Kijani Systems Inc.

Privacy Policy

Effective date: May 1, 2026 · Last updated: May 1, 2026

Kijani Systems Inc. ("Kijani," "we," "us," or "our") builds tools that help farmers, mills, and agricultural businesses run their operations. This Privacy Policy explains how we collect, use, share, and protect personal information when you:

visit our website at kijani.io or any of its subdomains;
use any mobile application that Kijani publishes, including apps distributed through the Apple App Store and Google Play, on any device; or
use our web applications and any related services, features, or support we provide.

Together, these are the "Services." This policy applies to every app Kijani publishes unless an app links to a different privacy policy, in which case that policy applies to that app.

Kijani is a United States company headquartered in Massachusetts, and it operates in Kenya. This policy is designed to meet the requirements of the Kenya Data Protection Act, 2019 and its regulations, and of applicable United States federal and state privacy laws. Section 11 contains additional information for people in Kenya, and Section 12 contains additional information for people in the United States.

By using the Services, you acknowledge that you have read this Privacy Policy. If you do not agree with it, please do not use the Services.

1. Who this policy applies to

The Services are used by several kinds of people. This policy applies to all of them:

Farmers and growers who use the Services to manage their farms, inputs, deliveries, and payments.
Employees and workers of farms, mills, cooperatives, or other organizations that use the Services for day-to-day operations (for example, scheduling, task tracking, inventory, payroll, or field reporting).
Organization administrators who set up and manage accounts on behalf of a business (an "Organization"), such as a mill, cooperative, or agribusiness.
Website visitors and anyone who contacts us.

2. Our role: controller and processor

When you sign up directly with Kijani, Kijani is the data controller (under Kenyan law) or the business (under US state privacy laws) responsible for your personal information.
When an Organization gives you access (for example, your employer or the mill you supply), that Organization usually decides what information is collected about you and how it is used. In that case, the Organization is the data controller, and Kijani acts as a data processor (under Kenyan law) or service provider / processor (under US state privacy laws), processing information only on the Organization's instructions and under a written agreement. The Organization's own privacy notice also applies. Questions about how your employer or mill uses your information should go to them first; we will help them respond.

3. Information we collect

3.1 Information you or your Organization provide

Category	Examples
Identity and contact	Name, phone number, email address, postal address, preferred language, profile photo
Account and login	Username, password (stored in hashed form), PIN, role, permissions
Government identifiers	National ID or passport number, tax identification number (such as a KRA PIN in Kenya or a Social Security number or ITIN in the US), where required by your Organization or by law
Farm and land	Farm name, location, plot boundaries and acreage, GPS coordinates, crop type, planting and harvest dates, soil and input records
Operational and transaction	Inputs purchased or received (such as fertilizer), crop deliveries, weights, quality grades, contracts, invoices, deductions, loans or advances, payments
Employment and workforce	Job title, department, work schedule, attendance and time records, tasks, performance records, pay rate, payroll, tax, and benefits information, emergency contacts
Financial and payment	Bank account or mobile money (such as M-Pesa) details used to send or receive payments
Communications	Messages, support requests, feedback, survey responses
Content you upload	Photos, documents, notes, and field reports

3.2 Information collected automatically

Device and usage data: device type, operating system, app version, IP address, crash logs, screens viewed, features used, and timestamps.
Location data: precise location when you enable it, for example to map a farm, record a field visit, or confirm a delivery. You can turn off location access in your device settings, though some features may not work without it.
Cookies and similar technologies: on our website and web app, we use cookies and similar tools to keep you signed in, remember preferences, and understand how the Services are used. See Section 9.

3.3 Information from other sources

Your Organization, such as a mill or employer that registers you as a grower or employee.
Partners and service providers, such as payment providers, mobile network operators, or agronomy and certification partners.
Remote sensing and geospatial data, such as satellite or aerial imagery and mapping data used to estimate crop growth, yield, and soil conditions for mapped farms.
Publicly available sources, where permitted by law.

3.4 Mobile app permissions

Our mobile apps ask for your permission before accessing certain features of your device. Depending on the app and the features you use, these may include:

Permission	Why we ask
Location (precise or approximate)	To map farms and plots, record field visits, and confirm deliveries
Camera	To take photos of crops, fields, deliveries, receipts, or documents, and to scan codes
Photos and files	To upload existing photos or documents
Notifications	To send reminders, alerts, and updates about your account and transactions
Microphone	To record voice notes, if you choose to
Biometric sign-in (Face ID, Touch ID, or Android biometrics)	To let you unlock the app. Your biometric data stays on your device and is handled by your device's operating system; Kijani does not receive or store it

You can grant or withdraw these permissions at any time in your device settings. Some features may not work without them. Our apps may work offline and store data on your device until it can be synced with our servers.

No tracking. We do not track you across apps or websites owned by other companies, and we do not use your data for third-party advertising. Our apps do not use Apple's advertising identifier (IDFA) or Google's advertising ID for advertising purposes.

Third-party software in our apps. Our apps may include software development kits (SDKs) from service providers for functions such as crash reporting, analytics, maps, push notifications, and payments. These providers may collect device and usage data as described in Section 3.2, and they may use it only to provide services to us.

App stores. When you download our apps, Apple or Google may collect information about you under their own privacy policies. We do not control that collection. We receive only limited information from them, such as aggregated download and crash statistics.

3.5 Sensitive personal information

Some information we process is treated as sensitive under Kenyan or US law, including government identification numbers, financial account details, and precise geolocation. If your Organization uses the Services for workforce management, it may also include health information (for example, sick leave records) or biometric data (for example, fingerprint or face sign-in, if enabled). We collect sensitive personal information only where it is needed for the Services or required by law, protect it with additional safeguards, and do not use it to infer characteristics about you or for any purpose other than those described in this policy.

4. How we use information

We use personal information to:

Provide the Services, including creating accounts, managing farm, inventory, workforce, and financial records, and enabling Organizations to run their operations.
Process transactions and payments, such as input sales, crop deliveries, invoices, payroll, and disbursements.
Provide agronomic insights, such as crop and soil recommendations, yield estimates, and field monitoring.
Support traceability and environmental reporting, including tracking inputs from production to field and measuring, reporting, and verifying (MRV) environmental outcomes such as carbon removal. Where possible, we use aggregated or de-identified data for this purpose.
Communicate with you, including by SMS, phone, email, push notification, or in-app message, about your account, transactions, service updates, and support.
Keep the Services secure, prevent fraud, and enforce our terms.
Improve and develop the Services, including through analytics and research.
Comply with legal obligations, such as tax, employment, accounting, and record-keeping requirements, and respond to lawful requests from authorities.

We will not use your personal information for a purpose that is incompatible with the purpose for which it was collected without telling you and, where required, getting your consent.

Legal bases for processing

Where the law requires a lawful basis (including under section 30 of the Kenya Data Protection Act), we rely on one or more of the following:

Consent, for example for precise location, optional marketing, or biometric sign-in. You can withdraw consent at any time; this does not affect processing that happened before you withdrew it.
Performance of a contract with you or your Organization.
Compliance with a legal obligation, such as tax or employment law.
Legitimate interests, such as securing and improving the Services, where those interests are not overridden by your rights.
Other bases permitted by law, such as protecting someone's vital interests.

Automated decision-making

The Services may use automated tools to generate recommendations or estimates, such as fertilizer recommendations or yield estimates. We do not make decisions that produce legal or similarly significant effects on you (such as decisions about your employment, pay, or access to credit) solely by automated means. Where an Organization uses such features, a person is involved in the final decision, and you may ask for human review and contest the outcome.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the past 12 months. We share it only as described here:

With your Organization. If you use the Services through a mill, cooperative, or employer, information you enter or that relates to your work or supply relationship is available to authorized people in that Organization.
With service providers who help us operate the Services, such as cloud hosting, data storage, SMS and messaging, payment and mobile money processing, mapping and satellite imagery, analytics, and customer support. They are bound by written contracts to use the information only to provide services to us and to protect it.
With partners, at your or your Organization's direction, such as lenders, insurers, certification bodies, or carbon registries and verifiers. Where possible we share aggregated or de-identified data.
For legal reasons, if required by law, court order, or government request, or to protect the rights, safety, or property of Kijani, our users, or others.
In a business transfer, such as a merger, acquisition, financing, or sale of assets, subject to standard confidentiality protections.
With your consent, or as otherwise disclosed when the information is collected.

