Privacy Policy
How LionsLane collects, uses and protects personal data when you use EMMA, under Kenya's Data Protection Act, 2019.
Last updated 9 October 2026
Who we are
EMMA is operated by LionsLane (Nairobi, Kenya). For your account and billing data we are the data controller. For personal data you put into your workspace about your own customers and leads, your business is the controller and we process it on your instructions.
What we collect
- Account: your email address, name, and sign-in records.
- Workspace content: your business profile, calendar, campaigns, leads, emails, library and notes, and your conversations with EMMA.
- Leads: contact details you add, and business contact details EMMA finds in public sources (always marked unverified and without consent).
- Usage: how many briefs and searches you use, and the AI processing they needed, so we can enforce plan limits and costs.
- Payments: for M-Pesa, the phone number and the receipt. Card payments are handled by Stripe; we never see or store card numbers.
- Technical: server logs (including IP address) kept briefly for security, and anonymous, cookie-free page statistics.
Why we use it (lawful basis)
- To provide EMMA under our contract with you: running your workspace, generating your plans, billing.
- Our legitimate interests: keeping the service secure, preventing abuse, and improving the product from aggregated usage.
- Legal obligations: keeping financial records.
- Your consent, where we ask for it (for example product news by email). You can withdraw it at any time.
We do not sell personal data and we do not use your workspace to train AI models.
Who processes it for us
| Provider | What for | Where |
|---|---|---|
| Supabase | Database and sign-in | Cloud region chosen at setup |
| Vercel | Hosting the website and API | Global |
| Anthropic | Generating EMMA's responses (Claude) | United States |
| Stripe | Card payments | Global |
| Safaricom | M-Pesa payments | Kenya |
When you brief EMMA, your message, the conversation and the relevant parts of your workspace are sent to Anthropic to generate the reply. Under its commercial terms, Anthropic does not use this data to train its models. Some providers process data outside Kenya; we rely on contractual safeguards for those transfers as the Act requires.
How long we keep it
Workspace and account data for as long as your account is open. When you delete your account, we delete it within 30 days, except records the law requires us to keep (such as payment records, kept for the period required by Kenyan tax law). Security logs are kept for up to 90 days.
Your rights
You can ask to access, correct, export or delete your personal data, object to or restrict how we use it, and withdraw consent. You can export your workspace and delete your account yourself in the app. For anything else, contact us at the contact details on our website. If you're unhappy with our answer, you can complain to the Office of the Data Protection Commissioner (ODPC).
Security
Data is encrypted in transit, every business's data is isolated at the database level, secret keys never reach your browser, and access is limited to people who need it. If a breach affects your personal data, we'll notify the ODPC within 72 hours and tell you without undue delay.
Children
EMMA is for businesses and people aged 18 and over.
Changes
We'll post changes here and tell you in the app or by email if they matter.