Effective 26 September 2026
1. Who is responsible for your data
JengaFlow Pro provides construction project information services. For public website visits, enquiries, account administration and platform security, JengaFlow determines why and how relevant personal data is used and acts as a data controller.
For information uploaded to a customer project, the customer organization normally determines the purpose of processing and acts as controller. JengaFlow processes that project data on its instructions as a data processor.
| Context | Typical controller | JengaFlow role |
|---|---|---|
| Website enquiry or account administration | JengaFlow | Controller |
| Customer project reports, labour records and evidence | Customer organization | Processor |
| Platform security and abuse prevention | JengaFlow | Controller |
2. Personal data we may handle
- Names, work contact information, organization, role and account identifiers.
- Project assignments, permissions, approvals and activity history.
- Daily reports, labour records, visitor records, safety information, meeting actions and commercial records submitted by authorized users.
- WhatsApp identifiers, message content, attachments and sender information from explicitly connected project groups or authorized direct messages.
- Site photographs, which may incidentally include people, vehicle registrations, location context or safety observations.
- Public-site visit events, a random browser visitor value, device class, referring host and whether that browser was previously used for a JengaFlow account. Public analytics does not record the account identity or raw IP address.
- Device, access, error and security logs required to operate and protect the service.
- Support correspondence and information provided through enquiries.
Customers are responsible for ensuring they have authority to submit workforce, subcontractor, visitor and project-participant information.
3. Why we use personal data
We use data to provide project workspaces, authenticate users, apply role and project access, organize submitted records, generate reports, support approvals, respond to support requests, maintain service reliability and investigate misuse.
Depending on the context, processing is based on performance of a contract, legitimate operational and security interests, compliance with legal obligations, consent where required, or the documented instructions of a customer acting as controller.
5. Retention and deletion
Project-data retention is determined by the customer agreement, project obligations and documented customer instructions. Account, support and security information is retained only for the period reasonably required for service delivery, legal obligations, dispute handling and security investigation.
Some records have fixed periods set by the service itself:
- Incoming WhatsApp messages waiting to be processed: deleted automatically after 14 days.
- Source messages kept with a report built from WhatsApp: up to the last ten messages per report, each up to 4,000 characters, kept for as long as the report.
- Logs of AI-assisted document and image extraction: deleted after 90 days.
- Service health and monitoring logs: deleted after 30 days.
- Sample messages that an administrator deliberately sends to teach the bot a report format: up to 30 samples of 500 characters each, replaced as new samples are added.
Deletion from active systems may not immediately remove information from encrypted backups, which are replaced according to backup cycles. Customers should define project retention requirements before uploading statutory or long-term construction records.
6. Protecting information
JengaFlow uses authenticated access, role and project authorization, controlled WhatsApp routing, audit-oriented records and operational monitoring. No internet service can promise absolute security. Verified security practices and reporting information are described in the Trust Center.
7. Your data-protection rights
Subject to applicable law, you may request information about processing, access to your personal data, correction, deletion, restriction or objection. You may also raise concerns about solely automated decisions that produce legal or similarly significant effects.
If your data belongs to a customer project, contact that organization first because it normally controls the project record. These rights are set out in Kenya’s Data Protection Act, 2019. You may also complain to Kenya’s Office of the Data Protection Commissioner through odpc.go.ke.
8. Contact and changes
We may update this notice when the service, providers or legal requirements change. Material revisions will carry a new effective date.