Privacy

What ichava.com collects when you visit it, why, how long it is kept, and your rights.

Summary

A short version to help you read this policy. If it differs from the sections below, the sections govern.

Simtabi LLC runs ichava.com and is responsible for the information described here.
The site runs no analytics, advertising or tracking, and loads no third-party scripts.
It keeps server logs for at most 90 days, and sets two strictly necessary cookies.
Your language and theme choices stay in your own browser and are never sent to us.
We never sell your information or share it for advertising.
You can ask to see, correct or delete your information, and we reply within 30 days.

1. Who we are

Simtabi LLC is the controller of the personal information described here. You can reach us at ichava@simtabi.com, or at 131 N Judd Pkwy NE, Suite #1541, P.O. Box 1541, Fuquay-Varina, NC 27526, United States of America. Our data protection contact is Simtabi LLC, at the same email address.

2. What we collect

Server logs. When you request a page, our web server and the application record the request: your IP address, the time, the page asked for, the response, the referring page and your browser's user agent. Errors are logged the same way.
Cookies. The site sets two cookies that the Laravel framework needs to work: ichava-session, which identifies your session, and XSRF-TOKEN, which protects against cross-site request forgery. They are strictly necessary, are not used to track you, and expire 120 minutes after your last request. The site sets no other cookies.
Information you send us. If you email us, we receive your address, your name if you give it, and what you write. The site has no forms; it collects nothing you type into it.

Giving us information is voluntary. Without your email address we cannot reply to you.

3. What stays in your browser

The landing page remembers your language, theme and accent colour, and whether you closed its announcement bar, in your browser's own storage (localStorage and sessionStorage). That information never leaves your device and is never sent to us. Clearing your browser's data for this site removes it.

4. How we use it, and why we may

To serve the site, keep it running and protect it from abuse, which is our legitimate interest in running a secure website.
To answer you when you write to us, and to take steps you ask for, such as discussing a licence.

We run no analytics, advertising or tracking. We do not build profiles of visitors, and we make no decisions about you by automated means alone.

5. Sharing

We do not sell or rent personal information, and we do not share it for advertising. We share it only with the providers that run the site for us, under written confidentiality and data protection terms: DigitalOcean, which hosts the server, Ploi, which manages it, and our email provider. We also share it with our own team, or when the law requires it.

6. How long we keep it

Server and application logs: at most 90 days, then deleted.
Session data: deleted after the session expires.
Email you send us: two years after our last contact, unless it leads to an agreement, whose records are then kept as that agreement requires.

Deleted information leaves our backups within 30 days.

7. Your rights

Email ichava@simtabi.com to see, correct or delete your information, to receive a copy of it, to object to our use of it, or to ask us to restrict it. We answer within 30 days, or sooner where the law that protects you sets a shorter period, and we may ask you to confirm your identity first. We give these rights to everyone, wherever you are, and do not treat you less favourably for using them.

You may also complain to the data protection authority where you live, for example a supervisory authority in the European Economic Area, the Information Commissioner's Office in the United Kingdom, or the Office of the Data Protection Commissioner in Kenya.

8. Children

The site is not directed at children, and we do not knowingly collect information from anyone under 13. If you believe a child has sent us information, contact us and we will delete it.

9. Security

The site is served only over HTTPS, with a strict content security policy and other protective headers. We use reasonable technical and organisational measures to protect what we hold, but no method is completely secure. To report a vulnerability, see Contact.

10. International transfers

The site is operated from the United States, and our team works from the United States and Kenya. Our providers may process information in other countries. Where the law that protects you restricts sending your information abroad, we rely on a safeguard that law recognises, such as the European Commission's Standard Contractual Clauses. Ask us for a copy of the safeguard that applies to you.

11. Changes

We post any update on this page with a new effective date. A material change takes effect no earlier than 30 days after we post notice of it on the site, unless a law, a security need or a third party's requirement compels a shorter period, in which case the notice says which. We keep earlier versions and send them to anyone who asks.