Privacy Policy.

This policy explains what personal data Kefita collects, why, and the choices you have. We handle personal data in line with Ethiopia’s Personal Data Protection Proclamation No. 1321/2024 and its implementing directives.

The short version: we collect what we need to run your account and your website, we don’t sell personal data, we don’t put tracking cookies on your published site, and you can ask us to see, correct or delete your data at any time.

Kefita, Addis Ababa, Ethiopia, is the data controller for the personal data of our customers (account holders). For messages that visitors send through a contact form on a customer’s site, the site owner is the controller and Kefita processes that data on their behalf.

Data protection contact: support@kefita.ai (subject “Privacy”).

From you, as a Kefita customer

• Account details — name, email address and sign-in method (email and password, or Google). Passwords are handled by our authentication provider; we never see them in plain text.
• Business and site content — what you tell us about your business, and the text, images and settings of your sites.
• Payment records — plan or domain bought, amount in ETB, date and Chapa transaction reference. Card numbers and mobile-money PINs go directly to Chapa; we never receive them.
• Domain registration details — when you buy a domain, the contact details the registry requires.
• Telegram chat ID — only if you turn on Telegram lead alerts.
• Support conversations — emails and Telegram messages you send us.

About visitors to published sites

• Contact-form messages — the name, phone/email/Telegram and message a visitor chooses to send, delivered to the site owner.
• Visit counts — we count page views per day, the page visited and the referring website (for example “google” or “facebook”). We do not set cookies, store IP addresses, or build visitor profiles. Known bots are filtered out.

Technical data

Like every website, our servers briefly process IP addresses and browser information to deliver pages, prevent abuse (for example, rate-limiting form spam) and keep the Service secure. This data is kept only in short-lived security logs.

• To create your account, build, host and publish your sites, and register and connect domains.
• To process payments through Chapa, send receipts, and keep the accounting records the law requires.
• To generate and edit site content with AI when you ask us to.
• To deliver contact-form messages to site owners, by dashboard and — if enabled — Telegram.
• To provide support, send important service notices, and protect Kefita and its users from fraud and abuse.
• To understand, in aggregate, how Kefita is used so we can improve it.

Under Proclamation No. 1321/2024 we rely on:

• Contract — processing needed to provide the Service you signed up for.
• Legal obligation — keeping payment and tax records, and responding to lawful requests from Ethiopian authorities.
• Legitimate interests — securing the Service, preventing fraud and improving our product, balanced against your rights.
• Consent — for optional features such as Telegram alerts. You can withdraw consent at any time.

We don’t sell personal data. We share it only with service providers that help us run Kefita, under contracts that require them to protect it:

• Google Firebase — accounts, database and file storage.
• Vercel — website hosting and delivery.
• Chapa — payment processing in ETB.
• Our domain registrar and the relevant registry — domain registration. Some registration data may appear in public WHOIS/RDAP records where registry rules require it.
• Anthropic — AI processing of the business details and instructions you send to the AI editor. It is not used to train their models.
• Telegram — delivering lead alerts, only if you switch them on.

We may also disclose data when required by Ethiopian law or a valid order of a competent authority, or to protect someone’s safety.

Some of our providers store or process data on servers outside Ethiopia. Where we transfer personal data abroad, we do so as permitted by Proclamation No. 1321/2024, using providers that maintain strong security and contractual safeguards for your data.

• Account and site data — while your account is open, and deleted within 30 days after you ask us to close it (backups roll off within 90 days).
• Payment records — as long as Ethiopian tax and commercial law requires.
• Contact-form messages — until the site owner deletes them, or their account is closed.
• Visit counts — aggregate daily totals only, kept while the site exists.

Subject to the Proclamation, you have the right to:

• be told how your data is used, and get a copy of it;
• have inaccurate data corrected, and have data erased when it is no longer needed;
• object to or restrict certain processing, and withdraw consent;
• receive your data in a portable format.

Email support@kefita.ai from your account address and we’ll respond within 30 days. If you’re not satisfied, you can complain to the Ethiopian Communications Authority, the supervisory authority under the Proclamation.

Visitors who sent a message through a customer’s site should contact that business first; we will help the business respond.

The Kefita app (kefita.ai) uses only the browser storage needed to keep you signed in and remember your draft while you build. Published customer sites have no Kefita cookies or advertising trackers, so you don’t need a cookie banner for Kefita’s analytics.

All traffic is encrypted with HTTPS. Access to data is limited to people who need it to run the Service, and our database rules prevent customers from seeing each other’s data. No system is perfectly secure; if a breach affecting your personal data occurs, we will notify you and the authority as the Proclamation requires.

Kefita is a tool for businesses and isn’t directed at children. We don’t knowingly collect personal data from anyone under 18.

We’ll post any update here with a new date, and tell you by email or in your dashboard about significant changes. See also our Terms of Service.