan tax law requires; they hold the bill-to name and address and the M-Pesa number that paid
Your family's workspace	Until the custodian deletes it, then 30 days' grace (restorable and exportable by the custodian; closed to everyone else), then people, relationships, houses, stories, events, photos, recordings, invitations, share links and export records are permanently deleted; copies kept for disaster recovery are deleted within 30 days
The family's change log	Each change to a family record is logged with who made it, when, and the earlier values. The log is kept as part of the family's record and as a security record (section 3, audit and logs); it is never shown outside the family, and after a family is deleted it is not accessible to any user
A person's details after an erasure request	Removed within 30 days; the position in the tree remains as an anonymous placeholder; earlier values in the change log are kept as described in the row above
Sessions and sign-in records	Deleted 30 days after the session expires, and immediately when your account is removed
Security audit log	Kept for the life of the Service, so that what happened to an account or a family can always be established
Server logs	30 days
Invitation details	The email or phone the invitation was sent to, and the message, are removed 90 days after the invitation expires, is accepted or is revoked
Legal acceptances	For as long as the agreement they prove may be relevant
Export records	90 days; the exported file itself is deleted as soon as it has been sent to you
Analytics	Google Analytics data is kept for no longer than 14 months; you can reject analytics at any time

A family that stops paying keeps everything; nothing is deleted for non-payment.

8. Your rights (account holders)

You can: see and correct your account details; export your family's data (free, any plan); turn two-factor authentication on or off; sign out; close your account; leave a family; object to or restrict processing; withdraw consent (analytics, cross-border storage) without affecting earlier processing; ask for a copy of your personal data in a portable format; complain to us at support@example.com and to your regulator — in Kenya the Office of the Data Protection Commissioner, in the EU or UK your national authority. We answer within 48 working hours, and complete a request within 30 days. A custodian can delete a whole workspace from Plan & data.

9. Rights of people recorded in a tree who are not members

Someone in your family may have added you — your name, dates, clan, religion, parentage, photos. Enju Ya is private: nothing about you is public or searchable, and only that family's members can see it. Still, you have rights. Write to support@example.com with enough detail for us to find the record. You can ask: what is recorded about you (we will tell you, through the custodian where that is appropriate); to correct it; to restrict it (a sensitivity flag or placeholder so that only the custodian sees the details); to be removed (we erase your details and leave an anonymous node so the family's structure is not broken). We will act within 30 days and tell the custodian. Where a request concerns a deceased person, the family's custodian decides, within the law.

10. Children

Accounts are for people aged 13 and over. Under Kenyan law a person under 18 is a child, and the law allows us to process a child's data only with a parent's or guardian's consent; the EU and UK set the age of digital consent at 16, or 13 in some countries. So at signup we ask your age group; if you are under 18 we ask for a parent's or guardian's email, send them a consent request, and keep the account limited until they confirm. Children also appear in trees because families have children; a child's details may be recorded only by a parent or guardian or with their consent, and families can flag minors so that their details are restricted. A parent or guardian may exercise the rights in section 9 for a child.

11. Security

Passwords are hashed; invitation, share-link, password-reset and guardian-consent tokens are hashed or short-lived; every workspace query is scoped to the family and fails closed; every read path — screens, exports, share links, prints — passes through one visibility service; sensitive flags and placeholders apply everywhere; cookies are HTTPS-only; every pre-login door is rate-limited and audited; secrets never enter the database. Details are on our Security page. If a breach creates a real risk to you we will tell you in writing without undue delay, and notify the Data Commissioner within 72 hours of becoming aware, and EU or UK authorities as the GDPR requires.

12. Cookies

See the Cookie Notice. The Service itself uses only strictly necessary cookies (session, security token, remember-me). Analytics cookies are set on the public website only with your consent, and only when analytics is switched on.

13. Changes

We will tell account holders by email about material changes at least 14 days before they apply, and ask you to accept the new version in the Service. Every version is kept.

14. Contact and complaints

Eighteen O Nine Limited · support@example.com. If we do not resolve your concern, you may complain to the Office of the Data Protection Commissioner (Kenya) or your local authority.