/ Legal

Privacy Policy

Last updated: September 23, 2026

ForgeByte Creations ("we", "us", or "our") is an applied AI and software engineering studio based in Nairobi, Kenya (forgebytecreations.co.ke). We respect your personal data and are committed to safeguarding it in compliance with the Kenya Data Protection Act, 2019 (KDPA) and recognized international data protection principles.

1. Scope of This Policy

This Privacy Policy explains how we collect, use, store, process, and protect your information when you visit our website, submit project inquiries via our contact surfaces, or interact with our studio services.

2. Information We Collect

We collect minimal personal data necessary to evaluate project inquiries and maintain site security:

  • Inquiry & Contact Information: When you submit a message through our contact form, we collect your name, email address, phone number (optional), company name (optional), and the text of your project message or inquiry.
  • Technical & Telemetry Data: To protect our infrastructure against automated spam, denial-of-service, and malicious traffic, our servers log technical metadata including your IP address, browser User-Agent header, and HTTP referrer.
  • Usage & Performance Telemetry: When consent is granted, anonymized traffic analytics help us understand site navigation and page performance.

3. How We Use Your Information

We process collected information strictly for legitimate business and engineering purposes:

  • Evaluating & Responding to Inquiries: Reviewing incoming project requests, assessing architectural compatibility, preparing technical proposals, and communicating back to you.
  • Security & Abuse Prevention: Applying rate limiting (e.g., throttling form submissions to prevent spam attacks), blocking honeypot-triggered bot traffic, and protecting system integrity.
  • Contractual Performance: Administering client onboarding, executing Statements of Work, and delivering ongoing engineering milestones.

4. AI Data Handling & LLM Governance

As an applied AI studio, we design AI touchpoints with defensive data isolation:

  • Draft Assistance Only: Incoming project inquiries may be processed through internal LLM touchpoints to generate internal briefing summaries and initial auto-reply drafts for human staff review.
  • Zero Model Training: Your inquiries, messages, and proprietary specifications are never used to train, fine-tune, or improve third-party public foundation models. API agreements with LLM providers enforce strict zero-data-retention and zero-training policies.
  • Encryption & Access Control: All data in transit to and from AI service endpoints is encrypted with TLS 1.3, and access is strictly restricted to authenticated studio engineering staff.

5. Cookies & Tracking Technologies

We maintain an unobtrusive, privacy-conscious stance regarding cookies and tracking:

  • Strictly Necessary Cookies: We use session and CSRF tokens strictly required for form submission security and website functionality.
  • Consent Manager Integration: Non-essential analytics (such as Google Analytics 4) are gated behind an autoblocking Consent Management Platform (CMP). No tracking scripts or beacons load or fire until you provide explicit consent through our banner.
  • No Intrusive Ad Tech: We do not deploy third-party advertising trackers, cross-site profiling pixels, or data-broker trackers.

6. Third-Party Infrastructure & Service Providers

We partner with trusted infrastructure providers that adhere to rigorous security standards:

  • Resend / SMTP Infrastructure: Transactional email delivery for notification of client inquiries and auto-responses.
  • Cloudflare: DNS resolution, edge routing, Cloudflare Tunnel ingress, DDoS mitigation, and SSL/TLS termination.
  • Hosting Infrastructure: Self-hosted containerized services deployed on isolated, hardened virtual private servers.

7. Data Retention

We retain personal data only as long as necessary to fulfill the purposes outlined in this policy:

  • Inquiry leads and related email correspondence are retained for the duration of the prospective or ongoing business relationship, or up to 24 months after last contact if no engagement ensues.
  • Server access logs and rate-limiting cache entries are automatically purged or rotated within 30 to 90 days.

8. Your Rights Under the Kenya Data Protection Act

Under the Kenya Data Protection Act, 2019 and comparable international privacy standards, you have the right to:

  • Access: Request confirmation and copies of personal data we hold about you.
  • Correction: Request rectification of inaccurate, incomplete, or out-of-date personal data.
  • Deletion / Erasure: Request the deletion or destruction of your personal data where there is no lawful basis for continued retention.
  • Objection & Restriction: Object to or request restriction of data processing under specific circumstances.

9. Contact for Privacy Enquiries

To exercise your data protection rights, ask questions about our data practices, or submit a privacy request, please contact our Data Protection Officer / Privacy Lead: