Privacy Policy.
What we keep, and why.

Devscook is the data controller for the personal information described in this policy. That means we decide why and how it is used, and we are responsible for it.

• Website: devscook.com
• Contact: hello@devscook.com

When you book a call. Our booking calendar is run by Cal.com. When you book, you give your name, email address, the time you picked, your time zone and anything you write in the notes. If you built an order on our homepage first, the services you picked are added to those notes for you, and you can edit or remove them before booking.

When you email us. Your email address, name and whatever you include in your message and attachments.

When we work together. Contact details for you and your team, project briefs, content and files you share, feedback and approvals, and billing details such as your company name, address and payment records.

When you browse the site. Like any website, our hosting provider receives technical details with each request, such as your IP address, browser type and the page asked for, and keeps them in short-lived server logs. Our fonts are served by Google Fonts, which also receives your IP address when the page loads.

Optional website analytics. If you allow it, Google Analytics collects pages visited, visible sections, approximate reading time, scroll depth, link and button interactions, and successful booking submissions. Google also provides traffic source, device, browser and approximate location reports. We do not send names, email addresses, booking notes, form contents or full query strings to Analytics. We do not use session recording or advertising personalization.

• To reply to you, and to prepare for and hold the call you booked.
• To scope, price, deliver and support the work we agree to do.
• To send invoices, take payment and keep the records the law requires.
• To keep the site running, secure and free of abuse.
• With your consent, to understand website traffic and improve pages, sections and booking journeys.

We don't run a mailing list. We only email you about your enquiry or your project, and we'll ask first before sending anything else.

We only use personal information when the law allows it:

• Contract: to take the steps you ask for before working together, and to deliver the work once we do.
• Legitimate interests: to reply to messages, keep the site secure and run the studio, in ways you would reasonably expect.
• Legal obligation: to keep financial and tax records.
• Consent: for anything else, which you can withdraw at any time.

We never sell personal information or share it for advertising. We only share it with the services that help us run the studio, each bound to protect it and to use it only for the job we give them:

• Cal.com, which runs our booking calendar and sends booking confirmations.
• Google, which hosts this site through Firebase and serves its fonts, and processes optional website analytics through Google Analytics.
• Our email provider, which carries the emails between us.
• The tools we work in, such as Figma, Notion, Slack, Linear and Notion Calendar, when we work together and only with what the project needs.
• Payment providers, to process invoices and payments.
• Professional advisers or authorities, such as our accountant, or where the law requires it.

Some of these services store information outside Kenya, including in the European Union and the United States. Where that happens, we rely on providers that offer appropriate safeguards, such as standard contractual clauses, as the Data Protection Act requires.

Before you allow analytics, we do not load Google Analytics or set its cookies. Your browser also keeps the following:

• A cached copy of our public project pages, so they load faster on your next visit.
• The order you build on our homepage, held in session storage so it can follow you to the booking page. It is deleted when you close the tab.
• Your analytics choice, saved in local storage for up to 180 days.
• If you allow analytics, Google Analytics cookies identify a browser across visits. We configure their lifetime to 180 days. Selecting Decline analytics stops our tracking and removes these first-party cookies.

The project cache and order storage do not identify you. Analytics is optional; you can change your choice through Analytics Preferences in the footer. We also respect Global Privacy Control. The booking calendar is embedded from Cal.com, which may set its own cookies when you use it, under its own privacy policy.

• Enquiries and bookings that don't become a project: up to 24 months after we last spoke, then deleted.
• Project information: for the length of the project, and up to 3 years after, so we can support the work and answer questions about it.
• Invoices and financial records: as long as tax law requires, currently 7 years in Kenya.
• Server logs are kept by our hosting provider for a short period and then deleted automatically.
• Analytics: cookie identifiers expire after up to 180 days. Event data retention is controlled by our Google Analytics property settings. Withdrawing consent stops future collection; it does not erase previously collected reports.

The site is served over HTTPS. Accounts that hold client information use strong, unique passwords and two-step verification, and access is limited to the people working on your project. No system is perfectly secure, but if a breach ever puts your information at risk, we will tell you and the Data Protection Commissioner as the law requires.

You can ask us, at any time and free of charge, to:

• Tell you what personal information we hold about you, and send you a copy.
• Correct anything that is wrong or out of date.
• Delete it, unless we have to keep it by law.
• Stop or limit how we use it, or object to a particular use.
• Send it to you, or to someone else, in a common format.
• Withdraw any consent you have given.

Email hello@devscook.com and we will respond within 30 days. If you're unhappy with how we've handled your information, you can complain to Kenya's Office of the Data Protection Commissioner, or to the data protection authority where you live.

Our services are for businesses, not children. We don't knowingly collect information from anyone under 18; if you think we have, tell us and we will delete it.

For anything about this policy or your information, email hello@devscook.com. A person reads every message.

If we change how we handle personal information, we'll update this policy and the date at the top. If a change matters to people we already work with, we'll tell them directly.