We may share aggregated or de-identified information that cannot reasonably identify you. We maintain de-identified information in de-identified form and do not attempt to re-identify it, except as permitted by law.

6. International data transfers

Kijani is based in the United States and operates in Kenya. Your information may be stored and processed in the United States, Kenya, or other countries where we or our service providers operate, and those countries may have different data protection laws from yours.

When we transfer personal information out of Kenya, we do so only in accordance with sections 48 to 50 of the Kenya Data Protection Act and its regulations, for example where we have given the Data Protection Commissioner proof of appropriate safeguards, where the transfer is necessary to perform a contract with you, or with your consent. We use contractual safeguards with recipients that require them to protect your information to a standard consistent with Kenyan law. Where Kenyan law or a lawful direction requires certain data to be processed or stored in Kenya, we will comply.

7. Data retention

We keep personal information only as long as reasonably necessary for the purposes in this policy, including to provide the Services and to meet legal, tax, accounting, and employment record-keeping requirements in Kenya and the United States, resolve disputes, and enforce agreements. When information is no longer needed, we securely delete it, anonymize it, or de-identify it.

Category	Typical retention
Account and profile information	For as long as the account is active, then up to 24 months
Farm, transaction, and payment records	Up to 7 years after the transaction, to meet tax and accounting requirements
Employment and payroll records	For the period required by applicable employment and tax law
Device and usage logs	Up to 12 months
Support communications	Up to 3 years

Where we act on behalf of an Organization, we retain data according to our agreement with that Organization.

8. Security

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest, access controls based on role, employee confidentiality obligations and training, and monitoring. We maintain a written information security program, as required under Massachusetts law (201 CMR 17.00). No system is completely secure, so we cannot guarantee absolute security.

Data breaches. If a breach affects your personal information, we will notify the relevant authorities and you as required by law. In Kenya, we will notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of a qualifying breach, and notify affected people within a reasonably practicable time. In the United States, we will notify affected individuals and regulators as required by applicable state breach notification laws, including Massachusetts General Laws chapter 93H.

Please keep your login details, PIN, and devices secure, and tell us right away if you think your account has been compromised.

9. Cookies and similar technologies

Our website and web app use:

Essential cookies, needed to sign in and use core features.
Preference cookies, to remember settings such as language.
Analytics cookies, to understand how the Services are used so we can improve them.

We do not use cookies for targeted advertising. You can control cookies through your browser settings. Blocking essential cookies may stop parts of the Services from working. We honor Global Privacy Control (GPC) signals as a request to opt out of the sale or sharing of personal information, to the extent required by law.

10. Your rights and choices

Depending on where you live, you may have the right to:

Be informed about how your personal information is used.
Access the personal information we hold about you.
Correct inaccurate or incomplete information.
Delete your information, subject to legal exceptions.
Object to or restrict certain processing.
Data portability, meaning receiving your information in a structured, commonly used format, or having it sent to another provider.
Withdraw consent where processing is based on consent.
Opt out of marketing messages at any time, by replying STOP to an SMS, using the unsubscribe link in an email, or contacting us.

How to make a request: contact us using the details in Section 15. We will verify your identity before responding, using information we already hold about you. You may use an authorized agent where permitted by law; we may ask for proof of their authority. We will respond within the time required by law. If you use the Services through an Organization, we may refer your request to that Organization, since it controls your information, and assist it in responding.

We will not discriminate or retaliate against you for exercising your privacy rights.

Deleting your account

You can delete your account and associated personal information at any time:

In the app: go to Settings → Account → Delete account.
On the web or by email: email privacy@kijani.io with the subject "Delete my account," from the email address or phone number linked to your account. You do not need to have the app installed.

When you delete your account, we delete or de-identify your personal information within 30 days, except information we must keep to meet legal, tax, or accounting obligations, resolve disputes, or prevent fraud, as described in Section 7. If your account was created by an Organization, records that belong to that Organization (such as delivery and payment records) may be kept by the Organization under its own policies. Deleting the app from your device does not delete your account.

11. Additional information for people in Kenya

This section applies to personal information processed in Kenya or about people in Kenya, and supplements the rest of this policy.

