Privacy Policy

Mateeka is a product of Crane Digital Solutions (U) Limited, a company registered in the Republic of Uganda with the Uganda Registration Services Bureau under business registration number 80034330576974. For the purposes of this Privacy Policy and the Uganda Data Protection and Privacy Act, 2019 (the “DPPA”), we are the data controller of personal data collected through the Service.

This Privacy Policy explains what personal data we collect when you use the Service, how we use and share it, where it is stored, how long we keep it, and the rights you have over it.

We collect personal data in the following ways:

We use personal data to:

• Authenticate you and provide access to the Service;
• Generate AI-assisted research responses based on your queries;
• Save your conversations, sessions, and credit balance so you can return to them;
• Process credit purchases and keep accurate financial records;
• Send transactional and service emails (such as receipts, firm invitations, and security alerts);
• Detect and prevent fraud, abuse, and unauthorised access;
• Improve the reliability and quality of the Service through aggregated, non-identifying analysis; and
• Comply with our legal obligations under Ugandan law.

The legal bases on which we rely under the DPPA are: performance of a contract with you (to provide the Service you signed up for), compliance with a legal obligation (in particular tax and accounting law), our legitimate interests in operating and securing the Service, and your consent where we ask for it.

We do not use your queries, conversations, uploaded content, or any other personal data to train, fine-tune, or evaluate artificial-intelligence models, whether ours or those of our providers.

When we send your queries to third-party AI providers to generate a response, we do so under their API arrangements, which prohibit those providers from using your data to train their models and require deletion of inputs and outputs after a short retention window for abuse monitoring.

To deliver the Service, we rely on a small number of trusted external service providers. They process personal data only on our written instructions and only to the extent needed to provide their service to us, under contractual confidentiality and data-protection obligations. We use providers that fall within the following categories:

• Cloud infrastructure — database, file storage, authentication, application hosting, and content delivery used to operate the Service and store your account, conversation, and transaction data securely.
• AI model and language processing providers — large-language-model and document-processing services that generate AI responses to your queries and help us prepare the legislation library.
• Workflow orchestration — services used internally to route requests between components of the Service.
• Identity providers — Google (web, Android, iOS) and Apple (iOS only) for Sign in with Google and Sign in with Apple. If you use Apple’s private email relay, Apple forwards email to you on our behalf without disclosing your real address.
• Payment processing — Yo Payments for mobile-money credit purchases in Uganda. Your mobile money phone number, the amount, and a transaction reference are shared with Yo Payments to complete the purchase.
• Transactional email delivery — to send service emails such as receipts, firm-workspace invitations, and security alerts.

We choose providers that offer appropriate technical and organisational security measures. Where you exercise your rights under the Uganda Data Protection and Privacy Act, 2019, we will provide further information about the specific recipients of your personal data on request to joel@mateeka.com.

We do not sell your personal data, share it for cross-context behavioural advertising, or rent it to third parties. We may disclose personal data: (a) where required by Ugandan law, court order, or a request from a competent authority; (b) to enforce our Terms of Service or protect the rights, safety, or property of Crane Digital Solutions (U) Limited, our users, or others; or (c) in connection with a corporate transaction such as a merger or acquisition, in which case the recipient will be bound by terms at least as protective as this Privacy Policy.

Our primary database, file storage, and authentication systems are hosted in Switzerland. Other service providers process data in the regions in which they operate, which may include the United States and the European Union.

This means that when you use the Service, your personal data is transferred from Uganda to Switzerland and, depending on the feature, to other jurisdictions. Switzerland is recognised as providing an adequate level of data protection under the European Union’s GDPR framework. Where data is transferred to other jurisdictions through our sub-processors, we rely on those providers’ standard contractual protections to safeguard your data.

Account profile, conversations, research sessions, and unused credits. We keep these for as long as your account is active. When you delete your account, this data is erased immediately and permanently; we cannot recover it afterwards.

Transaction and financial records. Records of completed credit purchases (including amount, date, transaction reference, and the mobile money phone number used) are retained for up to seven (7) years after the transaction, even if you delete your account. This retention is required by Ugandan tax and accounting law, including the Tax Procedures Code Act, 2014. These records are kept only for that compliance purpose and are not used for marketing, profiling, or anything else.

You can delete your account at any time:

• Mobile apps: use the in-app account deletion option in our iOS and Android applications.
• Web app: a self-service deletion flow is being rolled out. In the meantime, please email joel@mateeka.com from the address associated with your account.

Deletion is immediate and irreversible. Please make sure you have exported anything you wish to keep before confirming. The only data that survives deletion is the financial transaction records described in section 7 above, which we are legally required to retain.

Under the Uganda Data Protection and Privacy Act, 2019 you have the right to:

• Access: request a copy of the personal data we hold about you;
• Correction: ask us to correct inaccurate or incomplete personal data;
• Deletion: ask us to delete personal data we hold about you (account deletion is the fastest way to do this for most data);
• Object or restrict: object to or ask us to restrict certain types of processing;
• Withdraw consent: where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal; and
• Lodge a complaint: with the Personal Data Protection Office (PDPO) of Uganda if you believe we have not handled your personal data lawfully.

To exercise any of these rights other than account deletion, please contact us at joel@mateeka.com. We may need to verify your identity before responding, and we will respond within the time allowed under Ugandan law.

We use industry-standard measures to protect your personal data, including encryption of data in transit (HTTPS/TLS) and at rest, strict role-based access controls within our team, OAuth-based authentication via Google, and reputable infrastructure providers.

No system is perfectly secure. While we work hard to protect your data, we cannot guarantee absolute security. If we become aware of a security incident affecting your personal data, we will notify you and, where required, the Personal Data Protection Office, in accordance with Ugandan law.

We use a small number of cookies and similar technologies, limited to:

• Essential cookies: required to keep you signed in and to keep the Service functioning. These cannot be turned off without breaking the Service.
• Preference cookies: remember settings such as theme and language.

You can clear or block cookies in your browser settings, but doing so may prevent you from signing in or using parts of the Service.

The Service is intended for users who are 18 years of age or older. We do not knowingly collect personal data from anyone under 18. If you believe a person under 18 has provided us with personal data, please contact us at joel@mateeka.com and we will delete it.

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page and, for material changes, give reasonable notice through the Service or by email before the change takes effect.

If you have questions about this Privacy Policy or wish to exercise any of your rights, please contact us: