Pricing Get started

Loading…

©Khapy

Pricing·Terms of Service·Privacy Policy·Refunds·Contact

Khapy Privacy Policy

Khapy • Zambia • Effective date 2026-09-02 • Version 1.0.0

Last updated 2026-09-02 • Initial forensic draft grounded in actual Khapy product behaviour (auth, Business Brain, media, distribution, billing, AI routing). Pending independent legal review before production publication.

Contact: legal@khapy.com · Privacy: privacy@khapy.com

Legal entity: [LEGAL ENTITY — TO BE VERIFIED BY COUNSEL]. Registered address to be confirmed during legal review. This draft uses a placeholder pending verification.

v1.0.0View Terms of Service →

Canonical source: packages/legal/src/policies.ts • Route: /privacy • API: /api/v1/legal/policies/privacy. Web and Mobile resolve to the same version identifiers.

Search policy

Contents

1. Who is responsible for your information (controller)
2. What this policy covers
3. Categories of data we process
4. Sources of data
5. Purposes and lawful bases
6. AI processing and model providers
7. Business Brain and memory
8. Connected channels and permissions
9. Sharing, processors and subprocessors
10. International transfers
11. Security
12. Retention and deletion
13. Your rights and choices
14. Marketing communications
15. Cookies and similar technologies
16. Children
17. Security incidents and breach notification
18. Complaints and regulator contact
19. Changes to this policy

Tip: use the search above to filter sections. Headings are semantic and keyboard navigable.

1. Who is responsible for your information (controller)

Plain language: Khapy controls platform data for its own service. You control your customer lists inside your workspace.

Khapy (trading name) determines the purposes and means of processing for platform data it controls — the Khapy websites, mobile apps, APIs, Business Brain, media and distribution services described above. Legal entity details are [LEGAL ENTITY — TO BE VERIFIED BY COUNSEL] (placeholder pending verification — marked UNKNOWN until confirmed). Privacy contact: privacy@khapy.com / legal: legal@khapy.com. Where you place third-party personal data (leads, contacts, customer conversations) into Khapy, you act as the controller for that customer data and Khapy acts as your processor/service provider under your lawful basis. Where Khapy serves people in other jurisdictions, additional mandatory rules may apply and will be assessed before claims of compliance are made for those markets.

Back to contents ↑

2. What this policy covers

Plain language: Covers Khapy web, mobile, APIs and support — not the third-party platforms you connect.

This policy covers personal data processed when you visit Khapy web or mobile, create an account, use Business Brain, upload files, interact with AI, connect channels, schedule publishing, view analytics or contact support. It applies to account holders, organisation members and business users. It does not cover third-party platforms you connect (Meta, WhatsApp, TikTok, Google, etc.) — their own policies govern data they process. It also does not cover customer data you independently collect outside Khapy.

Back to contents ↑

3. Categories of data we process

Plain language: Only what is needed to run, secure, bill and improve the service — listed plainly.

We collect only what is needed for the purposes below, and we do not hide categories behind vague "we may collect information" language: • Account and contact data: phone in E.164 format, optional email, user name, display initials. • Organisation and membership data: organisation/business name, slug, role, locale/timezone/currency preferences (default Zambia/Africa/Lusaka/ZMW). • Business profile data: category, description, locations, service areas, advantages, trust signals you choose to provide. • Products and offers: product/service names, prices and price components (cents/currency), bundles, availability and related merchandising. • Uploads and imports: files you upload (mediaAssets S3 key, checksum, size, MIME type), workbook rows, website pages, review excerpts and derived facts/insight records. • Customer and lead data you enter: CRM contacts, conversations, messages, lead stages, customer names/phones you provide. • Brand and media: logos, colours, typography, brand rules, assets, validated artefacts, render status and version history. • Location and regional settings: country/region/city, timezone per location, map coordinates you set. • Payment and billing metadata: plan code, subscription status, checkout session identifiers, amounts/currency, invoice markers — card data itself is handled by the payment provider (Lipila or Paddle hosted checkout), not stored by Khapy. • Device, session and security data: device identifiers, IP address, OTP challenge hashes (bcrypt), session refresh-token hashes (SHA-256), access-token identifiers, audit events. • Analytics and support data: ingested metrics, conversions, insights, learnings, experiment evaluations and support tickets/grants — cohort metrics may withhold small samples (<5 tenants). We do not intentionally collect sensitive personal data; please do not upload it.

