1. Who we are
Phindor Limited (“Phindor”, “we”, “us” or “our”) is an AI infrastructure company based in Nairobi, Kenya. We build and operate technology for localised AI models, speech and voice systems, hosted inference and model infrastructure, AI service access through products such as JuaFlow, and domain-specific AI systems.
This Privacy Policy explains how personal data is handled across phindor.com and other Phindor Services where this policy is presented or incorporated by reference.
2. Our roles: controller and processor
Our role depends on the context. We are a data controller when we decide why and how personal data is processed, for example when you contact Phindor, create an account, request access to a model, visit our website or participate directly in our research with us as the responsible organisation.
We are commonly a data processor when an organisation uses Phindor infrastructure to process information about its own customers, employees, communities or users. In that case, the organisation normally determines the purpose and lawful basis, and we process data under its instructions and our agreement with it.
Some collaborations, research projects or jointly designed deployments may involve separate or joint responsibilities that are defined in the relevant agreement and notices.
3. Services covered by this policy
This policy covers personal data processed through Phindor Services, which may include:
- language-model development, adaptation, fine-tuning, evaluation and benchmarking;
- datasets, evaluation sets, model registries, repositories and access-request systems;
- hosted inference, model APIs, model routing and compute infrastructure;
- speech recognition, speech synthesis, calls, voice notes, transcripts and voice-agent systems;
- JuaFlow and other infrastructure that connects AI to knowledge, APIs, databases, business systems and human teams;
- domain-specific AI systems and pilots in sectors such as health, agriculture, manufacturing, finance, workforce and public services; and
- our websites, developer tools, dashboards, research programmes and support channels.
4. Information we may process
Depending on the Service, we may process:
- identity and contact data: names, email addresses, phone numbers, organisation, role and account identifiers;
- commercial and account data: subscriptions, agreements, billing information, support history and service configuration;
- Customer Content: messages, documents, prompts, responses, records, knowledge sources, uploaded files and connected-system data;
- model and dataset materials: datasets, labels, evaluation sets, prompts, model weights, adapters, checkpoints, model metadata and benchmark results;
- voice and speech data: audio, recordings, voice notes, transcripts, call metadata, pronunciation or language samples, and generated speech;
- model-access information: where access is controlled, organisation, country or region, intended use, reason for access, approvals and download/API logs;
- technical and usage data: IP address, device/browser information, API activity, logs, latency, errors, model versions, token or compute usage, security events and diagnostic information; and
- integration data: information exchanged with services you or a customer choose to connect, such as messaging platforms, telephony, databases, ERP/CRM systems, calendars, cloud services and custom APIs.
5. How we collect information
We receive information directly from individuals, customers and partners; through use of our Services and APIs; from connected systems; through authorised research or data-collection programmes; and from public, licensed, partner-contributed or open datasets where we have a lawful basis and the required rights to process them.
Public availability does not automatically make personal data or content unrestricted. Where public or third-party data is used for research, model development or evaluation, we assess applicable privacy, intellectual-property, licence and purpose restrictions.
6. Why we process data
We process information as necessary to:
- provide, host, operate and support our Services;
- run model inference, speech processing, service-access and connected-system functions requested by customers;
- train, adapt, evaluate or benchmark models where the relevant dataset, agreement and lawful basis permit that processing;
- administer model repositories, downloads, access requests and developer APIs;
- secure our infrastructure, prevent abuse, investigate incidents and maintain auditability;
- measure reliability, latency, quality and system performance;
- conduct authorised research, pilots and product development;
- manage accounts, contracts, billing, support and communications;
- comply with legal, regulatory, contractual and dispute-resolution obligations; and
- send permitted marketing or event communications subject to applicable choices.
7. Legal bases
Where Kenya’s Data Protection Act, 2019 or another applicable law requires a lawful basis, we rely on one or more appropriate bases, including performance of a contract, compliance with a legal obligation, legitimate interests that do not override individual rights, protection of vital interests, public-interest functions where applicable, research or statistical grounds recognised by law, or consent.
When we act as processor, the customer normally determines the lawful basis for the underlying processing unless law provides otherwise.
8. Model development, training and evaluation
Phindor may develop, adapt, fine-tune, evaluate or benchmark AI models using data from sources that are appropriate for the particular project. These may include licensed datasets, public datasets that may lawfully be used, consented or partner-contributed data, internally created data, synthetic data and customer-provided data where the customer has instructed or agreed to the processing.
Private Customer Content, private customer datasets and customer-owned model artefacts are not used to train general-purpose models for other customers unless the customer expressly agrees in writing.
Where model training involves personal data, we apply purpose limitation, data minimisation, access controls and other safeguards appropriate to the risk. Where reasonably possible for the objective, we prefer de-identified, pseudonymised, aggregated or synthetic data over directly identifying data.
Evaluation results and service telemetry may be used to improve reliability, safety and performance where permitted by law and contract. We do not attempt to re-identify data that has been properly anonymised.
9. Customer models, hosted inference and compute
If a customer or model owner uploads a model, weights, adapter or related artefact for hosting or inference, we process that artefact and related metadata as necessary to provide the requested service. Access to private models is limited according to the account, workspace and permissions configured for the Service.
Inference requests may include prompts, audio, images, documents or structured data. Depending on configuration, inputs and outputs may be retained temporarily for reliability, safety, abuse prevention, debugging, billing or audit purposes, or for a longer period where the customer requests storage or a contract requires it.
10. Model registries, repositories and access requests
Where Phindor provides a model registry, repository or controlled-download service, we may collect account details, organisation, intended use, country or region, reasons for access and download/API logs. This information may be used to enforce licences, geographic or eligibility restrictions, prevent abuse and understand how resources are being used.
Where a model owner controls access, we may share an access request or relevant request details with that model owner when this is made clear at the point of collection or is otherwise authorised by the applicable arrangement.
11. Voice, speech and recorded communications
Voice Services may receive or generate audio, create transcripts, analyse language or acoustic information, process call metadata, or convert text to speech. Customers are responsible for ensuring that notices or consents required for recording, transcription, monitoring or automated calling are provided for their use case.
A voice recording is not automatically biometric data. Where voice or other features are processed specifically for unique identification, authentication or another biometric purpose, additional safeguards and legal requirements may apply.
Speech data used to build or evaluate language or voice models is processed according to the applicable consent, dataset licence, research protocol, partner agreement or other lawful basis.
12. Service access, agents and connected systems
Services such as JuaFlow may process requests received through web, messaging, email or voice; retrieve information from knowledge sources; interact with business systems; invoke tools or APIs; and create or update records.
Where Phindor acts as a processor, the customer controls which systems are connected, what permissions are granted, the relevant retention settings and the purposes for which personal data is processed.
13. AI outputs and automated decisions
Our Services may classify, retrieve, generate, translate, transcribe, recommend, route or act on information using machine-learning systems. AI outputs are probabilistic and can be incomplete or incorrect.
Phindor Services are not intended by default to make solely automated decisions that produce legal or similarly significant effects on a person. Where a customer or project involves profiling or significant automated decision-making, the responsible controller must ensure an appropriate lawful basis, transparency, safeguards, meaningful human involvement where required, and a way for affected people to exercise applicable rights.
14. Sensitive data, regulated sectors and children
Some deployments may involve health, financial, employment, education, identity, public-service or other sensitive information. These uses may require additional legal bases, explicit consent, sector requirements, impact assessments, stricter access controls, local hosting or contractual safeguards.
Our general business Services are not directed at children. Where a lawful customer or research project involves children or minors, the responsible party must establish the required authority, notice, consent and safeguards, and Phindor will process the data according to the relevant agreement and law.
15. Service providers, subprocessors and third parties
We may use providers for cloud hosting, compute, GPUs, AI inference, communications, telephony, security, analytics, payment, support and other infrastructure. Providers that process personal data for us are subject to appropriate contractual or legal obligations according to their role.
Customers may choose to connect third-party services. Information is exchanged with those services only as needed for the requested integration or action, and their own terms and privacy practices also apply.
Open-source or third-party models and datasets may be subject to separate licences and data practices of their owners or providers.
16. International and cross-border processing
Phindor is based in Kenya and may use infrastructure or service providers located in other countries. Where personal data is transferred outside Kenya, we apply safeguards required by the Data Protection Act and the Data Protection (General) Regulations, including appropriate contractual, organisational or other safeguards where required.
Deployments in other African countries or jurisdictions may also be subject to local privacy, telecommunications, data-residency, health, financial or sector rules. Those obligations are addressed according to the relevant role, customer agreement and deployment.
