Legal & Trust Center

1. Who We Are

Noticus is a demand letter as a service platform operated in the Republic of Kenya. We work in partnership with a registered Kenyan advocate licensed by the Law Society of Kenya, through whom all demand letters are formally issued.

For the purposes of this policy, Noticus is the data controller responsible for your personal information. To contact us on privacy matters write to: privacy@noticus.co.ke

2. What Information We Collect

Information you provide directly:

• Your full name, email address, and phone number
• The nature and details of your dispute
• Financial details including amounts owed and payment history
• The name, address, and contact details of the person or business you are making a demand against
• Documents you choose to upload — contracts, agreements, invoices, and correspondence
• Your preferred delivery method and urgency level

Information collected automatically:

• IP address and approximate location
• Browser type and operating system
• Pages visited and time spent on the platform
• Session identifiers and cookies

Payment information:

We do not store your card details or M-Pesa PIN. All payment processing is handled by Flutterwave, a PCI-DSS compliant payment provider. We only receive confirmation that payment was successful and the transaction reference.

3. Information About Third Parties

When you use Noticus you provide us with personal information about another person — the recipient of your demand letter. This person has not interacted with our platform directly.

By submitting a demand letter request you confirm that:

• You have a genuine and lawful dispute with the named recipient
• The information you provide about them is accurate to the best of your knowledge
• You have lawful grounds to share their personal information for the purpose of formal legal correspondence
• You are not using this platform to harass, threaten, or make false demands against any person

We use recipient information solely to address and deliver the demand letter. We do not use it for any other purpose, we do not contact recipients for any reason other than delivery, and we do not retain it beyond what is necessary to complete the service.

Recipients who wish to understand what information Noticus holds about them may contact us at privacy@noticus.co.ke

4. How We Use Your Information

We use your information to:

• Draft your demand letter using automated processing assisted by a registered advocate
• Apply the firm's official letterhead, stamp, and signature to your letter
• Deliver the letter to the named recipient by your chosen method
• Process your payment and issue a receipt
• Create and manage your Noticus account
• Send you transactional communications — order confirmation, delivery confirmation, and follow-up notifications
• Detect and prevent fraud and abuse of the platform
• Comply with our legal and regulatory obligations under Kenyan law
• Improve the platform based on aggregated and anonymised usage patterns

We do not use your information for advertising. We do not sell your information to any third party. We do not share your dispute details with anyone other than the advocate who signs your letter and the service providers necessary to deliver it.

5. Automated Processing and AI

Noticus uses artificial intelligence to assist in drafting your demand letter. When you submit your dispute details and any uploaded documents, this information is processed by an AI system that generates a draft letter based on your inputs and applicable Kenyan law.

You have the right to know this. By using Noticus you consent to your dispute details being processed by an AI drafting system.

Important protections:

• Every letter generated by the AI is formally reviewed and signed by a registered Kenyan advocate before it is issued
• No letter is sent without human advocate involvement
• The AI draft is a starting point — the advocate's signature gives it legal weight
• You have the right to review your letter before it is served and to request changes
• No decision with legal effect on you is made by automated means alone

This processing is disclosed in compliance with the Kenya Data Protection Act 2019.

6. Uploaded Documents

When you upload a contract, agreement, invoice, or other document to support your letter:

• The document is processed in memory to extract relevant clauses and details
• It is transmitted to our AI processing provider (Anthropic) for this purpose
• It is not permanently stored on our servers after your letter has been generated
• It is not shared with any party other than those necessary to draft your letter
• You should only upload documents that relate directly to your dispute
• Do not upload documents containing sensitive personal data of persons not party to your dispute

7. Third Party Service Providers

We share data with the following trusted providers who help us deliver the service. Each is bound by a data processing agreement and their own privacy commitments:

• Supabase — database and secure file storage. Servers located in West EU (Ireland). supabase.com/privacy
• Anthropic— AI processing for letter drafting. Your dispute details and uploaded documents are processed by Anthropic's systems. anthropic.com/privacy
• Flutterwave — payment processing for M-Pesa and card payments. flutterwave.com/privacy
• Resend — transactional email delivery for order confirmations and notifications. resend.com/privacy
• Vercel — platform hosting and infrastructure. vercel.com/legal/privacy-policy

No other parties receive your personal data without your explicit consent.

8. How Long We Keep Your Information

• Account and profile data — Duration of account plus 7 years after closure
• Letter content and dispute details — 7 years from date of issue
• Uploaded documents — Deleted after letter generation — not stored
• Payment records — 7 years for tax and audit compliance
• Recipient contact details — Deleted after delivery is confirmed
• Usage and analytics data — 12 months

The 7-year retention periods align with standard legal document retention requirements in Kenya and the requirements of the Income Tax Act.

9. Your Rights Under the Kenya Data Protection Act 2019

The Kenya Data Protection Act 2019 gives you the following rights over your personal information:

• Right of access — you can request a copy of all personal data we hold about you at any time.
• Right to rectification — if any information we hold is inaccurate or incomplete you can ask us to correct it.
• Right to erasure — you can ask us to delete your personal data. We will do so unless we are required to retain it by law — for example financial records which must be kept for 7 years.
• Right to data portability — you can request your data in a structured, machine-readable format.
• Right to object — you can object to processing based on our legitimate interests. We will stop unless we can demonstrate compelling grounds.
• Right to restriction — you can ask us to limit how we use your data while a complaint or objection is being resolved.
• Right to withdraw consent — where we rely on consent as the basis for processing you can withdraw it at any time. This does not affect the lawfulness of processing before withdrawal.

To exercise any of these rights email privacy@noticus.co.ke with the subject line "Data Rights Request." We will respond within 21 days as required by the Act.

10. Data Security

We take the security of your information seriously:

• All data is transmitted over encrypted HTTPS connections
• Your database records are protected by Row Level Security — you can only access your own data
• API credentials and keys are stored as server-side environment variables and never exposed to the browser
• Payment data is never stored on Noticus servers — Flutterwave handles all card and M-Pesa data
• Access to production systems is restricted to authorised personnel only
• We conduct regular reviews of our security practices

No system is completely immune to security incidents. In the event of a breach that affects your personal data we will notify you and the Office of the Data Protection Commissioner within the timeframes required by law.

11. Cookies

Strictly necessary cookies — these are required for the platform to function. They maintain your session as you move through the intake form and dashboard. You cannot disable these and continue to use the platform.

Analytics cookies — we use anonymised analytics to understand how users navigate the platform and where we can improve. These do not identify you personally.

We do not use advertising cookies. We do not work with any advertising networks. We do not track you across other websites.

12. Children

Noticus is a legal services platform intended for adults aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe a minor has submitted information through our platform please contact us immediately at privacy@noticus.co.ke and we will delete the data promptly.

13. Cross-Border Data Transfers

Your data is processed and stored on servers located in the European Union (Ireland) through our providers Supabase and Vercel. By using Noticus you acknowledge and consent to this transfer.

We ensure appropriate safeguards are in place for all cross-border transfers in accordance with Part V of the Kenya Data Protection Act 2019 and the regulations made thereunder.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal obligations.

For material changes we will notify you by email at least 14 days before the change takes effect and display a prominent notice on the platform. Your continued use of Noticus after the effective date of a material change constitutes your acceptance of the updated policy.

The date at the top of this page always reflects when the policy was last updated. Previous versions are available on request.

15. Complaints

If you are unhappy with how we have handled your personal information you have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya (ODPC).

We would always prefer the opportunity to address your concerns directly before you escalate to the ODPC. Please contact us first at privacy@noticus.co.ke