uhaiPrivacy notice
Last updated 31 July 2026
Uhai is a product of Nova Insight, Nairobi, Kenya. This notice covers personal data collected through the public website at uhai.app and uhai.co.ke — principally what you type into the trial request form. Nova Insight is the data controller for that information.
It does not cover the media libraries themselves. Where we index a client’s archive, that client remains the controller of their own material and Nova Insight acts as a processor on their written instructions, as required by section 42(2) of the Data Protection Act 2019. Those terms live in the client agreement, not here.
What we collect, and only what we collect
When you submit the trial request form we store exactly the fields you filled in:
- your name, your email address, and the property or company you are asking on behalf of;
- optionally: a phone or WhatsApp number, country, website, the kind of operation you run, where your media is stored, roughly how large the archive is, and anything you chose to tell us in the message box;
- a record that you ticked the consent box, and when;
- the page you arrived from and your browser’s user-agent string, which tell us which channels work;
- a salted, irreversible hash of your IP address. Not the address itself. It exists solely so the form can refuse a flood of automated submissions from one network, and it cannot be turned back into an address or matched to you.
There are no advertising trackers, no analytics scripts and no third-party cookies on this website. The only cookie Uhai sets is a session cookie for operators who are signed in to a library, and it exists to keep them signed in.
Why we hold it
To reply to you, to prepare the free library health check you asked for, and to keep a record of who asked for what. We rely on your consent — the tick box — and on our legitimate interest in answering a business enquiry addressed to us. We do not sell it, rent it, or use it to build advertising profiles, and we will not add you to a marketing list off the back of a trial request.
How long we keep it
Trial requests are kept for 24 months from our last contact with you, then deleted. If you become a client, the relevant contact details move into the client record and are governed by the client agreement instead. Submissions we identify as automated spam are deleted as we find them. You can ask us to delete yours sooner at any point, and we will.
Who else touches it
We keep the list of processors short on purpose:
- Supabase — the database, hosted in the EU (Frankfurt), where the request is stored.
- Netlify — hosting and content delivery for this website.
- Resend — delivery of the confirmation email to you and the notification email to us.
- Google Workspace — the mailbox the reply is written from.
Because those services are hosted outside Kenya, submitting the form involves a transfer of your data abroad. Each of them is contractually bound to process it only on our instructions and to appropriate security standards. Nobody else receives it.
Your rights
Under the Data Protection Act 2019 you may ask us for a copy of the personal data we hold about you, ask us to correct it if it is wrong, ask us to delete it, object to our holding it, or withdraw your consent. Withdrawing consent does not make what we did before it unlawful, and it will not cost you anything.
Write to barny@novainsight.ke and we will action it within the statutory timeframe. If you are not satisfied with how we handle it, you can complain to the Office of the Data Protection Commissioner (ODPC), Kenya.
Security
Trial requests are stored in a table that is not readable by any public or signed-in role — only the server process that writes them, and the Nova Insight staff account that reads them, can reach the data. The site is served over HTTPS only, with a strict content security policy.
Changes
If this notice changes materially we will update the date at the top. Nothing here is backdated: what applied when you submitted a form is what governs that submission.