Back to contents ↑

4. Sources of data

Plain language: Mostly from you, your team, your uploads and your connected channels.

Directly from you when you create an account, verify your phone, complete Teach Khapy, upload files or write campaign inputs. From organisation administrators who invite or manage members. From connected channels you authorise (e.g., page, inbox or channel metadata received via Meta/TikTok/Google APIs). From uploaded or imported sources you choose (workbooks, websites you allow us to crawl, review sets). From public sources or research where you ask Khapy to retrieve them. Automatically from your device/service interaction (session activity, security events, audit logs) as described in cookies/device storage below.

Back to contents ↑

5. Purposes and lawful bases

Plain language: Provide the service, keep it secure, bill correctly and — where you permit — improve it.

We process personal data to: provide and operate the service (including storing and processing Customer Content you submit); authenticate you and manage sessions; generate the marketing work you request; publish or schedule content according to your approval policy; maintain security, prevent abuse and enforce rate limits and trial-abuse checks; bill, invoice and administer subscriptions and checkout; provide support and respond to requests; run product analytics and improvement as disclosed below; comply with legal obligations; and, where you separately consent, send optional marketing communications. Where consent is the lawful basis (e.g., optional communications, optional cookies), you may withdraw it. Do not reframe necessary service processing as optional consent. For Zambia, processing bases follow the Zambia Data Protection Act, 2021 (e.g., consent, contract, legitimate interests, legal obligation) — the specific basis per purpose will be confirmed during legal review.

Back to contents ↑

6. AI processing and model providers

Plain language: When you ask for generation, relevant business context may be sent to a model provider. Provider terms then apply.

When you request AI assistance, generation or extraction (e.g., improve text, generate campaign copy, transcribe or vision-analyse media, produce video/storyboard), Khapy routes a tailored prompt that may include relevant Business Brain facts, brand context, your input text and, where required, sanitized snippets from your uploads. Recipients are the model providers actually configured for your deployment: currently OpenAI and Anthropic where keys are set, via Khapy's model router which enforces budget, health, rights and region checks and produces a model-selection decision with registry version and max-cost estimate. Provider contracts and settings — not marketing claims — determine whether content is used for model training. Khapy does not promise "never used for training" unless the actual provider contract and technical settings support that statement; where training use is contractually excluded we enforce it, otherwise provider terms govern. Business-specific memory (your Business Brain) versus general model training are distinct: your Business Brain re-uses your business knowledge scoped to your organisation, it is not the same as training a public model. Do not include secrets, credentials or highly sensitive personal data in free-text prompts.

Back to contents ↑

7. Business Brain and memory

Plain language: Your business knowledge is stored for your business only, with tenant isolation and owner correction.

Business Brain stores structured knowledge (products, services, history, facts, conflicts, embeddings) and derived memory (marketing memory, claims/rights, evidence packs) scoped to your organisation and business ID, isolated by tenant and protected against cross-tenant exposure. It is populated from Teach Khapy answers, ingested documents, media insights, website pages and review themes you provide, plus operator-confirmed corrections. Confidence and provenance are recorded. You remain in control: you may view, correct or request deletion of Business Brain data for your business; low-confidence or conflicting values are queued for review rather than silently published. Vector embeddings are likewise tenant-filtered.

Back to contents ↑

8. Connected channels and permissions

Plain language: Connecting a channel grants narrow tokens that Khapy stores securely and uses only for the publishing you approve.

When you connect a social or messaging channel (Facebook, Instagram, WhatsApp, TikTok, Google/YouTube, or future integrations), Khapy requests only the permissions/scopes needed to provide the distribution you authorise. What may be received: channel identifiers, page/account metadata and content status as returned by the provider. What Khapy may send: content you have approved for publishing and related delivery metadata, via the official API. Credentials and tokens are encrypted server-side (distributionConnections.encryptedToken, tokenScope) and are not exposed in normal customer UI. You may disconnect at any time; posted content already delivered remains on the third-party platform subject to its policies. We do not describe third-party platforms as controlled by Khapy.

Back to contents ↑

9. Sharing, processors and subprocessors

Plain language: We do not sell your personal data. We share it only with the providers who run the service.

