Pilot Edition — Phase 1 | Version 1.0 | Governed by the Kenya Data Protection Act, 2019
Effective Date: 14/04/2026
This Privacy Policy explains how Cropaite Technologies collects, uses, stores, and protects your personal and farm data when you use the Cropaite mobile application during the Phase 1 Pilot Programme. It is written in plain language because we believe every farmer deserves to understand exactly what happens to their data.
| What We Collect | Why We Collect It |
|---|---|
| Your name, phone number, email, and farm details | To create your account and contact you with support |
| Crop scan photographs | To train and improve our AI disease detection model |
| GPS location of scans (if permitted) | To map disease by region and improve the agrovet locator |
| Device type and app usage data | To fix bugs and improve app performance |
| Feedback and survey responses | To understand what is working and what to improve |
We do not sell your data. We do not use your data for advertising. You can request deletion of your data at any time by contacting privacy@cropaite.com.
Cropaite Technologies ("Cropaite", "we", "us", "our") is a technology company incorporated in Kenya, with its principal place of business in Naivasha, Nakuru County, Kenya. Cropaite is the data controller responsible for all personal data processed through the Cropaite mobile application and Pilot Programme.
This Privacy Policy applies to:
This policy does not apply to third-party websites or applications that may be linked from within the Cropaite app. Please review the privacy policies of those third parties independently.
| Legal Basis | When We Use It |
|---|---|
| Consent | For data uses you have specifically agreed to in the Data Consent Form, including scan image use for AI training |
| Performance of Contract | To deliver the Cropaite app and Pilot Programme services under the Pilot Agreement |
| Legitimate Interests | For product improvement, bug fixing, security monitoring, and aggregate research |
| Legal Obligation | Where Kenyan law requires us to retain or disclose data, such as for regulatory compliance or court orders |
| Purpose | Legal Basis |
|---|---|
| Creating and managing your Pilot account | Contract |
| Delivering AI crop disease diagnoses | Contract |
| Training and improving the AI model (anonymised data) | Consent |
| Providing treatment recommendations | Contract |
| Operating the agrovet locator | Contract |
| Providing Pilot support and check-in calls | Contract |
| Fixing bugs and improving app performance | Legitimate Interest |
| Monitoring Pilot programme performance | Contract |
| Producing aggregate anonymised research reports | Legitimate Interest |
| Contacting you about Phase 2 opportunities (optional) | Consent |
| Complying with Kenyan legal obligations | Legal Obligation |
When you scan a crop using the Cropaite app, the photograph is processed by our AI model to generate a disease diagnosis. That image — along with the diagnosis result and treatment outcome (if logged) — is stored on Cropaite's secure cloud servers and used to train and improve the AI model.
The Cropaite app will request permission to access your device GPS when you perform a scan. Your exact location coordinates are recorded alongside each scan to build a regional disease prevalence map, power the agrovet locator, and improve AI accuracy by geographic zone. You may decline GPS permission without affecting the core scanning functionality.
All Cropaite data is stored on secure cloud infrastructure hosted within Africa or the European Economic Area. We do not store personal data on servers located in countries without adequate data protection frameworks.
In the event of a personal data breach, Cropaite will notify the Office of the Data Protection Commissioner of Kenya within 72 hours of becoming aware of the breach, and will notify affected participants without undue delay, as required by the Kenya Data Protection Act, 2019.
| Data Category | Retention Period |
|---|---|
| Crop scan images | 3 years from Pilot end date — then anonymised or deleted |
| Personal identity data (name, contact) | 1 year after Pilot conclusion, or earlier on request |
| Feedback and survey responses | 2 years in identifiable form — then anonymised for research |
| Treatment logs and outcome records | 3 years — for AI model training and accuracy improvement |
| Device and crash logs | 6 months — then automatically deleted |
| GPS location data | 3 years — anonymised at source after 12 months |
| Communications (email, WhatsApp) | 2 years from last communication |
Cropaite does not sell, rent, or trade your personal data to any third party. We share data only in the following limited circumstances:
We share data with trusted third-party service providers who help us operate the platform. These providers are bound by data processing agreements. Current categories include cloud infrastructure and hosting providers (Google Firebase, Render), AI analysis engine (OpenAI — processes images for analysis only), and mobile analytics tools.
Aggregate and anonymised data — with no information that could identify you or your farm — may be shared with agronomic research institutions for the purpose of improving crop disease knowledge across East Africa.
We may disclose your data if required to do so by Kenyan law, court order, or a competent regulatory authority. Where legally permitted, we will notify you before complying with such a requirement.
To exercise any of the rights below, contact privacy@cropaite.com. We will respond within 21 days.
| Your Right | What It Means |
|---|---|
| Right of Access | You may request a copy of all personal data Cropaite holds about you |
| Right to Rectification | You may ask us to correct any inaccurate or incomplete data |
| Right to Erasure | You may ask us to delete your personal data (subject to AI model training limitations) |
| Right to Restrict Processing | You may ask us to pause processing of your data while a dispute is resolved |
| Right to Data Portability | You may request your data in a structured, machine-readable format (JSON or CSV) |
| Right to Object | You may object to processing based on legitimate interests |
| Right to Withdraw Consent | You may withdraw consent at any time without affecting prior lawful processing |
| Right to Lodge a Complaint | You may complain to the ODPC at www.odpc.go.ke |
The Cropaite application is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a child under 18 has submitted personal data, please contact us at privacy@cropaite.com and we will delete that data without delay.
We may update this Privacy Policy as the Cropaite platform evolves. We will notify Pilot Participants of any material changes by email at least 14 days before they take effect. Your continued use of the Cropaite app after notification constitutes acceptance of the updated policy.
If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya:
www.odpc.go.ke | Bishops Garden Towers, Bishops Road, Nairobi.