Privacy Notice

This notice concerns personal information used in connection with African Stock Markets. It is being reviewed against Kenya's Data Protection Act 2019 and applicable regulations.

"African Stock Markets" is the service name used here. The operator's full legal identity, address and final data-controller details must be confirmed before this notice is finalised. Privacy requests can be sent through our contact page.

What information is involved

• Accounts: an email address, account identifier and information needed for the sign-in method you choose. Authentication is handled through Supabase. A third-party sign-in provider may also supply account information through that sign-in process.
• Watchlists: the companies you choose, the lists you create and the account identifiers needed to keep those lists associated with your account.
• Reminders: selected events or companies, alert preferences, email-consent choices and delivery-related records where the reminder service is enabled.
• Messages: the information you choose to send when reporting an error, requesting support, discussing a partnership or making a privacy request.
• Usage and technical information: page visits and feature-use events where analytics is configured, along with the technical information processed by hosting and error-reporting services to operate the site.

You can read public research without creating an account. If you do not provide information needed for an optional account feature, that feature may not be available to you.

Please do not send passwords, sign-in codes, payment details or identity documents in an initial support message.

Why information is used and proposed legal bases

The proposed bases below require confirmation as part of legal review:

• Accounts and requested features: providing the service you request, including authentication and saved watchlists, on the basis of performing the relevant service agreement or taking steps at your request.
• Optional reminder emails: your request and the consent required by the email-alert flow. You can change your alert choices and use unsubscribe options where supplied.
• Optional analytics: consent is the intended basis. The gap between that policy and the current implementation is explained below.
• Support, security and reliability: responding to requests, preventing misuse and investigating service failures, on the basis of the operator's legitimate interests where those interests are not overridden by your rights.
• Legal obligations: complying with an applicable legal requirement when one arises.

Information should be used only for a stated, lawful purpose. These proposed bases are not a claim that every operational or contractual requirement has already been completed.

Analytics and consent: implementation under review

The site uses PostHog when the relevant site key is configured in production. Its configuration disables automatic capture of page elements and session recordings. It uses browser local storage for analytics persistence.

Reminder-conversion analytics require explicit PostHog opt-in in the application code. However, ordinary page-view and feature-use events are not currently protected by an equivalent explicit opt-in gate.

Consent enforcement for general analytics is a release blocker for the final notice. We cannot currently claim that all optional analytics waits for consent, or that a site-wide consent control is available. The intended consent-only policy must be implemented and verified separately.

If you have a question or objection about analytics processing, contact us. Where consent is the basis for processing, you have the right to withdraw it; withdrawal does not make earlier processing based on valid consent unlawful.

Browser storage

Account sessions use storage needed for authentication. The site also stores interface preferences, such as theme and dismissal of the first-visit information notice.

The reminder sign-up flow can use a host-only, 30-minute cookie to retain the selected event and a local return path during sign-in. That pending-reminder cookie is not intended to hold an email address or sign-in credentials.

PostHog's configured analytics persistence is separate from these service and preference uses. The full storage and consent arrangement must be checked before the final notice is approved.

Service providers and other recipients

The code uses or supports these providers for the stated roles:

• Supabase: authentication, application databases and associated storage services.
• Vercel: application hosting and delivery.
• Resend: calendar-alert email delivery when that sender is enabled. The provider used for authentication emails depends on the Supabase project's email configuration and still needs confirmation.
• PostHog: configured product and usage analytics.
• Sentry: configured error and performance reporting. The application disables default personal-information capture and applies event scrubbing; session replay is not enabled.

If you choose Google sign-in, Google's authentication service is also involved. The information shared through that flow depends on the sign-in permissions and provider settings; Google's own privacy terms also apply.

These services may process information needed to perform their roles. The exact processor contracts, subprocessors, regions and retention settings must be confirmed by the operator. If information has to be disclosed to comply with law or establish or defend a legal claim, the applicable legal basis must be assessed.

Retention

We need account, watchlist and reminder information for as long as it is required to provide the requested features, resolve a request or meet an applicable legal obligation.

The detailed retention schedule, account-deletion procedure, backup expiry and analytics and diagnostic retention settings are still under review. This notice does not promise automatic deletion after an unverified number of days.

You can request deletion or ask how a category of information is retained. Some records may need to be retained for a lawful reason; any applicable exception should be explained when responding to your request.

Processing outside Kenya

Cloud providers may process information outside Kenya, depending on the configured regions and service arrangements. We do not claim that all information stays in Kenya.

The destination countries, applicable transfer basis and safeguards must be confirmed before the notice is finalised. Transfers must meet the conditions of Kenya's Data Protection Act, including the additional requirements that apply to sensitive personal data where relevant.

Naming a provider here does not, by itself, establish that the required transfer safeguards are in place.

Your rights

Subject to the conditions and exceptions in applicable law, you can request:

• Information about the use of your personal data and access to it.
• Correction of inaccurate or misleading information.
• Deletion of information that should not be retained or is otherwise eligible for erasure.
• Restriction of or objection to processing in applicable circumstances.
• Withdrawal of consent where consent is the basis for processing.
• Data portability where the legal conditions for that right apply.

Use Privacy requests and explain the information or account involved. We may ask for proportionate information to verify your identity and authority. Do not send identity documents unless a necessary, appropriate verification process has been agreed.

You can also raise a complaint with Kenya's Office of the Data Protection Commissioner. This is not a claim that the service holds any registration or approval from that office.

Security and changes to this notice

Account features use authentication and application access controls. No online service can promise that every security risk is eliminated. Please report a suspected account or data issue through Contact.

We will update the last-updated date when this text changes. The operator must complete the identified legal and technical reviews, including consent, retention and international-transfer arrangements, before treating this as the final notice.