Khapy does not sell your personal data. Sharing is limited to processors and service providers needed to provide the service, each with a defined purpose and data category: • Infrastructure hosting and storage: PostgreSQL (database) and Redis (queues) host; AWS S3 (or compatible MinIO locally) for tenant-scoped media tenants/{org}/businesses/{biz}/media and backups — S3 region us-east-1 where shown means cross-border transfer. • Telephony/OTP: Twilio where OTP_PROVIDER=twilio (phone E.164, 6-digit code handling) — otherwise local mock OTP in development. • AI/model providers: OpenAI and Anthropic where configured (prompt content and relevant business facts as needed for the task). • Payments: Lipila and Paddle (provider transactions, webhook events, amounts/currency, entitlements) — provider webhook secrets verify events; card data stays with the provider-hosted checkout. • Channel providers: Meta, TikTok, Google where you connect channels (tokens, publishing payloads). • Error monitoring: Sentry where configured (error stacks, traceId). • Secrets hosting: secret manager (AWS Secrets Manager / Doppler / GitHub Secrets) per deployment. Material subprocessors and purposes are also reflected in your privacy transfer packs (privacy_data_transfer_packs: jurisdiction, region, subprocessors, retentionDays, deletionPolicy, dpaStatus). We update this list before changing sharing in a material way.

Back to contents ↑

10. International transfers

Plain language: Primary context is Zambia; some providers process data outside Zambia as shown.

Where you use Khapy in Zambia, data may be transferred outside Zambia to the extent indicated by the real infrastructure: object storage and some model/billing providers operate in the United States (e.g., S3 us-east-1, OpenAI/Anthropic, Paddle, Sentry), with channel providers in the United States and other regions (e.g., Singapore for TikTok). Transfers occur on the basis provided by the Zambia Data Protection Act, 2021 and by contractual safeguards with those processors (e.g., data-processing terms, access controls, tenant isolation). The region and jurisdiction recorded per privacy transfer pack represent the authoritative register. If you require data residency in a specific jurisdiction, contact privacy@khapy.com before deployment.

Back to contents ↑

11. Security

Plain language: Reasonable technical and organisational safeguards, without publishing exploitable detail or unproven certifications.

We apply organisational and technical safeguards appropriate to the service and its data categories — including tenant isolation by organisationId, hashed OTP and token secrets (bcrypt for codes, SHA-256 for refresh tokens, encrypted token storage), in-memory rate limiting for OTP, JWT short-lived access tokens (15 min) with refresh rotation, signed URLs for media where applicable, audit logging and provenance records. We do not claim encryption at rest or in transit, backups, disaster recovery, retention guarantees, SOC 2 or ISO certification or audit status beyond what is actually implemented and contractually supported. Where TLS is provided by the deployment, traffic is encrypted in transit; where S3/MinIO is used, platform-level protections apply. Details that would aid attackers are omitted. Report security issues to legal@khapy.com.

Back to contents ↑

12. Retention and deletion

Plain language: Active content lives until you delete it; system records follow their own documented retention.

Retention follows the implementation, not the inverse: • Active account/organisation/business content: retained while the account is active and until you delete it via the product or a verified request. • Media: soft-deleted assets are retained with deletedAt and status=deleted until purgeExpired runs (default 30-day purge window) when a hard delete removes the database row and enqueues S3 deletion; contentHash may remain for de-duplication where implemented. • Logs and audit: auditLogs are immutable for security and accountability and do not currently expire on a fixed TTL (bounded-growth handling is planned). • Backups: stored in tenants/{org}/backups with checksum/size, verified flag and restoredAt — retained until you delete the backup or per operator policy; backups are not immediately purged on every user deletion. • Billing and legal records: checkout sessions, invoices, usage snapshots and provider events are retained as required by financial and legal obligations even where account content is deleted. • Privacy transfer packs: retentionDays 1–3650 as recorded per pack and deletionPolicy (e.g., 30d_delete, export_then_delete) govern pack lifecycle. We never promise "immediate deletion everywhere" where backups or legal records lawfully remain; we explain that distinction.

Back to contents ↑

13. Your rights and choices

Plain language: Contact privacy@khapy.com for access, correction or deletion. We verify authority first.

