Privacy Policy

1. Introduction

A.D.O.P.T. is an AI Value Management platform designed to help organizations identify, evaluate, prioritize, manage and measure AI opportunities.

This Privacy Policy explains how Neurora Innovations (“we,” “us” or “our”) collects, uses, stores, shares and otherwise processes personal data when individuals visit our website, contact us, create an account or use A.D.O.P.T.

We aim to process personal data lawfully, fairly and transparently, limit collection to legitimate purposes, and apply appropriate safeguards.

This Policy should be read alongside our Terms of Service and, where applicable, our Data Processing Agreement.

2. Who we are

A.D.O.P.T. is operated by:

• Legal entity: Neurora Innovations
• Location: Nairobi, Kenya
• Website: adoptafrica.neurorainnovations.com
• Privacy contact: privacy@neurorainnovations.com

For privacy purposes, our role depends on the processing activity. We may act as a data controller where we determine why and how personal data is processed, including for website enquiries, account administration and our own business operations.

Where an organizational customer determines the purposes of processing and we process personal data on its behalf, our role and obligations will be defined by the applicable agreement and law.

3. Information we collect

3.1 Website visitors and enquiries

When you contact us or request a demonstration, we may collect:

• Name.
• Work email address.
• Organization name.
• Professional role.
• Information about your business challenge.
• Optional message or enquiry details.
• Information you voluntarily provide during communications.

We may also process limited technical information needed to operate, secure and troubleshoot the website, depending on the technologies deployed.

3.2 Account and organization information

When the platform is available to registered users, it may process:

• Account identity and contact information.
• Organization name and profile.
• Membership and role information.
• Invitations and invitation status.
• Account, access and security events.
• Preferences and relevant account settings.

The platform's organization roles are Owner, Administrator, Manager and Member. Permissions are intended to apply within the relevant organization.

3.3 Business Environment information

A.D.O.P.T. is designed to receive business information used to understand organizational needs and assess technology opportunities. Depending on the features used, this may include:

• Business problems and operational challenges.
• Organizational objectives and priorities.
• Descriptions of existing workflows and systems.
• Technology constraints and requirements.
• Potential AI use cases.
• Information supplied during conversational problem intake.
• Information used to generate diagnoses, technology options, recommendations, prioritized action plans and Technology Opportunity & Solution Reports.

Some of this information may be commercially confidential or proprietary even when it is not personal data.

Users should not submit passwords, access keys, unnecessary personal information, or highly sensitive information unless the relevant feature expressly supports it and appropriate safeguards have been established.

3.4 Platform activity and audit records

Depending on the features deployed, the platform may record events needed for security, accountability and troubleshooting, including:

• Authentication and account events.
• Membership and role changes.
• Invitations and access changes.
• Sensitive administrative actions.
• Changes to relevant records.
• Security events and diagnostic information.

Audit records may be retained after a user is removed or suspended where necessary for security, accountability, dispute resolution or legal obligations.

3.5 Information from third-party services

If we integrate external authentication, hosting, analytics, AI or other services, those providers may process information needed to deliver their services. The applicable providers, purposes and data flows will be documented once confirmed.

We do not claim to use any particular third-party service unless it is actually integrated.

4. How we use information

We may process information for the following purposes:

• Providing and operating the website and platform.
• Creating and administering user accounts and organizations.
• Enforcing organization-level permissions.
• Processing submitted business problems and generating requested outputs.
• Producing and maintaining opportunity assessments, recommendations and reports.
• Managing invitations and membership.
• Maintaining security, auditability and service reliability.
• Responding to enquiries and providing customer support.
• Diagnosing errors and improving product performance.
• Meeting applicable legal obligations.
• Protecting legitimate business interests, where lawful and appropriate.

Where required by law, we will identify the applicable legal basis for processing and obtain consent when consent is the appropriate basis.

We will not describe processing as necessary for service delivery if it is actually optional marketing or analytics processing.

5. AI processing

A.D.O.P.T. is designed to use AI-assisted processing to help analyze organizational information and generate decision-support outputs.

Depending on the deployed configuration, submitted information may be sent to an AI service provider to produce a requested result.

Before launch, we will document:

• The AI providers used.
• The categories of information sent to each provider.
• The purposes and legal basis for processing.
• Applicable provider retention and model-training practices.
• Relevant international transfers.
• The safeguards and contractual terms that apply.

