/\
/ \
/_/\_\ __
| | ____ __ __/ /___ ____
__|--|__ / __ \/ / / / / __ \/ __ \
/ \ / \ / /_/ / /_/ / / /_/ / / / /
/____\/____\/ .___/\__, /_/\____/_/ /_/
| | /_/ /____/
_|__|_
p r i v a c y
Privacy Policy
Last updated 21 September 2026
This policy explains what personal data Pylon Digital Limited ("pylon digital", "we") collects, why, and what your rights are. We are the data controller for the data described here, and we process it in line with Kenya's Data Protection Act, 2019. [We are registered with the Office of the Data Protection Commissioner, registration no. [number].]
1. What we collect
- Account data: name, email address, phone number, organisation name, and SSH public keys.
- Billing data: top-up and invoice history, M-Pesa phone number and transaction reference, and a KRA PIN if you ask for a tax invoice. Card details are handled by our payment processor; we never see or store full card numbers.
- Service data: which virtual machines, domains and repositories you have, their sizes and settings, and usage for billing.
- Technical logs: IP addresses and timestamps from logins, our control panel, API, git and web servers, and network flow records, kept for security and troubleshooting.
- Support messages: emails, WhatsApp messages and anything else you send us.
The content of your virtual machines and hosted sites is yours. We do not look at it, except where needed to keep the service secure, to fix a fault you ask us to fix, or to respond to a valid legal request.
2. Why we use it, and on what basis
- To provide the services you ordered, and take payment (performance of a contract).
- To secure our network and stop abuse (our legitimate interests).
- To meet tax, accounting and other legal duties (legal obligation).
- To send you service and incident notices (contract and legitimate interests). We send marketing only if you have agreed, and you can opt out at any time.
3. Who we share it with
We do not sell your data. We share only what is needed with:
- Payment providers (such as M-Pesa and our card processor), to process your payments.
- Our data centre and upstream network providers, where needed to run the service.
- Professional advisers and auditors, under confidentiality.
- Authorities, where the law requires it or a court orders it.
4. Where it is stored
Our systems are in Nairobi, Kenya. Some providers we use, such as email and card processing, may handle data outside Kenya. Where that happens we take steps to make sure your data is protected to the standard the Data Protection Act requires.
5. How long we keep it
- Account and service data: while your account is open, and up to 30 days after, then deleted.
- Billing and tax records: 7 years, as required for accounting purposes.
- Security and network logs: up to 12 months.
- Support messages: up to 3 years.
6. Security
We use access controls, encryption in transit, and regular updates to protect data. If a breach is likely to put your rights at risk, we will tell you, and the Data Protection Commissioner, within the time the law requires.
7. Your rights
Under the Data Protection Act you can ask us to:
- tell you what data we hold about you, and give you a copy;
- correct data that is wrong or out of date;
- delete your data, where we no longer need it;
- stop or restrict using it, or object to how we use it;
- give you your data in a portable format.
Email privacy@pylondigital.co.ke and we will respond within 30 days. We may need to check your identity first. If we can't resolve your concern, you can complain to the Office of the Data Protection Commissioner of Kenya.
8. Cookies
Our public pages do not use tracking or advertising cookies. Our control panel uses only the cookies needed to keep you signed in.
9. Children
Our services are not for people under 18, and we do not knowingly collect their data.
10. Changes and contact
We will post any changes here and, for material ones, tell you by email. Questions: privacy@pylondigital.co.ke, or write to [Legal company name], [registered address], Nairobi, Kenya.