Subject to applicable law, you may request access to, correction of or deletion of your personal data processed by Khapy. Submit requests to privacy@khapy.com or via the in-product privacy route where available. We route requests to the correct organisation/business and authenticated person, verify authority without collecting unnecessary identity information, and apply lawful exceptions and retention obligations consistently (e.g., where audit, billing or contractual records must be retained). Where required, we return data in a useful format. We keep an auditable record of the request, decision and completion status without exposing internal ticket IDs unless useful. For CRM/customer data you control, honour your own customers' rights before asking Khapy to act on them.

Back to contents ↑

14. Marketing communications

Plain language: Service notifications are separate from optional marketing. You can opt out of the optional ones.

Service notifications (e.g., OTP codes, security alerts, billing or support updates and required operational messages) are sent as needed to operate the service. Optional promotional communications about Khapy features or offers are sent only where you have separately opted in and can be unsubscribed via the unsubscribe control in the message or via privacy@khapy.com. Marketing choice is separate from Terms acceptance and from service-essential processing. Push notifications (packages/notification high-priority channels) are logical today and may map to platform push tomorrow where implemented — we treat them as service notifications unless clearly marketed as promotional.

Back to contents ↑

15. Cookies and similar technologies

Plain language: Web uses localStorage for sessions; mobile uses SecureStore. No third-party advertising cookies.

Khapy does not set third-party advertising or cross-site tracking cookies. On the web, authentication and session state are stored in localStorage (accessToken, refreshToken, organisation/business pointers) and not in HTTP cookies; the API sets no session cookies (cors + JSON only). On mobile, state is stored in Expo SecureStore (encrypted at rest) including pendingMutations for offline queue. Khapy Analytics as described in this policy is first-party product analytics based on ingested business metrics, not a third-party tracker (no Google Analytics, PostHog, Mixpanel). Where non-essential cookies or technologies are added in the future, they will be distinguished from essential technologies and presented with a consent/choice mechanism before use.

Back to contents ↑

16. Children

Plain language: Khapy is for business users. Accidental child data should be removed.

Khapy is intended for business users (adults) and is not directed to children. We do not knowingly collect personal data from children. If you believe a child's data has been inadvertently provided (e.g., via a customer list or upload), contact privacy@khapy.com and we will take steps to delete it. We make no claim about a child-specific legal regime unless a specific jurisdiction has been assessed and counsel has approved that representation.

Back to contents ↑

17. Security incidents and breach notification

Plain language: We investigate incidents and notify affected parties and regulators where the law requires it.

We investigate suspected security incidents, take steps to contain and remediate them, and notify affected parties and the relevant regulator (e.g., the Zambia Data Protection Commission where the Act requires it) where a personal-data breach triggers a notification duty. Timing and content of notice follow the applicable legal standard — for Zambia, the Zambia Data Protection Act, 2021 and its regulations/guidance — and any other jurisdiction that actually applies to the affected data. If you suspect an incident involving your organisation, contact privacy@khapy.com promptly.

Back to contents ↑

18. Complaints and regulator contact

Plain language: Contact Khapy first; you may also complain to the relevant data-protection regulator.

If you have a privacy complaint, contact privacy@khapy.com and we will aim to resolve it promptly. You also have the right to complain to the relevant data-protection regulator. For Zambia, that is the Data Protection Commission (established under the Zambia Data Protection Act, 2021) — see its published resources and guidance for how to lodge a complaint. For other jurisdictions, the relevant authority is that identified before serving customers there.

Back to contents ↑

19. Changes to this policy

Plain language: Versioned, dated and announced. Continued use after the new effective date means you accept the update.

We may update this policy as Khapy, its processors or the law changes. Every published version has a version number, effective date, last-updated date and change summary (see header). Material changes are notified by appropriate means (e.g., in-product notice, version bump and, where required, renewed agreement). Prior versions are retained for legal/audit purposes where appropriate. The canonical version is the one at /privacy (web) and as resolved from the API at /api/v1/legal/policies/privacy. If you do not agree with a material update, stop using the service before it takes effect and, where applicable, export or delete your data per section 12.

Back to contents ↑

This policy is a forensic draft grounded in the actual Khapy architecture (auth, Business Brain, media, distribution, billing) and is not a substitute for review by qualified counsel before production publication. Prior versions are retained for audit once published.