Data Retention & Deletion Policy

1. Scope and principles

KapuLetu is a product of KapuLetu Systems. This policy explains how long we keep personal data and customer workspace records, and how deletion requests are handled. We retain information only for as long as reasonably necessary for the purposes described in our Privacy Policy, our service agreements and applicable law.

Retention depends on the type of information, the customer relationship, workspace settings, legal obligations, security needs and any active dispute or legal hold. Deletion may be delayed or limited where information must be retained by law or to establish, exercise or defend legal claims.

• Privacy Policy
• Kenya Data Protection Act, 2019
• Data Protection (General) Regulations, 2021

2. Retention by information type

• Account and identity information is kept while an account is active and for a reasonable period afterward to administer closure, security, legal obligations and disputes.
• Workspace, contribution, ledger and campaign records are retained to provide the service and preserve customer records. Workspace administrators should export records they need before closing or losing access to a workspace.
• Security and audit logs are retained according to the configured retention setting. Workspace administrators can review the applicable audit-log setting in administrative settings.
• Billing, invoice, payment and refund records are retained for accounting, tax, fraud prevention and other legal requirements.
• Support requests and correspondence are retained as needed to resolve the request, maintain support history and handle disputes or legal obligations.
• Masked copies of conversations with our assistant (Letu), kept to check and improve its answers, are deleted after 180 days, or sooner if the account they came from is deleted.
• Cookies and browser storage remain subject to browser controls and the session or preference purpose for which they were created. See our Cookie Notice.

3. Account closure and deletion

To request access, correction, restriction or deletion of personal data, email support@kapuletu.co.ke or use the Contact Support page. Include the account email or phone number and enough detail to identify the data involved. We may ask for information to verify your identity and authority.

If your information is held in an organization’s workspace, the organization may control the relevant records. Contact the workspace administrator as well; KapuLetu will assist the controller where required by law or contract.

KapuLetu will assess verified requests under applicable data-protection law. Where deletion is required and no lawful retention ground applies, we will delete or irreversibly anonymize the relevant data. We will explain where a request cannot be fully actioned because data must be retained or is controlled by a customer organization.

4. Backups and residual copies

Deleted information may remain temporarily in protected backups or system logs until those copies are overwritten or expire under normal backup and security procedures. Such copies are not restored to active use except for recovery, security, legal or operational purposes and remain protected while retained.

5. Retention reviews and changes

We review retention practices as services, legal obligations and security requirements change. A shorter or longer period may apply where necessary to comply with law, honor a customer instruction, protect the service or resolve a dispute. We will update this policy when our practices materially change.