Tarifact
Back to classifier

Privacy Policy

Last updated: August 2026

Tarifact is owned and operated by James Ochuodho, a Kenyan individual operating under the Kenya Data Protection Act, 2019 (No. 24 of 2019). This Privacy Policy explains what personal data we collect, how we use it, and your rights as a data subject. By using Tarifact, you agree to the collection and use of information as described in this policy.

1 — Who We Are

Tarifact is an AI-powered HS tariff classification tool designed for use within the East African Community. We are registered as a Data Controller with the Office of the Data Protection Commissioner (ODPC) of Kenya.

Data Controller contact

2 — What Personal Data We Collect

We collect the following categories of personal data:

Account data

When you create an account, we collect your email address, display name, and encrypted password.

Usage data

We log classification requests including timestamps, input method used (camera, upload, or text), the HS code returned, and confidence level. We do not store product photos beyond the duration of a single classification session.

Product descriptions

Text descriptions you enter for classification purposes are processed to generate a result and logged for service improvement. These descriptions may contain information about the goods you work with professionally.

Payment data

When you subscribe to a paid plan, payment is processed by Pesapal Limited, a licensed Payment Service Provider regulated by the Central Bank of Kenya. We do not store card numbers, M-Pesa PINs, or other sensitive payment credentials. We receive and store a transaction reference number and subscription status from Pesapal.

Technical data

IP address hash (anonymised), browser type, device type, and session identifiers for security and fraud prevention purposes.

3 — How We Use Your Data

We use your personal data for the following purposes:

  • To provide the classification service — your product descriptions are processed to generate HS code classifications
  • To manage your account and subscription
  • To maintain your classification history where applicable to your plan
  • To improve the accuracy and performance of the classification engine
  • To communicate with you about your account, subscription, and service updates
  • To comply with legal obligations under Kenyan law

4 — International Data Transfers

Tarifact uses Anthropic, Inc. (United States) to power its AI classification engine. When you submit a product description or image for classification, that description or image is transmitted to Anthropic's servers in the United States for processing. Anthropic processes this data solely to generate the classification result and does not use it to train their models on your behalf.

By using Tarifact, you consent to this transfer of your product descriptions and images to the United States for processing purposes. Anthropic operates under data protection standards consistent with international best practices. For more information see Anthropic's Privacy Policy at anthropic.com/privacy.

Payment processing is handled by Pesapal Limited, a Kenyan company. Payment data does not leave Kenya.

5 — Data Retention

  • Account data: retained for the duration of your account and deleted within 30 days of account closure on request
  • Classification history: retained for 30 days for Free accounts, indefinitely for Professional and Organisation accounts, deleted on request
  • Payment transaction references: retained for 7 years as required by Kenya's Tax laws
  • Guest session data: anonymised fingerprint data retained for 24 hours only

6 — Your Rights Under the Kenya Data Protection Act 2019

Under the Kenya Data Protection Act, 2019, you have the following rights:

  • The right to be informed about how your data is used — this Privacy Policy fulfils that obligation
  • The right to access your personal data — contact us to request a copy
  • The right to correction of inaccurate data
  • The right to deletion of your personal data — we will delete your account and associated data within 14 days of a verified request, subject to legal retention requirements
  • The right to object to processing of your personal data
  • The right to data portability — you may request your classification history in a machine-readable format

To exercise any of these rights, contact us at ochuodho.jamesogutu@gmail.com. We will respond within 21 days as required by the Act.

7 — Data Security

We implement the following security measures to protect your personal data:

  • All data transmitted between your device and Tarifact is encrypted using HTTPS/TLS
  • Passwords are stored using industry-standard one-way encryption
  • Database access is restricted to authorised backend functions only using row-level security
  • API keys and payment credentials are stored as encrypted environment variables and never exposed in application code
  • We conduct regular reviews of access controls and security practices

8 — Cookies and Local Storage

Tarifact uses browser local storage (not cookies) to maintain your session, store your recent Code Checker lookups, and remember your install prompt preferences. This data is stored on your device only and is not transmitted to our servers.

9 — Third Party Services

Tarifact uses the following third-party services:

ServicePurposeLocationPrivacy Policy
Anthropic, Inc.AI classification engineUnited Statesanthropic.com/privacy
Pesapal LimitedPayment processingKenyapesapal.com/privacy
Lovable CloudApp hosting and databaseEuropean Unionlovable.dev/privacy

10 — Children

Tarifact is a professional tool intended for adults engaged in customs and trade. We do not knowingly collect personal data from persons under 18 years of age.

11 — Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and notify registered users by email if the changes are material. Continued use of Tarifact after changes constitutes acceptance of the updated policy.

12 — Contact and Complaints

For any privacy-related queries or to exercise your data rights, contact:

If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya: