Privacy Policy

Effective August 22, 2026. Kauli is a product of Forge Media Services, operated by Godfrey Njoroge.

1. What we collect

  • Account info: your email, password (handled entirely by our authentication provider, Supabase - we never see or store your raw password), display name, and an optional profile photo.
  • What you submit: the audio/video files or YouTube links you upload, plus the transcripts, translations, subtitles and dubbed audio/video we generate from them.
  • Payment metadata: which provider you paid with, the amount, and a transaction reference. Card numbers and M-Pesa PINs go directly to Paystack or Safaricom - we never see or store them.
  • Technical logs: IP address and browser user-agent on file uploads (part of our malware/abuse-prevention audit trail) and on login attempts (to rate-limit brute-force attempts).
  • Usage data: your order history, minutes used, and plan.

2. How we use it

To process your orders, bill you correctly, keep the service secure (malware scanning, abuse rate limiting), and reach you about an order or your account. We don't sell your data, and we don't use your uploaded content for anything beyond delivering the order you submitted it for.

3. Who else sees it

We use a small number of third-party services to actually run Kauli - each only sees what it needs to do its job:

  • Supabase - authentication (your login credentials).
  • Paystack and Safaricom M-Pesa - payment processing. They see your payment details directly; we only see the result (paid/not paid) and a reference number.
  • Anthropic (Claude) and Translated (Lara Translate) - translation providers, used depending on which tier and language pair your order needs. They process the transcript text being translated, per their own privacy terms.
  • Transkriptor - our primary transcription provider for some orders. It processes the actual audio being transcribed, per its own privacy terms; if it's unavailable, we fall back to our own local transcription model, which never leaves our own infrastructure.
  • Brevo - sends transactional email on our behalf (receipts, order-status updates, voice-actor assignment notices). It sees the recipient's email address and the message content.
  • Hetzner - hosts the server Kauli actually runs on. Cloudflare sits in front of it (routing traffic, DNS, our website analytics) and also stores encrypted backups of our database and delivered files. See section 8 for what this means for where your data physically sits.
  • exchangerate-api.com - live USD→KES conversion for M-Pesa checkout amounts. No personal data is sent, just a currency-conversion request.

We don't share your data with anyone else, and we don't run ads or ad-tracking on this site.

4. Cookies

Kauli sets exactly one cookie: a signed, time-limited session cookie that keeps you logged in. It's strictly necessary for the site to function (there's no way to use an account-based service like this without one) - it doesn't track you across other sites, and we don't use it for analytics or advertising.

We use Cloudflare Web Analytics to see aggregate traffic to this site (roughly how many people visit, which pages, which country). It's cookieless by design - Cloudflare's own description is that it doesn't use any client-side state (no cookies, no local storage, no fingerprinting) and doesn't track you across other sites. We don't run Google Analytics, Meta Pixel, or any other cookie-based analytics or advertising script on this site. If that ever changes, this section will say so and we'll ask first where the law requires it.

5. Security

Every upload is checked against its real file signature (not just trusted by its filename), scanned for malware, and validated as genuine audio/video before it's processed. Login sessions use signed, time-limited cookies. Payments never touch our servers directly - they go straight to Paystack or Safaricom.

6. How long we keep it

Honestly: uploaded files and generated deliverables are currently kept on our servers indefinitely - we don't yet have automatic deletion after a fixed period. If you'd like your files or account data deleted, use the "Your data" section in Settings, or contact us and we'll do it by hand. This is an area we intend to improve as the service grows; this policy will be updated when automatic retention limits exist.

7. Your rights

Wherever you're located, you can ask us for a copy of the data we hold on your account, ask us to correct it, or ask us to delete it, at any time. If you're in the EU/UK, the GDPR calls these the rights of access, rectification, erasure, restriction and portability; if you're in Kenya, the Data Protection Act, 2019 gives you the same substantive rights. We apply the same practice to every request regardless of where it comes from, rather than offering a narrower version to people outside any one jurisdiction.

To exercise any of these: sign in and use the "Your data" section under Settings to request deletion directly, or email [email protected] for anything else (a copy of your data, a correction, a question). There's no self-service export button yet, so a data-copy request is handled by us by hand; deletion requests go through Settings and are reviewed and actioned by us.

8. International visitors and data transfers

Kauli is operated by Forge Media Services, a Kenyan business, and Kenyan law (the Data Protection Act, 2019) governs how we handle your data - but the server itself runs on infrastructure in Germany (Hetzner), with encrypted backups stored via Cloudflare's network. This is a real, deliberate choice for reliability and cost, not an oversight: wherever you're contacting us from - Kenya, the EU, UK, or elsewhere - your data is transferred to and processed in Germany, and backed up across whatever locations Cloudflare's storage network uses (it doesn't guarantee a single country for this). It's also processed in whatever countries our other third-party providers (section 3) operate their own infrastructure in. By using Kauli, you understand and accept that transfer. If you're an EU/UK-based organization that needs a formal data processing agreement or transfer safeguard in place before sending us content, contact us and we'll work through what that looks like - we haven't needed to build one yet since it hasn't come up, not because we'd refuse.

9. Children

Kauli isn't directed at children, and we don't knowingly collect data from anyone under 18.

10. Changes to this policy

We may update this policy as the service changes. Material changes will be posted here with a new effective date.

11. Contact

Questions about this policy, or a data request: [email protected] or 0712 531 841.