We will not claim that submitted data is never used for model training, is never retained by a provider, or remains within a particular country unless those statements have been verified against the actual configuration and contractual arrangements.

A.D.O.P.T.'s AI-generated outputs may be incomplete, inaccurate or unsuitable for a particular context. Users should review outputs before relying on them.

6. Organization access and confidentiality

The platform is designed to isolate organizational data so that a user's role applies within their own organization.

Our intended access model includes:

• Organization-level data separation.
• Role-based permissions.
• Least-privilege access.
• Audit logging of sensitive actions.
• Restricted exceptional access by A.D.O.P.T. personnel.

Routine access by A.D.O.P.T. personnel to proprietary Business Environment data is not intended. Any exceptional access should be authorized by the relevant organization, limited to a defined purpose and period, logged and revoked when no longer required, subject to applicable law and genuine emergency or legal obligations.

These statements describe the intended control model. They must not be presented as operational guarantees until the corresponding controls have been implemented and tested.

7. Sharing information

We may disclose information to:

• Service providers that host, maintain or support the platform.
• AI providers needed to perform requested processing.
• Security, technical and professional advisers subject to appropriate confidentiality obligations.
• Authorities or other parties where disclosure is required by law or necessary to establish, exercise or defend legal claims.
• A successor entity in a lawful business transaction, subject to applicable privacy requirements.

Where service providers process personal data on our behalf, we will use appropriate contractual and organizational safeguards.

We do not sell personal data as a business model. Any other use or disclosure will be described in the applicable notice and conducted in accordance with law.

8. International transfers

Some service providers may process information outside Kenya. Before enabling such processing, we will assess the applicable legal requirements, identify relevant destinations and implement required safeguards or other valid transfer mechanisms.

Specific provider locations and transfer arrangements: Vercel (website hosting) and Resend (email delivery for the demo request form); processing locations to be confirmed.

9. Retention

We retain information only for as long as reasonably necessary for the relevant purposes, subject to applicable legal requirements and legitimate needs such as security, dispute resolution and auditability.

Retention periods will vary by category:

• Website enquiries: up to 12 months after our last contact.
• Account and organization records: to be set out before the platform becomes available.
• Business Environment data and generated reports: to be set out before the platform becomes available.
• Audit and security records: to be set out before the platform becomes available.
• Backups: to be set out before the platform becomes available.
• Legal and billing records, if applicable: to be set out before the platform becomes available.

When information is no longer required, we will delete it, anonymize it or otherwise handle it in accordance with applicable law and documented retention procedures.

10. Security

We intend to apply appropriate technical and organizational safeguards, taking account of the nature of the information and the risks of processing.

These may include access controls, tenant isolation, secure authentication, encryption where implemented, audit logging, secure development practices, backups and incident-response procedures.

No online system can be guaranteed to be completely secure. Specific safeguards should be described publicly only when verified.

11. Your rights

Subject to applicable law and any relevant exceptions, individuals may have rights to:

• Be informed about the processing of their personal data.
• Access personal data.
• Request correction of inaccurate information.
• Request deletion where applicable.
• Object to certain processing.
• Request restriction of processing where applicable.
• Request portability where legally available.
• Withdraw consent where processing relies on consent.
• Lodge a complaint with the relevant supervisory authority.

Requests may be sent to privacy@neurorainnovations.com. We may need to verify identity and clarify the request before responding.

Where an organization controls information submitted through its account, users may also need to contact their organization's administrator or the organization itself.

12. Cookies and similar technologies

Our website may use essential technologies needed to operate the site and, if implemented, optional analytics or preference technologies.

The actual technologies, purposes, providers and choices available to visitors will be described in our Cookie Policy. We will not claim that optional tracking is used or absent until the website has been audited.

13. Children

A.D.O.P.T. is intended for business and organizational use, not for children. We do not knowingly seek to collect children's personal data through the service. If we discover that such information has been collected unlawfully, we will take appropriate steps in accordance with applicable law.

14. Changes to this Policy

We may update this Policy to reflect changes in the service, our processing practices or applicable law. The updated version will state its revision date. Where required, we will provide notice or obtain consent before implementing material changes.

15. Contact

Privacy enquiries and requests:

• Neurora Innovations
• Nairobi, Kenya
• privacy@neurorainnovations.com
• adoptafrica.neurorainnovations.com

Supervisory authority information: Office of the Data Protection Commissioner (ODPC), Kenya — www.odpc.go.ke.