Applicable law. We process personal information in accordance with the Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021, and other applicable regulations.
Registration. Kijani registers with the Office of the Data Protection Commissioner as a data controller and data processor, as required by the Act.
Data protection principles. We process personal information lawfully, fairly, and transparently; collect it for explicit, specified, and legitimate purposes; limit it to what is necessary; keep it accurate and up to date; keep it no longer than necessary; and protect it with appropriate security.
Your rights. Under section 26 and related provisions of the Act, you have the right to be informed of how your personal data is used; to access your personal data; to object to processing of all or part of your personal data; to correct false or misleading data; to delete false or misleading data; to data portability; and not to be subject to a decision based solely on automated processing that significantly affects you. We will respond to requests within the timeframes set by the regulations.
Commercial use and direct marketing. We will use your personal data for direct marketing only with your express consent or where otherwise permitted under section 37 of the Act, and every marketing message will include a simple way to opt out.
Sensitive personal data. We process sensitive personal data (such as biometric or health data) only where permitted under Part V of the Act, with additional safeguards.
Children. We do not knowingly process personal data of anyone under 18 without the consent of a parent or guardian, as required by section 33 of the Act. See Section 13.
Data Protection Officer. You may contact our Data Protection Officer at the details in Section 15.
Complaints. If you are unhappy with how we handle your personal data, please contact us first so we can try to resolve it. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (www.odpc.go.ke).

12. Additional information for people in the United States

This section applies to residents of the United States and supplements the rest of this policy.

12.1 State privacy rights

If you live in a state with a comprehensive consumer privacy law (such as California, Colorado, Connecticut, Virginia, Texas, Oregon, and others), you may have the rights described in Section 10, subject to the conditions and exceptions in your state's law, including the right to:

Know what personal information we collect, use, and disclose, and to access it;
Correct and delete personal information;
Opt out of the sale or sharing of personal information, targeted advertising, and profiling that produces legal or similarly significant effects (we do not engage in these activities);
Limit the use of sensitive personal information (we use it only for purposes permitted by law); and
Appeal a decision we make about your request. To appeal, reply to our decision or email us with "Privacy Appeal" in the subject line. If we deny your appeal, you may contact your state Attorney General.

12.2 California notice at collection

If you are a California resident, including a California employee or job applicant, the California Consumer Privacy Act (as amended by the California Privacy Rights Act) gives you the rights above. In the past 12 months:

Category of personal information (CCPA)	Collected	Disclosed for a business purpose to
Identifiers (name, contact details, account ID, IP address)	Yes	Service providers; your Organization
Personal records under Cal. Civ. Code § 1798.80(e) (government ID, financial account details)	Yes	Service providers; your Organization
Commercial information (purchases, deliveries, invoices)	Yes	Service providers; your Organization
Internet or network activity (usage data)	Yes	Service providers
Geolocation data	Yes	Service providers; your Organization
Professional or employment-related information	Yes	Service providers; your Organization
Sensitive personal information (government ID, financial account, precise geolocation)	Yes	Service providers; your Organization
Inferences used to profile consumers	No	Not applicable

Sources, purposes, and retention periods are described in Sections 3, 4, and 7. We do not sell or share personal information, and we do not knowingly sell or share the personal information of anyone under 16.

Shine the Light. We do not disclose personal information to third parties for their own direct marketing purposes.

12.3 Text messages and calls

If you give us your phone number, we may send you service-related text messages. We will send marketing text messages or calls only with your prior express consent, as required by the Telephone Consumer Protection Act. Reply STOP to opt out or HELP for help. Message and data rates may apply. Marketing emails comply with the CAN-SPAM Act and include an unsubscribe link.

12.4 Massachusetts

Kijani maintains a written information security program meeting the requirements of 201 CMR 17.00 to protect the personal information of Massachusetts residents, and follows the breach notification requirements of M.G.L. c. 93H.

13. Children's privacy

The Services are intended for people aged 18 and older and are not directed to children. We do not knowingly collect personal information from children under 13, in line with the US Children's Online Privacy Protection Act (COPPA), or from anyone under 18 in Kenya without verified parental or guardian consent, as required by the Kenya Data Protection Act. If you believe a child has provided us with personal information, please contact us and we will delete it.

14. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the Services, by SMS or email, or by other appropriate means before the changes take effect, and get your consent where required by law. The "Last updated" date at the top shows when this policy was last revised.

15. Contact us

If you have questions, requests, or complaints about this Privacy Policy or our data practices, contact us: