Privacy Policy
Last updated: 23 June 2026
This notice explains how Rilaw (we, us) collects and uses personal data, in line with the Data Protection Act, 2019 of Kenya. Rilaw is the data controller. You can reach us at rilaw@rilaw.ai.
1. Data we collect
Account details you give us, namely your name, email address, and password (stored only as a secure hash). Profile details you choose to add, such as your profession, whether you are a student, age, gender, and place of residence. Usage data, such as the tasks you run and when. Payment data, where you subscribe, handled by our payment provider, we store the payment status and references only and never your full card number. Content you submit to the assistant, such as documents, contracts, and questions.
2. How we use your data
To provide and operate the assistant, including generating your drafts, reviews, and research. To create and manage your account and subscription, and to take payment. To send you service messages, including email verification, renewal reminders, and offers you can opt out of. To keep the service secure and prevent abuse. To improve the service. To meet legal obligations.
3. Legal basis
We process your data to perform our contract with you, with your consent where consent applies, for our legitimate interests in running and improving the service safely, and to comply with the law. You can withdraw consent at any time, which does not affect processing already carried out.
4. Who we share it with
We use carefully chosen processors and do not sell your data. We share data with our AI provider (Anthropic) to process the content you submit and return your output, with our payment provider (Flutterwave) to take payment, and with our email provider (Resend) to deliver messages. We also reference public legal materials from Kenya Law and similar sources, which does not involve your personal data. We may disclose data where required by law.
5. International transfers
Some processing, including AI processing of the content you submit, takes place outside Kenya, for example on our AI provider's infrastructure. Where data leaves Kenya we rely on appropriate safeguards and the conditions for transfer permitted under the Data Protection Act, 2019.
6. How long we keep it
We keep account and profile data for as long as your account is active and for a reasonable period afterwards. We keep billing and transaction records for as long as the law requires. You can ask us to delete your account, subject to records we must retain.
7. Security
We protect data with encryption in transit, hashed passwords, and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your information and to notify you of a serious breach as the law requires.
8. Your rights
Under the Data Protection Act, 2019 you have the right to be informed, to access your data, to correct it, to have it deleted, to object to or restrict processing, to data portability, and to withdraw consent. To exercise any right, email rilaw@rilaw.ai and we will respond within the timelines the law allows.
9. Cookies
We use a small number of strictly necessary cookies, mainly to keep you signed in. We do not use them to track you across other websites.
10. Children
The service is intended for legal professionals and adults. It is not directed at anyone under eighteen, and we do not knowingly collect their data.
11. Complaints
If you are unhappy with how we handle your data, please contact us first. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya.
12. Changes
We may update this notice from time to time. Material changes will be notified through the service or by email.
See also our Terms and Conditions.