Privacy Policy
Last updated: March 27, 2025
Overview
Hekaya Agency (“Hekaya”, “we”, “us”, or “our”) is a software development company registered in Kampala, Uganda. This Privacy Policy explains how we collect, use, and protect information when you visit our website at hekaya.agency or interact with us.
We take privacy seriously. We collect the minimum data necessary to operate our website and respond to enquiries, and we never sell your data to third parties.
Information we collect
Information you give us
When you submit the contact form on our website, we collect your name, email address, company name (optional), phone number (optional), and the message you send. We use this information solely to respond to your enquiry.
Information we collect automatically
When you visit our website, we collect basic analytics data including the page you visited, the page that referred you, your approximate country and city (derived from your IP address), and your browser user agent string.
We do not store raw IP addresses. Your IP address is cryptographically hashed before storage using a secret salt, meaning it cannot be reversed to identify you.
We do not use third-party analytics services such as Google Analytics. All analytics data is stored on our own infrastructure and used only to understand how our website is being used.
Cookies
We use a single session cookie (hekaya_session) to keep admin users logged into our content management system. This cookie is only set when an administrator logs in and is not used for tracking. We do not use advertising cookies or third-party tracking cookies.
How we use your information
We use the information we collect to:
- Respond to enquiries submitted through our contact form
- Understand how our website is being used so we can improve it
- Maintain the security and performance of our systems
We do not use your information for advertising, profiling, or any purpose other than those listed above.
Data storage and security
Contact form submissions and anonymised analytics data are stored in a database hosted on Turso (a managed SQLite service). Our website is hosted on Fly.io, a platform with data centres in Johannesburg, South Africa. Media files are stored on Cloudflare R2.
We use HTTPS for all data transmission. Passwords are hashed using bcrypt before storage. Session tokens are stored as HttpOnly cookies and are not accessible to JavaScript.
We retain contact form submissions for as long as necessary to respond to your enquiry and for reasonable follow-up. You may request deletion of your data at any time by contacting us.
Sharing your information
We do not sell, rent, or share your personal information with third parties, except in the following limited circumstances:
- Service providers: We use Turso, Fly.io, and Cloudflare to operate our infrastructure. These providers process data on our behalf under their own privacy policies.
- Legal requirements: We may disclose information if required to do so by law or in response to a valid legal request.
Your rights
You have the right to:
- Request access to the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your data
- Object to our processing of your data
To exercise any of these rights, contact us at info@hekaya.agency. We will respond within 30 days.
Children's privacy
Our website is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us and we will delete it promptly.
Changes to this policy
We may update this Privacy Policy from time to time. We will update the “Last updated” date at the top of this page when we do. Continued use of our website after any changes constitutes acceptance of the updated policy.
Contact us
If you have questions about this Privacy Policy or how we handle your data, please contact us: