Privacy Policy
Effective date: 1 October 2026
This policy applies to the UzioMeme platform, operated by DSAIL at Dedan Kimathi University of Technology.
1. Who We Are
The UzioMeme platform ("Platform", "we", "us") is operated by the Centre for Data Science and Artificial Intelligence (DSAIL) at Dedan Kimathi University of Technology, in partnership with Ol Pejeta Conservancy and National Geographic. The Platform provides real‑time electric fence monitoring, node voltage analytics, battery health tracking, weather integration, and email alerting for wildlife conservation operations at Ol Pejeta Conservancy, Kenya.
Data Controller contact: dsail-info@dkut.ac.ke
2. Scope of This Policy
This Privacy Policy applies to all persons who access the Platform, including:
- Administrators — authenticated users who manage fence nodes and configuration.
- Viewers — authenticated users who have read‑only access to live data and analytics.
- Public visitors — unauthenticated visitors who reach login or informational pages.
3. Information We Collect
3.1 Account Information (Google OAuth)
When you sign in via Google OAuth 2.0, we receive the following Google user data:
- Email address — used solely to identify you as an authorised user, determine your access role (Administrator or Viewer), and send system alert emails to designated recipients.
- Google-issued user ID — used internally to maintain your authenticated session via Supabase Auth.
We do not request, access, or store any other Google user data — including your Google profile photo, contacts, Google Drive files, calendar, or any other Google service data. No passwords are ever stored by the Platform.
Your Google user data is not sold, rented, traded, or shared with any third party except as described in Section 5 (the authentication processor Supabase, and Resend for alert email delivery to authorised recipients only). It is never used for advertising or profiling.
This use of Google user data is compliant with the Google API Services User Data Policy, including the Limited Use requirements.
3.2 Telemetry and Sensor Data
The Platform ingests time‑series data from LoRaWAN sensor nodes deployed along the electric fence perimeter. This data includes fence voltage (kV), battery voltage, RSSI, SNR, GPS coordinates of static node positions, data‑rate, and timestamps. This is device telemetry only — it does not relate to any identifiable natural person.
3.3 Usage and Log Data
Our infrastructure (Vercel, Supabase) may automatically collect standard server log data including IP addresses, browser user‑agent strings, pages visited, and timestamps. This information is used solely for security auditing, debugging, and platform reliability — it is not linked to your Google account.
3.4 Cookies and Local Storage
The Platform stores a single preference key (dfenz-theme) in your browser's localStorage to remember your light/dark mode preference. No third‑party advertising or tracking cookies are used. Supabase Auth may set a session cookie to maintain your authenticated session; this cookie is strictly necessary for login to function.
4. How We Use Your Information
| Data | Purpose | Legal Basis |
|---|---|---|
| Google email | Authenticate you; determine access role; send alert emails to authorised recipients | Legitimate interest (platform security) |
| Sensor telemetry | Display live fence status; generate alerts; produce analytics | Performance of a contract / legitimate interest (conservation operations) |
| Server logs | Security auditing; debugging; uptime monitoring | Legitimate interest (platform reliability) |
| Theme preference (localStorage) | Remember your UI preference across sessions | Your implicit consent by using the Platform |
5. Data Sharing and Disclosure
We do not sell, rent, or trade your personal data. We share data only with the following categories of processors, each bound by appropriate data‑processing agreements:
- Supabase — Authentication and database hosting (EU/US infrastructure).
- Vercel — Application deployment and edge functions (US/global CDN).
- Resend — Transactional email delivery for low‑voltage alerts.
- InfluxDB — Time‑series sensor data storage (self‑hosted instance at Ol Pejeta).
- cron-job.org — Scheduled HTTP pings to the alert‑check endpoint (no personal data transmitted).
We may disclose personal data if required by applicable law or a valid court order, or to protect the safety of persons or property.
6. Data Retention
- Account data: Retained while your account is active. Deleted within 30 days of a verified account deletion request.
- Sensor telemetry: Retained indefinitely for historical analytics and conservation research. This data is not personal data.
- Server logs: Retained for up to 90 days by Vercel and Supabase per their own policies.
7. Data Security
We implement industry‑standard technical and organisational measures to protect your data:
- All data in transit is encrypted with TLS 1.2 or higher.
- Authentication is delegated to Google OAuth 2.0 — no passwords are stored.
- Role‑based access control enforced at the database row level (Supabase RLS).
- API alert endpoints are protected by a secret key transmitted via HTTPS.
- Environment secrets (API keys, database credentials) are stored as encrypted environment variables on Vercel and are never committed to version control.
No method of transmission or storage is 100% secure. We will notify affected users promptly in the event of a confirmed data breach that presents a risk to their rights and freedoms.
8. Your Rights
Depending on your jurisdiction, you may have the right to:
- Access — request a copy of the personal data we hold about you.
- Rectification — ask us to correct inaccurate data.
- Erasure — ask us to delete your personal data (subject to legal retention obligations).
- Restriction — ask us to restrict processing of your data.
- Portability — receive your data in a structured, machine‑readable format.
- Objection — object to processing based on legitimate interest.
To exercise any of these rights, email dsail-info@dkut.ac.ke with the subject line "Privacy Request". We will respond within 30 days.
9. Third‑Party Services and Links
The footer displays logos that link to DSAIL, Ol Pejeta Conservancy, and National Geographic. These are independent third‑party websites with their own privacy policies. We are not responsible for their content or data practices.
10. Children's Privacy
The Platform is not directed at children under 18. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected such data, please contact us immediately so we can delete it.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will revise the effective date at the top of this page. If changes are material, we will notify authorised users by email. Continued use of the Platform after the effective date constitutes acceptance of the revised policy.
12. Contact
For privacy‑related questions or to exercise your rights:
Email: dsail-info@dkut.ac.ke