Last updated: [CONTENT-TODO: set to the date this policy is published live]
Brave Impact (“Brave Impact,” “we,” “us,” or “our”) operates this website (the “Site”) to share our work in Christ-centered leadership and youth empowerment, and to receive gifts, prayer requests, volunteer sign-ups, and event registrations from the people who support that work. This policy explains what information we collect through the Site, why, and what choices you have.
This policy is written to describe what the Site's systems actually do not generic template language. [CONTENT-TODO: this document should be reviewed by a Kenyan advocate or the client's legal counsel before publication it is drafted, not legally finalized.]
1. Who we are
Brave Impact is a Christ-centered organization based in Kenya, working through the Brave Impact Leadership Academy (BILA) and the Brave Impact Foundation.
- Legal / registered entity name: [CONTENT-TODO: registration type: NGO / Trust / Society / CBO, and registration number, not yet supplied]
- Registered / physical address: [CONTENT-TODO: not yet supplied]
- Contact email for privacy questions: [CONTENT-TODO: e.g. privacy@<domain>]
- Contact phone: [CONTENT-TODO: not yet supplied]
We are the “data controller” for the personal data described below under Kenya's Data Protection Act, 2019(“the DPA”), which is overseen by the Office of the Data Protection Commissioner (ODPC, odpc.go.ke). [CONTENT-TODO: confirm whether Brave Impact is required to register as a data controller with the ODPC registration is mandatory for controllers/processors above certain thresholds (e.g. processing sensitive personal data, or the data of 10,000+ people in a year) and insert the registration number here if so.]
2. What we collect, and why
We only collect what a given form or feature needs to do its job. Nothing below is sold, and nothing is used for purposes other than the ones stated.
2.1 When you give
If you make a gift through the Donate page, we collect: the amount, your phone number (required, to send the M-Pesa payment prompt), and optionally your name and email (if you want a receipt). We also record the transaction identifiers and result returned by Safaricom's M-Pesa system (a receipt number once payment succeeds, or a result code and description if it doesn't) so we can confirm your gift was received and reconcile our records.
Why: to process your gift, send a confirmation, and keep accurate financial records (gifts are grouped by phone number internally so we can recognize repeat donors and thank them appropriately).
Who else sees it: Safaricom processes the M-Pesa transaction directly with you (you enter your PIN on your own phone we never see or store it). We do not process card or other payment details; M-Pesa is the only payment method this Site supports.
2.2 When you volunteer, register for an event, ask us to pray, or reach out
Depending on the form, we collect some combination of: your name, phone number, email (optional on most forms), a message or request, and form-specific details (e.g. which area you'd like to volunteer in, how many guests you're bringing to an event, or the organization you represent if you're inquiring about a partnership).
Why:to respond to you, plan events and volunteer schedules, and for prayer requests to pray for what you've shared. If you mark a prayer request “private,” it is only ever seen by our team, never published.
2.3 Automatically, when you browse
If analytics is enabled on the Site, Google Analytics collects standard usage data (pages viewed, approximate location derived from IP address, device/browser type) via cookies. This only runs when the Site has been configured with a Google Analytics ID; see Cookies below for detail. If you sign in to the admin area (our own team only this section does not apply to visitors), a session cookie keeps you signed in; this cookie is never set for ordinary visitors.
2.4 What we do not collect
We don't ask for your ID number, date of birth, payment card details, or M-Pesa PIN. We don't build advertising profiles, and we don't sell or rent personal data to anyone.
3. Our legal basis for processing (Kenya DPA, 2019)
- Consent every form on this Site is something you choose to submit. Submitting it is your consent to the processing described here for that purpose.
- Contract / legitimate interest processing a gift (initiating the M-Pesa request, confirming payment) is necessary to actually deliver what you asked for.
- Legal obligation we keep financial records of gifts received as required for our own accounting [CONTENT-TODO: and, if applicable, tax-exemption compliance confirm Brave Impact's tax status; this policy makes no claim about tax-deductibility of gifts unless and until that status is confirmed].
4. Where your data is stored
Data submitted through this Site is stored with Supabase (a Postgres database provider) [CONTENT-TODO: confirm final project region the build plan specifies Frankfurt, EU, as the lowest-latency Supabase region to Kenya at time of writing]. Application logic runs on Render (api) and Vercel (web); transactional emails, when enabled, are sent via Resend. Each of these providers processes data on our behalf under their own security and data-processing terms; none of them independently use your data for their own purposes.
Access controls: donation records, volunteer sign-ups, event registrations, contact messages, partner inquiries, and prayer requests are restricted at the database level (row-level security) to our authenticated team members the public Site cannot read this data back, only submit it.
5. How long we keep it
[CONTENT-TODO: a specific retention schedule has not yet been set by the client the default position below is a reasonable placeholder, not a final policy.] We keep information for as long as needed for the purpose it was collected, or as required by law (for example, financial records related to gifts may need to be kept longer for accounting purposes). You can ask us to delete your information at any time see Section 6.
6. Your rights
Under the Data Protection Act, 2019, you have the right to:
- Be informed how your data is used (this policy);
- Access the personal data we hold about you;
- Request correction of inaccurate or outdated data;
- Request deletion of your data, subject to any legal reason we may need to keep it (e.g. financial records);
- Object to or restrict certain processing;
- Lodge a complaint with the Office of the Data Protection Commissioner (odpc.go.ke) if you believe your data has been mishandled.
To exercise any of these rights, contact us at [CONTENT-TODO: privacy contact email/phone]. We will respond within a reasonable time.
7. Children
Our youth programs may involve minors, but this Site's public forms are intended to be submitted by an adult (a parent/guardian, volunteer, donor, or program partner). We do not knowingly collect personal data directly from children through this Site. [CONTENT-TODO: confirm whether any program-related form is intended to be filled in by a minor directly none currently are, per the build plan's form list.]
8. Changes to this policy
We may update this policy as the Site or our practices change. The “Last updated” date at the top will always reflect the most recent version.
9. Cookies
This Site keeps cookie use to a minimum there is no advertising, and no cross-site tracking.
| Cookie | Set when | Purpose | Lifespan |
|---|---|---|---|
| Google Analytics (_ga, _ga_*) | Only if the Site has been configured with a Google Analytics measurement ID | Understand how visitors use the Site in aggregate (pages viewed, approximate location, device type) so we can improve it | Up to 2 years (set by Google) |
| Supabase session cookie | Only when a Brave Impact team member signs in to the admin area | Keeps the signed-in team member's session active | Session-length, per Supabase Auth defaults |
If you are an ordinary visitor to the public Site, the second cookie is never set for you it's only created on successful admin sign-in, and only our own team signs in.
Most browsers let you block or delete cookies in their settings. Blocking analytics cookies won't affect your ability to browse the Site, give, or submit a form. Google Analytics offers a [CONTENT-TODO: link to tools.google.com/dlpage/gaoptout if the client wants this referenced explicitly] browser opt-out add-on if you'd like to opt out of Analytics across all sites, not just this one.
We don't use cookies for advertising, retargeting, or selling data to third parties. We don't run a cross-site tracking pixel of any kind.
[CONTENT-TODO: this notice assumes Kenya's Data Protection Act, 2019 does not require an upfront cookie-consent banner (unlike EU/UK ePrivacy rules) confirm with counsel if the Site expects meaningful traffic from the EU/UK, since analytics cookies there generally do require prior consent, not just notice.]
10. Contact
Questions about this policy or your data: [CONTENT-TODO: privacy contact email/phone/address].
See also our Terms of Use.