Privacy policy

Last updated 11 November 2026

This policy explains how Oki Digital Creatives Ltd (“OKI Digital”, “we”, “us”) handles personal data in the OKI client portal at portal.okidigital.co.ke (the “portal”). The portal is where our team creates content for our clients, where clients review and approve it, and where clients see their content calendar and invoices. We handle personal data in line with Kenya's Data Protection Act, 2019.

Who this covers

OKI Digital staff who use the portal.
People at our clients whom we invite to the portal, to review content or see invoices.
Client contacts we hold for billing, who may receive invoices by email without having an account.

The portal is for business use. It isn't meant for anyone under 18.

What we collect

Your account

Your name, email address and the role you have (for example approver or viewer).
Your password, stored only as a secure one-way hash, unless you sign in with Google instead.
Which client you belong to, and who invited you.

Signing in with Google

If you choose “Continue with Google”, Google shares your name, email address, profile picture and Google account ID with us. We ask only for this basic profile. We don't get your Google password, and we can't see your Gmail, contacts, Drive or anything else in your Google account.

What you do in the portal

Content and files: captions, photos, videos and documents uploaded by our team or by you.
Comments, approvals and change requests, with who made them and when. Approvals are kept as a permanent record of what was agreed.
Planned activities, such as content ideas, site visits and meetings.
Notifications we send you, and whether you've read them.
A record of important actions (an audit log), such as sending an invoice or changing who has access.

Billing

Your organisation's billing details (name, address, KRA PIN and billing contacts), invoices, and payments we record. We don't take card or M-Pesa payments in the portal and we don't store payment card details.

Technical data

When you sign in we keep a session, with the IP address and browser it was opened from, so you stay signed in and so we can spot misuse. Our hosting providers keep standard server logs.

How we use it

To run the portal for you and your organisation: your account, content reviews, the calendar and invoices.
To email you about your work: invitations, posts ready for review, reminders, planned site visits and meetings, invoices and password resets.
To keep the portal secure, and to keep accurate records of approvals and billing.
To meet our legal obligations, such as keeping tax records.

We rely on the following legal bases: performing our contract with your organisation; our legitimate interest in running a secure, reliable service; and complying with the law. We don't sell personal data, use it for advertising, or make automated decisions about you.

Google user data

We use the information Google shares with us only to sign you in and to show your name in the portal. We don't use it for advertising, we don't sell it, and we don't share it with anyone except the service providers below, who process it for us. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Who we share it with

People see only what their role allows. Staff see the clients they're assigned to; client users see only their own organisation's content and invoices. Outside OKI Digital, we use these service providers, who process data only on our instructions:

Railway, which hosts the portal and its database.
Cloudflare, which stores uploaded files (Cloudflare R2).
Resend, which delivers our emails.
Google, if you choose to sign in with Google.

We may also disclose data if Kenyan law requires it, for example to a court or a regulator.

Where it's stored

The portal's servers and database are in the European Union, and our providers may process data in other countries. When personal data leaves Kenya, we rely on the safeguards the Data Protection Act requires, including providers' contractual commitments to protect it.

How long we keep it

Your account, for as long as you have access to the portal.
Sign-in sessions expire after 30 days.
Unfinished uploads are deleted after 24 hours.
A data export you ask for can be downloaded for 7 days.
Invoices and payment records, for as long as Kenyan tax law requires.
Content, comments and approvals, for as long as we work with your organisation and as our records need. If your account is deleted, your name is removed from them.

How we protect it

The portal is served only over HTTPS. Access is limited by role, and each organisation's data is kept separate inside the database itself. Passwords are hashed, and files are uploaded and shared through short-lived signed links.

Your rights

Under the Data Protection Act, you can ask us to:

tell you what personal data we hold about you, and give you a copy;
correct data that's wrong;
delete your data, where we don't need to keep it;
stop or limit how we use it, or object to a use.

Client users can ask for a copy of their data, or for their account to be deleted, from Your account in the portal. Anyone can also email us at info@okidigital.co.ke. We reply within the time the law allows.

If you're not happy with how we've handled your data, you can complain to the Office of the Data Protection Commissioner at www.odpc.go.ke.

Cookies

We use only the cookies the portal needs to keep you signed in. We don't use advertising or tracking cookies.

Changes to this policy

If we change this policy, we'll update the date at the top. If a change matters to how we use your data, we'll tell you in the portal or by email.

Contact us

Oki Digital Creatives Ltd. Email info@okidigital.co.ke.