Privacy Policy

1. Data we collect

Lakisa collects only what it needs to run a virtual gallery. That is:

• Account data: your email address and, if you register with a password, a one-way hash of that password (we never store your password itself). If you sign in with Google, Google gives us your email address and your name; we do not receive your Google password.
• Profile data: the display name, biography and profile photo you choose to add in Settings.
• Your work: the artworks you upload (images, and where supported, video or 3D files), their titles, descriptions and dimensions, and the exhibitions you build: their titles, descriptions, room choices, wall colours, artwork placement and visibility settings.
• Usage data: how the Service is used: which public exhibitions are visited and how often, so that artists can see how many people visited their work. A visit is counted per exhibition, per day; we do not build a browsing profile of individual visitors. For each visit we also record the city (from the network address, never your exact position), the type of device, the operating system and the browser, so artists can see how their work is viewed. These details are anonymous: they are never linked to a name, an email address or an account.
• Messages you send us: the content of emails you write to Lakisa, for example when you report a problem or ask a question.

2. Why we collect it

We use your data only to run Lakisa and to make it better:

• To let you sign in, keep your account secure, and show you your own exhibitions and artworks.
• To display the exhibitions you publish to the visitors you choose: everyone, people with the link, or people with the password.
• To show artists how their exhibitions are received (visit counts), and to keep the platform working (for example, to find out which pages fail).
• To answer your messages, and to send you the emails the Service needs, such as a password reset. We do not send marketing emails, and we do not sell your data.

3. Cookies and local storage

Every cookie Lakisa sets is essential to the platform. There are no optional cookies and no advertising cookies, so there is nothing to accept or refuse. The cookie notice at the bottom of the screen only informs you that these cookies are in use; you can close it and keep browsing.

Lakisa uses one session cookie to keep you signed in. It contains a session token, it is set when you sign in, and it is removed when you sign out. Without it, the Service cannot tell that it is you.

Lakisa also sets one anonymous visitor cookie (sanaa_visitor). It holds a random identifier and nothing that names you, and it lasts one year. It lets the platform count how many different people visit, instead of only counting raw visits, and tell new visitors apart from returning ones. It never stores your name, your email address, your IP address or your exact position.

Your language and theme choices are remembered in your browser, in local storage and in two small cookies (sanaa-locale and sanaa-theme), so the site opens the way you left it on your next visit. Your saved favourite rooms are stored the same way, in your browser only, and not synced to your account.

Lakisa runs no third-party advertising cookies and no advertising trackers.

4. Who else handles your data

Lakisa does not sell your personal data to anyone. A small number of service providers handle data on our behalf, only to run the platform:

• Hosting: the website and its database are hosted by Vercel. When you visit Lakisa, your request passes through Vercel's servers.
• File storage: the images and files you upload are stored in a Cloudflare R2 storage bucket. Public exhibition images are served from there to visitors.
• Email: transactional emails (such as password resets) are sent through our email provider using standard SMTP. Your email address is shared with that provider only to deliver the message.
• Google sign-in: if you choose “Continue with Google”, Google handles your sign-in and shares your email address and name with Lakisa, as described in section 1. Google's own privacy policy governs what Google does with your data on its side.

5. How long we keep it

We keep your account, your profile and your work for as long as your account exists. When you delete an artwork or an exhibition, it is removed from the live platform; copies may remain in ordinary backups for a limited time while those backups rotate, and are then gone.

When you delete your account in Settings, your exhibitions, your artworks and your profile are deleted with it. Visit counts are aggregate numbers attached to an exhibition, so they disappear with the exhibition. Emails you sent us may be kept for as long as needed to answer them and to keep a record of the exchange.

6. Your rights

Your work and your data are yours. You can, at any time:

• Access your data: your profile, your artworks and your exhibitions are visible to you in your workspace, and you can download the files you uploaded.
• Correct it: change your display name, biography and profile photo in Settings, and edit any artwork or exhibition you own.
• Delete it: delete individual artworks and exhibitions, or delete your whole account in Settings, which deletes everything attached to it (see section 5).
• Ask us about it: write to contact@kabeyailunga.com if you want a copy of the personal data we hold about you, or if you want something corrected or deleted that you cannot change yourself. We will answer within a reasonable time.

7. Security

We protect your data with the measures a small platform can reasonably provide: passwords are stored as one-way hashes, never in plain text; sign-in sessions use a secure cookie; and access to the database and file storage is limited to the people who run the platform.

No system is perfectly secure. If you believe your account has been compromised, change your password and write to contact@kabeyailunga.com. If we discover a breach that affects your personal data, we will tell you what happened and what we are doing about it.

8. Children

Lakisa is not aimed at children under 13, and we do not knowingly collect personal data from them. If you are under 18, use Lakisa only with a parent or guardian's permission, as the Terms of Use explain.

9. Changes to this policy

We may update this policy when Lakisa changes, for example, if we add a new feature that collects a new kind of data. When a change matters, we will tell you in the product or by email before it takes effect. The date at the top of this page shows when it was last updated.

10. Contact

Lakisa is operated from Uganda. For any question about this policy, or about your personal data, write to contact@kabeyailunga.com.

For any question about this document, write to contact@kabeyailunga.com.