How we handle your data.

We collect what we need to do the work — and nothing more. We operate under Uganda's Data Protection and Privacy Act 2019. Client data is not kept after a project closes. Every third-party service or AI model that touches your information is named in our engagement contract. You can ask us to delete what we hold about you at any time.

From visitors to qairutech.com: when you submit the audit request form, we collect your name, email address, the business type you select, and any text you provide about your challenge. That's it — we don't set tracking cookies, and our analytics provider (Plausible) is cookieless and aggregates traffic without identifying individuals.

From clients during engagements: we access the workflow data, system credentials, and operational records needed to map, automate, or integrate your processes. The exact scope is agreed in writing before any work begins. We avoid touching personal records unless your project specifically requires it — and if it does, we tell you up front and design the architecture accordingly.

• To respond to audit requests and follow up about engagements you've started.
• To deliver the work agreed in your contract — building, testing, and operating the systems we ship.
• To improve our own internal processes (e.g. learning which industries we serve well), in aggregate form only.
• To comply with legal obligations — for example, financial record-keeping required under Ugandan company law.

We do not sell data. We do not share it with anyone outside the people working directly on your engagement.

For the site itself, we use:

• Resend — to deliver booking-form submissions to our inbox.
• Plausible — cookieless, IP-anonymising analytics for traffic counts.
• Vercel — hosting and content delivery.

For client engagements, the AI models, automation platforms, and integrations we use vary by project. We name every third-party service and AI provider in the engagement scope before work starts. If you operate in a regulated sector or have cross-border data restrictions, we design those constraints into the architecture from day one.

Booking enquiries: kept while we're actively in conversation and for up to 24 months afterwards, so we can pick up where we left off if you come back. After that, archived or deleted on request.

Client engagement data: not retained after a project closes. We delete project-specific data — workflow exports, credentials, business records we accessed — within 30 days of contract end, unless you ask us in writing to hold it longer (e.g. for a planned follow-on engagement).

Operational records: contracts, invoices, and financial records are kept for the period required by Ugandan tax and company law.

Under Uganda's Data Protection and Privacy Act 2019, you have the right to:

• Ask what data we hold about you.
• Request that we correct anything inaccurate.
• Ask us to delete your data, subject to legal retention requirements.
• Withdraw consent for any optional uses.
• Lodge a complaint with the Personal Data Protection Office of Uganda.

To exercise any of these, email hello@qairutech.com. We respond within 14 days.

We use industry-standard practices to protect data in transit and at rest: TLS for the site, encrypted cloud storage for project artefacts, password manager–issued credentials, and access scoped to the people working on your engagement. No system is invulnerable, and if a breach affects your data we notify you and the relevant authority as required by law.

If we update how we handle data, we'll update this page and bump the "last updated" date. Material changes that affect existing clients will also go out by email.

Questions about anything on this page? Reach us at hello@qairutech.com. For postal mail, address it to Qairu Technologies Limited, Kampala, Uganda.