legal · privacy
Version 1.0 · 24 August 2026
In short: this site collects the minimum it needs to answer you, run payments, and review community applications. There is no advertising tracker on this site. Everything collected is listed below, nothing is sold, and you can ask for any of it to be deleted.
This policy covers muritu.top and the services offered through it, operated by me — Kennedy Muritu, Nairobi, Kenya (“I”, “me”). I am the data controller for personal information described here. This site is not directed at children, and I do not knowingly collect children’s data.
It is written to meet the standards of the Kenya Data Protection Act, 2019 (“the Act”). Where visitors fall under other laws (such as the EU GDPR), the same care applies.
Contact and project enquiries. When you use the contact form, your name, email address, phone number (if given) and message are collected through Tally, my form provider. Submissions are stored in Tally (hosted in the European Union) and delivered to my email so I can reply.
Inner Circle applications. Applications to the community go through a separate Tally form. I read every introduction personally; contents stay between you and me.
Coffee payments. If you buy me a coffee, payment runs through M-Pesa via PayHero. To verify and reconcile your payment I record the amount, transaction reference, status, and the M-Pesa number you paid from. The number is masked after reconciliation.
Live chat. The optional chat widget is provided by Tawk.to. Messages you send there, plus standard technical data (IP address, browser), are processed by Tawk.to on my behalf.
A guest identifier. A random ID is kept in your browser’s local storage so returning visits feel continuous. It never leaves your browser and is not linked to anything you type. You can .
Server logs. Hosting by Vercel produces short-lived request logs (including IP addresses) used for security and availability.
Under section 30 of the Act, each use rests on one of these bases:
Performance of a contract (or steps toward one) — replying to enquiries, quoting, delivering projects, reconciling payments.
Consent — community applications, coffee donations, optional chat.
Legitimate interests — keeping the site secure and working, and remembering your guest ID.
Only the providers named above, each under their own data-protection terms: Tally (forms, EU-hosted), PayHero and Safaricom M-Pesa (payments, Kenya), Tawk.to (chat, United States), Vercel (hosting, United States), Turso (database, EU region), and Cloudinary (image delivery). I never sell personal information, and I do not share it for anyone else’s marketing.
Some processing happens outside Kenya — forms and the database in the EU, hosting and chat in the United States. Section 25(h) and sections 48–49 of the Act allow this where appropriate safeguards exist; each provider above operates under contractual data-processing terms and recognised security certifications. If you would rather your data stayed in Kenya, email me and we will work out an arrangement.
This site runs no analytics, no advertising pixels, no cross-site tracking, no fingerprinting, and no cookie banners — because there are no tracking cookies to consent to. The only things stored on your device are the guest ID you can clear above and your theme preference.
Enquiries: up to 24 months after our last exchange, then deleted. Client records: for the life of the engagement, plus seven years where tax law requires keeping financial records. Community applications: deleted within 12 months of a decision. Payment records: reference, amount and masked number kept for accounting; the full M-Pesa number is masked immediately after reconciliation. Chat transcripts: trimmed periodically. Server logs: per hosting defaults, short-lived.
Under section 26 of the Act you can ask to see, correct, or delete your personal data, object to its processing, or withdraw consent. Email kenhopkins.ke@gmail.com and I will respond within 30 days. You can also complain to the Office of the Data Protection Commissioner if you think I have handled your data badly — though I would appreciate the chance to fix it first.
The site and community are intended for adults (18+). If a child’s image appears in portfolio or gallery photography, it is published only with a guardian’s consent, and removed on request.
Security safeguards are applied to every system that touches personal data. If a breach ever puts your data at risk, I will notify Kenya’s Data Commissioner within 72 hours as the Act requires, and tell you directly without delay.
Material changes to this policy will be announced on this page with a new version and date. Active clients are notified directly.
Kennedy Muritu — kenhopkins.ke@gmail.com. This policy is a plain-language commitment, not legal boilerplate; the Terms of Service govern engagements.