Privacy Policy

This Privacy Policy explains how Hisia ("Hisia", "we", "us", or "our") collects, uses, stores, shares, and protects information when you visit https://hisia.app, create an account, request a demo, or use the Hisia live media listening, sentiment analysis, public opinion research, and multi-channel outreach platform (collectively, the "Services").

This Privacy Policy is drafted to comply with:

• The Data Protection Act, 2019 (Laws of Kenya) and the Data Protection (General), (Registration of Data Controllers and Data Processors), and (Complaints Handling and Enforcement Procedures) Regulations, 2021 overseen by the Office of the Data Protection Commissioner (ODPC).
• The European Union General Data Protection Regulation (Regulation (EU) 2016/679) (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR), and the UK Data Protection Act 2018.
• United States federal and state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA, Cal. Civ. Code § 1798.100 et seq.), the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), the Connecticut Data Privacy Act (CTDPA), the Texas Data Privacy and Security Act (TDPSA), and the Children's Online Privacy Protection Act (COPPA).

For privacy questions, data subject access requests, or opt-out notices, contact our Data Protection Officer (DPO) at privacy@hisia.app.

Because Hisia serves both as a software provider to our customers and as a media listening and outreach tool operated by our customers, data protection laws distinguish between two roles:

• Hisia as a Data Controller (or 'Business' under US law): We act as the Data Controller for account registration details, billing records, workspace administrator profiles, marketing inquiries, and website analytics collected on https://hisia.app. We also act as an independent Controller to the limited extent we index publicly broadcast television, radio, press, and public social media posts under statutory exemptions for publicly available data and legitimate interests.
• Hisia as a Data Processor (or 'Service Provider' / 'Contractor' under US law): When an organization, brand, agency, or campaign ('Customer') uploads audience lists, connects its own WhatsApp, TikTok, X, Facebook, Instagram, Telegram, or SMS accounts, or uses our unified inbox and campaign outreach tools, the Customer is the Data Controller and Hisia acts strictly as a Data Processor acting on the Customer's documented instructions.
• Customer Responsibility: Each Customer is solely responsible for ensuring that it has a valid legal basis, required opt-in consent, and clear opt-out mechanisms for any direct messaging, SMS, WhatsApp, or social outreach conducted through its Hisia workspace.

We collect three distinct categories of information depending on how you interact with Hisia:

• Category A — Account, Billing & Workspace Data: Full name, work email address, phone number, organization or campaign name, job title, role permissions, authentication credentials (hashed), billing address, tax identification numbers, and payment transaction references processed by our PCI-DSS compliant payment partners.
• Category B — Publicly Available Media & Social Listening Data: Publicly aired TV and FM/regional radio segments, newspaper articles, online press stories, public podcasts, and public social media posts, comments, hashtags, engagement counts, author handles, and public location tags made available by the original publisher or poster on public platforms.
• Category C — Customer-Uploaded Outreach & Unified Inbox Data: Contact names, phone numbers, social handles, group thread metadata, drafted messages, scheduled posts, and inbound replies managed by a Customer inside its private Hisia workspace.
• Category D — Technical, Device & Telemetry Data: IP address, browser type and version, operating system, referring URLs, time zone, pages viewed, click paths, session duration, and crash diagnostics.

A core function of Hisia is helping teams hear what the public is saying across live broadcast stations, print press, and public social channels. Our processing of publicly available media content rests on clear statutory exemptions across all three jurisdictions:

• Kenya Data Protection Act, 2019: Under Section 30(1)(b)(i) of the Kenya DPA, personal data may be collected from a source other than the data subject where the data is contained in a public record or has deliberately been made public by the data subject. Under Section 25 and Section 30(1)(b), processing is further justified where necessary for the legitimate interests pursued by the data controller or a third party, and under Section 52 for journalism, literature, and public-interest research.
• EU & UK GDPR: Under Article 6(1)(f) of the GDPR, Hisia and its Customers have a legitimate interest in monitoring public broadcasts, news reporting, and public social discourse to understand public opinion, measure brand or campaign reputation, detect misinformation, and respond to public concerns. To the extent any public post contains special-category data, processing is strictly limited to data manifestly made public by the data subject under Article 9(2)(e) GDPR.
• United States Law (CCPA/CPRA & State Privacy Acts): Under California Civil Code § 1798.140(v)(2) and parallel exemptions in Virginia, Colorado, Connecticut, and Texas, 'personal information' does not include publicly available information that is lawfully made available from federal, state, or local government records, or information that a consumer has lawfully made available to the general public via widely distributed media or unrestricted social media posts.
• Source Removal & Author Opt-Out: If a public post is deleted or made private on the originating social platform, or if an individual contacts privacy@hisia.app requesting suppression of their public social handle from our search index, we honor removal requests promptly.

We process information only for specific, transparent purposes paired with a recognized legal basis under the Kenya DPA and GDPR:

• Providing & Operating the Services (Performance of a Contract — GDPR Art. 6(1)(b); Kenya DPA s. 30(1)(b)(ii)): Creating workspaces, delivering live media monitoring, generating sentiment and performance reports, and routing unified inbox messages.
• Security, Fraud Prevention & System Reliability (Legitimate Interests — GDPR Art. 6(1)(f); Kenya DPA s. 30(1)(b)(vii)): Detecting unauthorized access, preventing abuse or spam, enforcing rate limits, and debugging application errors.
• Product Improvement & Analytics (Legitimate Interests / Consent where required): Understanding which features teams use most, optimizing page load speed, and fixing broken user flows.
• Legal & Regulatory Compliance (Legal Obligation — GDPR Art. 6(1)(c); Kenya DPA s. 30(1)(b)(iii)): Complying with tax, accounting, law-enforcement, and data protection authority requirements.
• No Model Training on Private Workspace Data: We never use your private workspace drafts, uploaded contact lists, or private WhatsApp/SMS outreach threads to train public foundation models or share with other customers.

To keep Hisia fast, reliable, and easy to use, our production website and web application use essential cookies alongside three specialized product analytics and diagnostic tools:

• Microsoft Clarity: We partner with Microsoft Clarity to capture how visitors interact with our website through behavioral metrics, heatmaps, and session replay so we can improve site usability. Website usage data is captured using first- and third-party cookies and other tracking technologies to determine the popularity of features and online activity. For more information about how Microsoft collects and uses your data, visit the Microsoft Privacy Statement (https://privacy.microsoft.com/privacystatement).
• PostHog Product Analytics: We use PostHog (hosted via https://us.i.posthog.com) configured in 'identified_only' profile mode to measure pageviews, feature adoption, and navigation flows. PostHog helps us see which workflows save teams time and where users drop off.
• LogRocket Session Diagnostics: We use LogRocket (loaded via https://cdn.lr-ingest.com) to record technical session telemetry, network request errors, and console exceptions so our engineering team can reproduce and fix bugs rapidly.
• How to Opt Out: You can block or delete cookies at any time through your browser settings, enable Global Privacy Control (GPC) or Do Not Track (DNT) signals in your browser, or email privacy@hisia.app to opt out of non-essential analytics.

If you are located in the Republic of Kenya, the Data Protection Act, 2019 (No. 24 of 2019) grants you specific statutory rights regarding your personal data:

• Section 26 Rights of a Data Subject: You have the right to (a) be informed of the use to which your personal data is to be put; (b) access your personal data in our custody; (c) object to the processing of all or part of your personal data; (d) correction of false or misleading data; and (e) deletion of false or misleading data about you.
• Automated Decision-Making (Section 35): You have the right not to be subject to a decision based solely on automated processing which produces legal effects concerning or significantly affecting you. Hisia's sentiment scores and media summaries are analytical decision-support tools for human communications teams and do not make automated legal, credit, or employment decisions about individuals.
• Data Portability (Section 38) & Right to Erasure (Section 40): You may request a portable copy of your account data in a structured, commonly used machine-readable format, or request erasure of personal data that we are no longer authorised to retain.
• Cross-Border Data Transfers (Part VI, Sections 48–50): Where we transfer personal data outside Kenya for cloud hosting, analytics, or infrastructure redundancy, we ensure appropriate safeguards are in place—including Standard Contractual Clauses, encryption in transit and at rest, and verification that the recipient jurisdiction maintains commensurate data protection standards.
• Right to Lodge a Complaint: If you believe your rights under the Kenya DPA have been infringed, you may contact our DPO at privacy@hisia.app or lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at https://www.odpc.go.ke.

If you are located in the European Economic Area (EEA), Switzerland, or the United Kingdom, you have the following rights under Chapter III (Articles 15–22) of the GDPR:

• Right of Access (Art. 15) & Rectification (Art. 16): Request confirmation of whether we process your personal data, obtain a copy of that data, and correct inaccurate or incomplete records.
• Right to Erasure / 'Right to be Forgotten' (Art. 17) & Restriction (Art. 18): Request deletion of your personal data or temporary restriction of processing where legal grounds apply.
• Right to Data Portability (Art. 20) & Right to Object (Art. 21): Receive your personal data in a structured, machine-readable format and object at any time to processing based on legitimate interests (Art. 6(1)(f)) or direct marketing.
• International Data Transfers (Chapter V): When personal data is transferred outside the EEA, Switzerland, or the UK to countries not covered by an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (SCCs, Decision (EU) 2021/914) together with the UK International Data Transfer Addendum (IDTA) and supplementary technical encryption safeguards.
• Supervisory Authority: You have the right to lodge a complaint with your local EU/EEA Data Protection Authority or the UK Information Commissioner's Office (ICO) at https://ico.org.uk.

If you are a resident of California, Virginia, Colorado, Connecticut, Texas, or another US state with comprehensive consumer privacy legislation, this section provides required statutory disclosures:

• No Sale or Cross-Context Behavioral Advertising Share: Hisia does NOT sell your personal information for monetary or other valuable consideration, and we do NOT 'share' your personal information for cross-context behavioral advertising as defined under Cal. Civ. Code § 1798.140(ad) and (ah).
• Sensitive Personal Information: We do not collect or use Sensitive Personal Information for the purpose of inferring characteristics about consumers.
• Your US State Privacy Rights: You have the right to (1) Know and access the specific pieces and categories of personal information we have collected about you in the preceding 12 months; (2) Delete personal information we collected from you, subject to statutory exceptions; (3) Correct inaccurate personal information; (4) Opt Out of targeted advertising, sales, or profiling in furtherance of decisions that produce legal or similarly significant effects; and (5) Non-Discrimination for exercising any of your privacy rights.
• Exercising Your Rights & Appeals: Submit requests by emailing privacy@hisia.app with the subject line 'US Privacy Rights Request'. We verify requests using the email address associated with your interaction and respond within 45 days. If we decline to take action on a request, you may appeal our decision by replying 'Privacy Appeal' to our response, and we will provide a written determination within 45 days.

We share personal data only with vetted third-party service providers ('Sub-Processors') who are bound by written data processing agreements, confidentiality obligations, and security standards:

• Cloud Infrastructure & Content Delivery: Secure cloud hosting, database storage, and edge content delivery networks that power the Hisia web application.
• Product Analytics & Diagnostics: Microsoft Clarity, PostHog, and LogRocket for website usability, product performance, and error resolution.
• Customer-Connected Platforms: When a Customer connects third-party APIs (such as WhatsApp Business, Meta, X, TikTok, YouTube, Telegram, or SMS gateways), data is transmitted to those platforms strictly at the Customer's direction.
• Law Enforcement & Legal Process: We do not voluntarily disclose Customer workspace data to government or law enforcement agencies. We will only disclose non-public account records when compelled by a valid, binding subpoena, court order, or warrant issued under applicable law, and we will notify the affected Customer in advance unless legally prohibited from doing so.

We engineer Hisia with defense-in-depth security controls to protect your workspace and personal data:

• Technical & Organizational Safeguards: All data in transit is encrypted via TLS 1.2/1.3, and sensitive workspace data at rest is encrypted using industry-standard AES-256 encryption. We enforce role-based access controls, multi-factor authentication for administrative systems, and continuous vulnerability monitoring.
• Data Breach Notification: In the event of a personal data breach affecting your rights and freedoms, we will notify the Office of the Data Protection Commissioner (ODPC) under Section 43 of the Kenya DPA, relevant EU/UK supervisory authorities under Article 33 of the GDPR within 72 hours, and affected Customers or individuals without undue delay as required by US state data breach statutes.
• Data Retention Schedule: We retain Customer workspace data for the duration of an active subscription agreement. Upon account termination or written request, workspace data is deleted or anonymized within 30 to 90 days (except where longer retention is required by tax, audit, or legal obligations).

Hisia is a B2B and organizational communications platform designed exclusively for adults and professional teams.

• Age Restriction (18+ / COPPA Compliance): Our Services are not directed to children under the age of 18 (or under 13 as defined by the US Children's Online Privacy Protection Act, COPPA, 15 U.S.C. § 6501 et seq., or under 18 under Section 33 of the Kenya DPA). We do not knowingly collect personal data from minors. If you believe a minor has provided personal data to us, contact privacy@hisia.app and we will delete it immediately.
• Changes to This Privacy Policy: We may update this Privacy Policy periodically to reflect new features or regulatory updates. When we make material changes, we will update the 'Last Updated' date at the top of this page and notify workspace administrators.
• Contact Our Privacy & Legal Team: For all privacy inquiries, Data Subject Access Requests (DSARs), GDPR/Kenya DPA objections, or US state opt-out requests, email privacy@hisia.app or legal@hisia.app.