Privacy, plainly.

We only keep what you hand us on purpose — and we can account for every byte of it without reaching for a lawyer.

Maarifa is a small design and build studio working across Nairobi and London. When this policy says “we”, it means the studio — the people responsible for the data this site collects. The fastest route to anything about yours is hello@maarifa.studio.

What we collect is only ever what you type on purpose. Send an enquiry and we get your name, your email, your WhatsApp number if you add one, and the project details you describe — plus a note of which page sent you here, so we can reply with context. Ask the website check-up to keep an eye on a site and we store the email and web address you gave us, and nothing else. There are no advertising or analytics cookies on this site, and we don't track you around the web.

Why we hold it is short: to reply to you, and — if we end up working together — to do the work; for a monthly note, if you asked us to watch a site. We don't sell it, we don't share it for marketing, and we don't build a profile of you. The lawful basis is your consent, or our legitimate interest in answering an enquiry you started yourself.

Where it lives is deliberately small. Cloudflare hosts the site and stores form submissions on servers in Western Europe; Resend delivers the email that tells us you got in touch; UKBox, a UK provider, hosts the inboxes where your message lands. Each only ever sees what it needs to do its part. For visitors in Kenya that means a cross-border transfer, which we handle under the safeguards Kenya's Data Protection Act, 2019 expects — the same care we'd want for our own.

We keep it only as long as it earns its place. An enquiry that goes nowhere we clear within a year or so; if we work together, we hold what the project and our accounts need — financial records have to be kept for up to six years — then remove the rest. A site-watch signup lasts only until you unsubscribe, one click in every email, and the half-finished contact draft in your browser is gone the moment you send. If we ever hand you a password for something we set up — a new mailbox, say — it crosses as a scrambled blob we have no key for, opens exactly once, and deletes itself on the way out; anything you never collected is cleared the following night.

Your rights are simple, and we won't make you fight for them. Under Kenya's Data Protection Act, 2019 — and UK and EU law for those it covers — you can ask us to show you what we hold, correct it, delete it, stop using it, or hand you a copy to take elsewhere, and we'll just do it. No forms, no hoops: email hello@maarifa.studio. If you're ever unhappy with how we've handled it, you can complain to the Office of the Data Protection Commissioner in Nairobi, or the Information Commissioner's Office in the UK.

If something ever goes wrong, we won't go quiet on you. What's here is hardly a treasure trove — a few names, emails and project notes — but if a breach ever put your data at real risk, we'd tell you plainly and notify the Office of the Data Protection Commissioner within the 72 hours the law expects, rather than hope you didn't notice.

It isn't a site for children. The studio's work is meant for the people who commission it, not under-18s, and we don't knowingly collect anything from a child. If you think a child has sent us something through the site, email us and it's gone.

When any of this changes, the date at the top changes with it. Small tidies we'll just make; anything that actually affects you — a new tool that touches your data, a change in what we keep — we'll spell out here in plain terms rather than slip it past you.