Privacy Policy

Konaar AI is operated by Bazarin Technologies in Kenya (“we”, “us”). We are the data controller for the personal data described here. This policy covers https://konaar.dev, the builder, Konaar Cloud, and the emails and support we provide.

For anything in this policy, including requests about your data, email support@konaar.com.

What you give us.

• Account details: your name, email address, password (stored only as a hash), country and profile picture.
• Onboarding answers, such as your role and what you plan to build.
• What you build: prompts, chat messages, files and images you attach, voice notes, and the code, projects and templates that come out of them.
• Support cases and the messages in them.
• Domain owner details when you register a domain: name, organisation, address, email and phone number, which registries require.

What we collect as you use the service.

• Usage of AI and Cloud credits, builds, deploys, logs and resource consumption.
• Technical data: IP address, browser and device type, request identifiers and error logs, used to keep the service secure and working.

What we receive from others.

• If you sign in with Google or GitHub, your name, email address and profile picture from that account.
• If you connect GitHub, access to the repositories you choose, to import and push code.
• Payment confirmations from our payment provider. We do not receive or store your M‑Pesa PIN or card details.
• If someone invited you, the referral code that links your account to theirs.

• To provide the service: run the AI agent on your prompts, build and preview your projects, deploy and host them, register domains, and keep your account and workspaces working. This is necessary to perform our contract with you.
• To bill you: track credits, process payments and send receipts.
• To keep it safe: detect abuse, scan uploads for malware, prevent fraud and secure accounts. These are our legitimate interests.
• To talk to you: confirm your email, send service and billing notices, and answer support requests.
• To improve it: understand which features are used and where things fail, using aggregated or de-identified data where we can.
• To meet legal obligations, such as keeping financial records.

We do not sell your personal data, and we do not use your prompts or code to train AI models.

When you use the builder, your prompts, attachments and the relevant parts of your project are sent to AI model providers to generate a response. The support assistant works the same way with your support messages, and voice notes are sent to a transcription provider to turn them into text.

These providers process the data to return a result to us and act under agreements with us. Do not put secrets such as passwords or private keys into prompts; use environment variables in Konaar Cloud for those.

We share personal data only with service providers that help us run Konaar, and only what each needs:

• AI providers (Anthropic, OpenAI and a speech-to-text provider) for the builder, the support assistant and voice input.
• Payments: Palpluss, which processes M‑Pesa payments.
• Email: Resend, which delivers account and billing emails.
• Hosting and infrastructure: Fly.io and Cloudflare, which run deployed apps, storage, DNS and network services.
• Domain registrars and registries, which receive domain owner details and may publish some of them in WHOIS or RDAP as their rules require.
• Google and GitHub, when you choose to sign in with them or connect a repository.

We may also disclose data when the law requires it, to protect the rights and safety of our users or the public, or as part of a merger or sale of the business, in which case this policy continues to apply to it.

Several of our providers process data outside Kenya, including in the United States and the European Union. Where we transfer personal data abroad, we do so with safeguards required by applicable law, such as contractual commitments from the provider.

• Account data: for as long as your account is open.
• Projects, chats and deployments: until you delete them or close your account.
• Database backups: for the retention period shown on each database, then deleted.
• Billing records: as long as tax and accounting law requires.
• Security and request logs: for a limited period, then deleted or aggregated.

We use only what the service needs to work. There are no advertising or third-party analytics cookies.

• Sign-in cookie: keeps you signed in. It lasts up to 30 days if you choose to be remembered, otherwise until you close your browser.
• Preferences in your browser’s storage: your theme, the open workspace and project, whether the sidebar is collapsed, builder settings, and an invite code you arrived with.

Blocking these will sign you out or reset your preferences, but will not otherwise affect you.

Under the Kenya Data Protection Act, 2019, and similar laws such as the GDPR where they apply to you, you can ask us to:

• access the personal data we hold about you, or receive a copy of it;
• correct data that is wrong or incomplete;
• delete your data, or close your account;
• object to or restrict some processing;
• withdraw consent where we rely on it.

Email support@konaar.com from the address on your account. We will respond within the time the law allows. You can also complain to the Office of the Data Protection Commissioner in Kenya, or to the data protection authority where you live.

We encrypt data in transit, store passwords as hashes, encrypt secrets such as environment variables at rest, run builds in isolated sandboxes and scan uploaded files. No system is perfectly secure; if a breach affects your personal data, we will notify you and the regulator as the law requires.

Konaar is not intended for anyone under 18, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

We will update this page when our practices change and revise the date at the top. If a change is significant, we will tell you by email or in the app before it takes effect.