DukAI is operated by Nextverse Solutions Limited, Nairobi, Kenya.Throughout this Privacy Policy, "DukAI", "we", "us", and "our" refer to Nextverse Solutions Limited. This policy explains what information we collect, how we use it, and the choices you have when you use our website, merchant dashboard, and related services (collectively, the "Service").
1. Who this policy applies to
This policy applies to merchants who create an account and connect an Instagram professional account to DukAI. It also describes how we handle information about people who message a connected merchant on Instagram, because those messages are processed through our Service on the merchant's behalf.
2. Information we collect
Account and Instagram connection data
When you sign in with Instagram, we receive and store:
- Instagram user ID, username, display name, and account type
- OAuth access tokens needed to connect to Instagram on your behalf
- Permissions you grant through Meta's authorization flow
- Onboarding and connection status related to your account
Messages and conversation data
To provide inbox management, auto-replies, and conversation starters, we process Instagram direct messages sent to and from your connected account, including message text, timestamps, sender identifiers, and related metadata delivered through Instagram webhooks and APIs.
Configuration you provide
We store settings you create in the dashboard, such as auto-reply rules, conversation starter prompts, and automated response content.
Technical and usage data
We may collect standard server logs, including IP address, browser type, device information, pages visited, and timestamps. We use this data to operate, secure, and improve the Service.
3. How we use information
We use collected information to:
- Authenticate you and maintain your merchant account
- Display and manage Instagram conversations in your inbox
- Send automated and manual replies you configure or approve
- Sync conversation starters and webhook subscriptions with Instagram
- Monitor service health, prevent abuse, and troubleshoot issues
- Communicate with you about access, support, or product updates
We do not sell your personal information. We process customer message content solely to provide the Service to the merchant whose account received or sent those messages.
4. Legal bases for processing
Where applicable, we process personal data to perform our contract with you, to comply with legal obligations, with your consent (for example, when you connect Instagram), and where necessary for our legitimate interests in operating a secure and reliable platform.
5. How we share information
We may share information with:
- Meta / Instagram — to send and receive messages, manage permissions, and maintain API integrations you authorize
- Service providers — who process data on our behalf under contractual safeguards, including:
- Amazon Web Services, Inc. — cloud hosting and database storage
- OpenAI, LLC — AI-assisted direct message and comment replies
- Groq, Inc. — fallback AI processing for messaging features
- Google LLC — Gemini API for fallback AI processing
- Cloudflare, Inc. — infrastructure and optional AI processing
- Legal and safety requests — when required by law or to protect rights, safety, and security
We do not share merchant inbox data with unrelated third parties for their own marketing purposes.
6. Data retention
We retain account, message, and configuration data for as long as your account is active or as needed to provide the Service. If you disconnect or delete your account, we will delete or anonymize personal data within a reasonable period, except where retention is required for legal, security, or dispute-resolution purposes.
7. Security
We use administrative, technical, and organizational measures to protect information, including encryption of access tokens at rest. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
8. Your choices and rights
Depending on your location, you may have the right to:
- Access, correct, or delete personal information we hold about you
- Withdraw consent by disconnecting Instagram or deleting your account
- Object to or restrict certain processing activities
- Request a copy of your data in a portable format
You can revoke DukAI's access at any time through Instagram settings under Website permissions, by disconnecting in Settings, or via our data deletion instructions. To exercise privacy rights, email privacy@dukai.co.ke.
9. International transfers
Our Service may process data on servers located outside Kenya, including through cloud providers and Meta's global infrastructure. Where required, we take steps designed to ensure appropriate safeguards for cross-border transfers.
10. Children
The Service is intended for merchants operating a business. It is not directed to children under 18, and we do not knowingly collect personal information from children.
11. Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above. Material changes may be communicated through the Service or by email where appropriate.
12. Contact us
If you have questions about this Privacy Policy or our data practices, contact us at privacy@dukai.co.ke or hello@dukai.co.ke.
Nextverse Solutions Limited · Nairobi, Kenya