NEXT COHORT AI Bootcamp — In-Person · October 28–30 · The Social House — Lavington, Nairobi Reserve a seat →

LEGAL

Privacy Policy

This policy explains what personal data This Is Digital Limited collects when you use thisisdigital.ai, why we collect it, who we share it with, how long we keep it and the rights you have under Kenya’s Data Protection Act 2019. Effective 7 September 2026.

Contents

Who we are and what this policy covers

This Is Digital Limited (“This Is Digital”, “we”, “us”) is a company registered in Kenya. Our office is on the ground floor of SNDBX, CMS Africa House, Chania Avenue, Kilimani, Nairobi. We are the data controller for the personal data described in this policy, which means we decide why and how it is processed.

This policy covers the website at thisisdigital.ai and the services you can reach from it: our newsletter, discovery-session bookings, enrolment in our training programmes, the affiliate programme and the Meta AI Academy Kenya Pitchathon. The Pitchathon has its own Pitchathon Privacy Notice that adds to this policy. Our PromptKit product runs on its own subdomain, promptkit.thisisdigital.ai, and has its own privacy notice, which applies when you use it.

Links on this site take you to services run by other organisations, including Paystack, Skool, WhatsApp, YouTube, LinkedIn, Facebook and Instagram. Their privacy policies apply once you leave our site.

What we collect and why

We collect personal data only when you give it to us or when it is needed to run the site. Here is what happens in each case.

When you sign up to our newsletter

We ask for your email address and, optionally, your first name. They go straight to Flodesk, the service that sends our emails, which asks you to confirm your subscription before you receive anything. We keep no subscriber list on this site; if a subscription fails, the address appears in our error log, which holds only the most recent 1,000 entries. Every email carries an unsubscribe link.

When you book a discovery session

We collect your name, email address, the option you choose to describe your situation and the time slot you pick. We store this on our site and email it to our team so we can send you a meeting invitation and prepare for the conversation.

When you enrol in a programme

Payment is taken by Paystack on Paystack’s own checkout pages. You give your name, email address and card or mobile-money details to Paystack, not to us, and we never see your full card number. Paystack then gives us a record of the transaction: your name, email address, the amount and currency, the payment method and a reference number. We use it to confirm your place, send joining details, issue receipts and keep the financial records the law requires.

When you arrive through an affiliate link

Some people find us through affiliate partners. If you arrive through one of their links we set a small cookie so that the partner is credited if you later enrol (see Cookies). We also log the click with the landing page, the referring page, and one-way hashed versions of your IP address and browser identifier. We cannot turn those hashes back into your details; we use them only to detect abuse of the programme.

When you join the affiliate programme

Affiliates give us their name, email address, phone number and bank details. We pass the bank details to Paystack so that commissions can be paid, and we keep only the last four digits of the account number. We record each referred sale, including the customer’s name and email address, so that commissions can be calculated and audited. We do not give affiliates their referred customers’ names or contact details.

When you apply to the Pitchathon

The application form collects contact details, information about your team and your business, and supporting documents. The Pitchathon Privacy Notice describes this in full.

When you contact us

If you email, call or message us on WhatsApp we keep the conversation for as long as we need it to answer you and to keep a record of our dealings. WhatsApp is run by Meta and handles your messages under its own privacy policy.

When you visit the site

Like every website, ours receives technical data from your browser: your IP address, browser and device type, the pages you view and the page that referred you. Cloudflare, which protects and speeds up the site, sees this data at the edge of the network and runs a small analytics script on our pages that measures page speed and visits without using cookies. Google Analytics gives us aggregated statistics about how the site is used (see Cookies). We do not use this data to identify you.

Staff and reviewer accounts

The site does not offer public registration. Only our staff and appointed reviewers have accounts, and their use of the site is logged.

Section 30 of the Data Protection Act 2019 requires us to have a lawful reason for each use of your personal data. Ours are:

  • Your consent when you subscribe to the newsletter or apply to the Pitchathon. You can withdraw consent at any time; doing so does not affect processing that already took place.
  • Performing a contract with you when you book a session, enrol in a programme or join the affiliate programme.
  • Our legitimate interests in running a secure website, preventing fraud and spam, understanding how the site is used and promoting our services, including the analytics and anti-spam cookies described below, provided those interests do not override your rights.
  • A legal obligation, for example keeping financial and tax records.

