Privacy Policy
Privacy Policy
Last updated: 18 September 2026
1. Who this policy covers
This Privacy Policy explains how The Reinvention Program collects, uses, stores and protects your personal data when you visit reinventionprogram.lovable.app (or its live domain), submit an enquiry, register for a programme, or use your client portal.
Data Controller: Catherine Bosibori-Aruyaru, trading as The Reinvention Program
Contact: hey@reinventprog.com
[INSERT: registered business name/number and physical or postal address, if any]
Data Processor: Mizizi AI, which builds and operates the technical platform on the Controller’s behalf, under a services agreement, and does not use your data for its own purposes.
Contact: amani@mizizi-ai.com
This policy is written to comply with Kenya’s Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021.
2. What we collect
| Category | Examples | When |
|---|---|---|
| Identity & contact | Full name, email, phone number | When you submit an enquiry, register, or book a call |
| Enquiry content | What you tell us about your current situation and what you want to change | The “Start here” / registration form |
| Programme data | Programme interest, enrolment status, payment status, module progress, reflections you submit inside the portal | Once you register or enrol |
| Communications | Emails, SMS and WhatsApp messages exchanged with us; notes our team keeps about your enquiry | Throughout your relationship with us |
| Technical data | Pages visited, general usage of the site and portal, IP address (via standard web server logs and Google Fonts, which are loaded from Google’s servers) | Automatically, when you use the site |
| Payment records | Amount, programme, and payment status. We do not collect or store your card, M-Pesa PIN, or bank credentials — payment is arranged and confirmed directly with Catherine outside this platform. | When a payment is recorded against your account |
We do not knowingly collect data from anyone under 18. If you believe a minor has submitted data to us, contact us and we will delete it.
3. Why we process your data (lawful basis)
- Consent — you tick a consent box before submitting an enquiry; this is the lawful basis for contacting you about it.
- Contract — once you register for a programme, we process your data to deliver it (portal access, modules, scheduling, invoicing).
- Legitimate interest — improving our programmes, keeping basic records of enquiries and outcomes, and internal notes our team keeps to serve you well.
- Legal obligation — where Kenyan tax, consumer protection, or other law requires us to keep certain records (e.g. invoices).
Some of what you share with us in the “what’s going on” field may touch on sensitive matters (health, family, relationships) even though this is a coaching service, not a data-collection exercise about those topics specifically. We treat everything you write with the same confidentiality as the rest of your record, and it is never shared outside the small team supporting your programme.
4. Who sees your data
- Catherine and anyone she designates as programme staff, for the purpose of running your programme.
- Mizizi AI, as the processor operating the platform, bound by confidentiality and only acting on Catherine’s instructions.
- Service providers who help run the platform: our hosting/database provider (Supabase, EU region), our email/SMS delivery providers, and — only if and when actually switched on — a payment processor. As of this policy, no online payment processor is live on this platform; payment is arranged directly and manually.
- We do not sell your data. We do not share it with advertisers.
5. How long we keep it
- Active clients: for the duration of your programme plus 3 years afterwards, to allow for support queries, references, or re-enrolment.
- Enquiries that don’t convert: 12 months, after which they are deleted unless you’ve asked us to keep them.
- Financial/invoice records: as required by Kenyan tax law (currently 5 years).
- You can ask us to delete your data sooner; see Section 7.
6. Where your data is stored
Your data is stored with Supabase, a cloud database provider, in their EU (Sweden) region. Some processing (email/SMS delivery) may briefly route through providers based outside Kenya. Where this happens, it is limited to what’s needed to deliver the service, and those providers are contractually bound to protect your data to a comparable standard.
7. Your rights
Under the Data Protection Act, 2019, you have the right to:
- Know what personal data we hold about you and why (access).
- Ask us to correct inaccurate data.
- Ask us to delete your data, subject to our legal retention obligations (e.g. we can’t delete a paid invoice we’re legally required to keep for tax purposes).
- Object to or restrict certain processing.
- Withdraw consent at any time — this won’t affect anything already done, and won’t affect a paid, active programme’s basic operation (we still need to deliver what you’ve paid for).
- Data portability — a copy of your data in a usable format.
- Lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya, if you believe we’ve mishandled your data.
To exercise any of these, email hey@reinventprog.com. We’ll respond within a reasonable time and no later than required by law.
8. Security
We use industry-standard measures to protect your data, including access controls limiting who on our team can see what, and encrypted storage and transmission. No system is perfectly secure; if we ever become aware of a data breach affecting you, we will notify you and the ODPC as required by law.
9. Cookies and tracking
This site does not currently use advertising or analytics tracking cookies. We load Google Fonts (a static stylesheet) for typography, which may cause your browser to make a request to Google’s servers containing your IP address, under Google’s own privacy policy. We do not run Google Analytics, Meta Pixel, or similar third-party trackers at this time. If that changes, this policy and a cookie consent notice will be updated before any such tracking goes live.
10. Changes to this policy
We may update this policy from time to time. The “Last updated” date at the top will change, and material changes will be communicated to active clients directly.
11. Contact
Questions about this policy or your data: hey@reinventprog.com. See also our Terms of Service.