17. Security and access controls
We use technical and organisational measures designed to protect data and model artefacts from unauthorised access, loss, alteration, disclosure or destruction. Depending on the Service, measures can include authentication, role-based access, network controls, encryption in transit, logging and audit trails, environment separation, secrets management, backup and recovery, monitoring and incident response.
No system is completely secure. Customers and users also have responsibilities, including protecting credentials and API keys, limiting permissions and promptly revoking access that is no longer needed.
18. Personal-data breaches
We maintain procedures for investigating and responding to suspected personal-data breaches. Where Phindor acts as a processor, we notify the relevant customer/controller without undue delay and in accordance with applicable contractual and legal requirements. Where Phindor acts as controller, we make regulatory or individual notifications when required by law.
Under Kenya’s Data Protection Act, processors have notification duties to controllers and controllers may have notification duties to the Office of the Data Protection Commissioner within the statutory timelines where the relevant threshold is met.
19. Retention, deletion and backups
We retain personal data, Customer Content and model-related artefacts only for as long as reasonably necessary for the relevant purpose or as required by law, contract, security, research governance, tax, accounting or dispute-resolution needs.
Retention for datasets, training runs, checkpoints, evaluation artefacts, logs and hosted models may vary by project or agreement. When data is deleted from active systems, residual copies may remain for a limited period in backups or disaster-recovery systems before being overwritten or securely removed.
20. Your privacy rights
Subject to applicable law and our role in the processing, individuals may have rights to be informed; access personal data; request correction or deletion; object to or restrict processing; withdraw consent where consent is the basis; request portability where applicable; and seek safeguards in relation to solely automated decisions.
If your data is processed by Phindor on behalf of one of our customers, the customer is usually the appropriate first contact. We support customers in responding where required by contract and law.
For data for which Phindor is controller, contact info@phindor.com. We may need to verify identity before acting on a request.
21. Data-protection impact assessments and high-risk processing
Where processing is likely to create a high risk to the rights and freedoms of individuals, applicable law may require a data-protection impact assessment or additional safeguards. Relevant factors can include large-scale processing, sensitive data, systematic monitoring, biometric identification, new technologies and automated decisions with significant effects.
We may work with customers and partners to assess technical risks and safeguards, but each party remains responsible for its legal obligations according to its role.
22. De-identified, aggregated and synthetic information
We may create or use information that has been aggregated, de-identified or anonymised so that it is no longer personal data under applicable law, for research, analytics, safety, reliability, capacity planning and product development. We do not attempt to re-identify properly anonymised information.
We may also use synthetic data to test or develop systems where appropriate.
23. Marketing, events and communications
You can opt out of marketing communications using the unsubscribe mechanism provided or by contacting us. We may still send service, security, billing, research-participation or administrative communications where necessary.
24. Cookies and website technologies
Phindor.com is primarily informational. We may use essential website technologies, server logs and limited analytics to operate, secure and understand the website. If we introduce non-essential cookies or similar technologies that require consent, we will provide appropriate notice and controls.
25. Business transfers and corporate changes
If Phindor is involved in a merger, acquisition, financing, reorganisation, sale of assets or similar transaction, information may be disclosed to advisers and transaction parties subject to appropriate confidentiality and legal safeguards. Any successor remains subject to applicable data-protection obligations.
26. Kenya law, other jurisdictions and complaints
This policy is anchored in Kenya’s Data Protection Act, 2019 and its implementing regulations. Where another jurisdiction’s law applies to a particular Service, dataset, research project or deployment, we comply with applicable additional obligations according to our role.
If you have a concern, contact us first at info@phindor.com. You may also lodge a complaint with Kenya’s Office of the Data Protection Commissioner at odpc.go.ke, or with another competent authority where applicable.
27. Third-party websites and resources
Our websites and Services may link to third-party sites, model repositories, datasets or applications. We do not control those third parties, and their privacy practices are governed by their own policies.
28. Changes to this policy
We may update this policy as our technology, research, Services or legal obligations evolve. The current version will always be published at this URL. Where a change materially affects how we use personal data, we will provide additional notice where required.
29. Contact
Privacy questions, rights requests and security reports can be sent to info@phindor.com.
Phindor Limited · Nairobi, Kenya · phindor.com