Cookies and similar technologies

Cookies are small text files a website stores in your browser. We keep ours to a minimum. This is every cookie and similar store our site uses.

tid_aff
Set by us only when you arrive through an affiliate link. It holds the affiliate’s code so the partner can be credited if you enrol. It lasts 90 days and is sent only over HTTPS. Our analytics script reads it so that an enrolment can be attributed to the right partner in Google Analytics; we do not share it with anyone else.
_ga and _ga_*
Set by Google Analytics to tell returning visitors from new ones and to measure how pages are used. They last up to two years. We have not enabled Google Signals, so this data is not linked to your Google account for advertising.
_GRECAPTCHA
Set by Google reCAPTCHA, which protects our forms from bots. The reCAPTCHA script loads when you reach or start filling in a form, and the cookie lasts about six months.
Cloudflare cookies (for example __cf_bm)
Short-lived cookies Cloudflare uses to tell people from automated traffic. They contain no personal information and expire within a day.
Session cookie
Set when a member of staff or a reviewer signs in, and when you start a Pitchathon application so that your draft can be found again. It is cleared when you sign out or the session expires.
Browser session storage
After you submit a Pitchathon application we store its reference number in your browser’s session storage so the confirmation is counted once. It is cleared when you close the tab.

Videos on the site are embedded from youtube-nocookie.com and load only when you press play. YouTube may then set its own cookies under Google’s privacy policy.

You can block or delete cookies in your browser settings; the site will still work, though the affiliate cookie will not be able to credit a partner. You can also install Google’s browser add-on to opt out of Google Analytics.

Who we share data with

We never sell personal data. We share it only with the organisations that help us run the site and our programmes, each of which may use it solely to provide its service to us:

  • Paystack takes payments and pays affiliate commissions.
  • Flodesk stores newsletter subscribers and sends our emails.
  • SMTP2GO delivers the transactional emails the site sends, such as booking and application confirmations.
  • DigitalOcean hosts the site, its database and uploaded documents.
  • Cloudflare provides the content delivery network, DNS and security layer in front of the site.
  • Google provides Google Analytics, reCAPTCHA and YouTube.
  • Meta is our partner for the Meta AI Academy Kenya programme and receives Pitchathon applications as described in the Pitchathon Privacy Notice.

We may also disclose personal data when the law requires it, to protect our rights or safety, or as part of a sale or reorganisation of our business, in which case this policy would continue to apply.

Where your data is stored and international transfers

Our web server and its backups are hosted by DigitalOcean in Frankfurt, Germany. Some of the providers listed above process data in the United States or elsewhere outside Kenya. Where personal data leaves Kenya we rely on the safeguards in sections 48 and 49 of the Data Protection Act 2019: the transfer is necessary to perform our contract with you or takes place with your consent, and each provider is bound by contractual terms that require appropriate protection of the data.

How long we keep your data

We keep personal data only for as long as it is needed for the purpose we collected it, and then delete or anonymise it. Our current periods are:

Newsletter subscription
Until you unsubscribe, after which Flodesk removes you from our list.
Discovery-session bookings
Twelve months after the session so that we can follow up, then deleted.
Enrolment and payment records
At least five years after the transaction, as Kenyan tax law requires for financial records.
Affiliate accounts and referred-sale records
For the duration of the affiliate relationship and then for five years as financial records.
Affiliate click logs
About thirteen months (400 days), then removed automatically by a scheduled task.
Pitchathon applications
Twelve months after pitch day; see the Pitchathon Privacy Notice.
Google Analytics data
Fourteen months, the longest period Google offers, which we have set.
Error log
The most recent 1,000 entries only; older entries are overwritten.
Backups
Nightly backups of the database and uploaded documents are kept for seven days, and weekly snapshots of the whole server for about a month, so deleted data disappears from every backup within five weeks.

How we protect your data

All traffic to the site is encrypted with HTTPS and filtered by Cloudflare’s firewall. Uploaded documents are stored outside the public web root and can be opened only by signed-in reviewers. Access to personal data is limited to the people who need it for their role, and the site keeps a log of changes to application records. IP addresses in our affiliate logs are hashed so they cannot be read back. Backups are access-restricted and rotated every seven days. No system is perfectly secure, so if we learn of a breach that puts your rights at risk we will notify the Office of the Data Protection Commissioner within 72 hours, as section 43 of the Act requires, and, where required, you.

Your rights

Under section 26 of the Data Protection Act 2019 you have the right to:

  • be told how your personal data is used, which is the purpose of this policy;
  • access the personal data we hold about you;
  • have inaccurate or incomplete data corrected;
  • have your data deleted where we no longer need it or you withdraw consent;
  • object to processing based on our legitimate interests, and to direct marketing at any time;
  • receive the data you gave us in a portable format;
  • withdraw consent where consent is our basis for processing.

To exercise any of these rights, email ai@thisisdigital.ai. We may ask you to confirm your identity before we act. We do not charge for requests unless they are clearly unfounded or excessive. If you are not satisfied with our response you may complain to the Office of the Data Protection Commissioner at odpc.go.ke.

Children

Our programmes and services are for adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

Changes to this policy

We will update this policy when our services or the law change and will show the effective date at the top. Significant changes will be announced on the site. This version took effect on 7 September 2026.

How to contact us

This Is Digital Limited
Ground floor, SNDBX, CMS Africa House
Chania Avenue, Kilimani, Nairobi, Kenya
Email: ai@thisisdigital.ai
Phone: +254 722 268 274