1. Who we are and what this policy covers#
This policy explains how Msharti Intelligence Limited, trading as msharti ("msharti", "we", "us"), handles personal data. msharti provides a contracted AI access layer for organisations: role-based control of what AI tools and agents can reach, an audit log, human approval for agent write actions, Shadow-AI discovery and connectors built for each client.
It applies to visitors to msharti.dev, people who contact us or request a Shadow-AI Exposure Assessment, people who receive our updates, and our business contacts at clients, prospects, partners and suppliers.
Please also read our Terms of Service.
2. Our two roles: controller and processor#
When we are the controller. For website visits, enquiry and booking forms, assessment requests, marketing and business contacts, we decide why and how personal data is used. This policy applies.
When we are the processor. When an organisation hires us, the data that passes through our services (for example audit logs, connector settings, data from the client's systems, or log exports shared for an assessment) belongs to that client. We use it only on the client's documented instructions, under a signed data processing agreement (DPA). The client's own privacy notice applies to that data. If you are a client's employee or customer, please contact that organisation first. If you contact us, we will pass your request to them and help them respond.
3. What we collect#
- Forms and enquiries: name, work email, organisation, role, sector, organisation size and your optional message.
- Assessment requests: the information you submit and our review decision. We review requests by hand.
- Communications and meetings: emails, call scheduling details and meeting notes.
- Business contacts: work contact details, roles and records of our dealings.
- Technical data: basic browser, device, network and page-view information used to run and secure the website, and optional analytics when you consent.
Please do not send logs, files, passwords or customer data through website forms.
4. How we use your data and why#
We use personal data to:
- reply to enquiries and arrange calls (steps you asked us to take before a contract, and our legitimate interest in answering business enquiries);
- review assessment requests and prevent abuse (our legitimate interest in making sure access goes only to genuine, authorised organisations);
- deliver our services and manage client relationships (performance of a contract);
- keep financial and business records (legal obligation);
- send updates and event invitations, only if you opt in (consent, which you can withdraw at any time);
- run and secure our website (legitimate interests), and understand page usage through optional analytics (consent).
Where we rely on legitimate interests, you can object at any time. We do not make decisions about you based solely on automated processing.
5. Shadow-AI Exposure Assessments#
An assessment shows an organisation which AI tools are in use without approval and what data may be leaving. For the data the client shares with us:
- the client is the controller and msharti is the processor, and nothing is shared until a non-disclosure agreement and a DPA are signed;
- we ask only for the data fields we need, and replace user names with pseudonyms by default;
- we do not ask for the content of messages or documents;
- the scope and permitted processing are set out in the assessment agreement and DPA;
- raw assessment data is deleted after delivery within the period agreed in the DPA, and deletion is confirmed in writing;
- findings describe tools and departments, not individual people.
8. Processing by Service Providers#
Service Providers process personal data on our behalf under appropriate confidentiality, security and data-protection terms. If personal data is transferred to another country, we use the safeguards required by applicable data protection law. Client-specific processing arrangements are set out in the signed agreement and DPA.
9. How long we keep data#
We keep personal data only as long as needed for the purposes in this policy, or as the law requires. We then delete or anonymise it.
- Enquiries and requests: while needed to review and respond to the request and manage any resulting relationship.
- Marketing contacts: until you unsubscribe; we may retain a limited do-not-contact record to respect your choice.
- Business and financial records: for the period required by law.
- Client and assessment data: for the period agreed in the client's agreement and DPA, then returned or deleted as agreed.
10. Security#
We use technical and organisational measures appropriate to the risk, including protecting data in transit and limiting access to people who need it for their work. No system is completely secure, so we cannot guarantee absolute security.
11. If there is a data incident#
If a personal data breach happens:
- Where we are the controller, we will notify the relevant data protection authority without undue delay and, where required, within 72 hours of becoming aware of it. For msharti, that authority is the Office of the Data Protection Commissioner (ODPC) in Kenya. Where there is a real risk of harm, we will also tell the people affected, explain what happened and what they can do.
- Where we are the processor, we will notify the client without undue delay and within the time set in their DPA, and give them the information they need to meet their own duties.
12. Your rights#
Depending on where you live and the law that applies, you can ask us to:
- tell you what personal data we hold and give you a copy;
- correct data that is wrong or incomplete;
- delete data we no longer need;
- restrict or stop using your data, including for marketing;
- send your data to you or another organisation in a common format; and
- withdraw your consent, where we rely on it.
To make a request, email contact@msharti.dev. We may need to confirm your identity first. We will reply within the time the law allows and explain if we cannot meet a request in full. Every marketing email includes an unsubscribe link.
13. Children#
Our website and services are for organisations and are not aimed at anyone under 18. We do not knowingly collect children's data. If you think we have, contact us and we will delete it.
14. Changes to this policy#
We may update this policy when our services or the law change. We will post the new version here with a new "last updated" date. If a change materially affects how we use data we already hold, we will tell the people affected where we can.
15. Contact us and complaints#
For privacy questions or to exercise your rights, email contact@msharti.dev.
If you are unhappy with how we have handled your data, please contact us so we can try to put it right. You can also complain to the Office of the Data Protection Commissioner (ODPC) in Kenya, or to your local data protection authority.
Version history
- 1.0 · October 2026Simplified policy and website practices updated.