Privacy Policy

JUA Agent
Bluecrane Creatives Limited

Last Updated: 16 October 2026
Effective Date: 16 October 2026

This Privacy Policy (the “Policy”) explains how Bluecrane Creatives Limited (“Bluecrane”, “we”, “us”, or “our”) collects, uses, stores, discloses, and otherwise processes personal data in connection with the product marketed as JUA Agent / JUA AGENT (the “Service”).

By accessing or using the Service, you acknowledge that you have read and understood this Policy. If you do not agree with this Policy, you must not use the Service.

1. Controller identity and contact

1.1 The data controller for personal data processed as described in this Policy, except where we act as a processor for an Organization Customer (as defined below), is:

Bluecrane Creatives Limited
Product: JUA Agent
Email for privacy and data-protection requests: [email protected]
Websites: https://juaagent.com , https://dashboard.juaagent.com , https://bluecranelimited.com

1.2 All notices, requests, and complaints under this Policy shall be sent to [email protected]. We may require reasonable verification of identity before acting on a request.

1.3 This Policy is intended to align with the principles of the Data Protection Act, 2019 of Kenya (the “DPA”) and, where applicable, other data-protection laws that apply to the relevant processing. Nothing in this Policy limits any non-waivable statutory right.

2. Scope of this Policy

2.1 This Policy applies to personal data processed through all surfaces of the Service, including without limitation:

(a) the public marketing website at https://juaagent.com and related pages (including visitor conversation portals such as /conversations);
(b) the customer dashboard at https://dashboard.juaagent.com;
(c) the Android application identified as package com.juaagent.dashboard (the “Android App”), whether distributed by direct install or other means we authorize;
(d) the WordPress plugin distributed as Jua Agent (the “WordPress Plugin”);
(e) the embeddable website chat widget served from https://concierge.juaagent.com (including jua-widget.js) (the “Widget”);
(f) WhatsApp support messaging connected through the Service;
(g) Facebook Page connection and content posting through Meta platforms;
(h) subscription billing through Safaricom M-Pesa;
(i) Bird Eye developer and affiliate tooling made available by us; and
(j) related application programming interfaces, emails, push notifications, and support communications.

2.2 This Policy does not govern the privacy practices of third-party websites, applications, payment networks, Meta Platforms, WhatsApp, WordPress.org, WooCommerce merchants, or other independent controllers, except to the extent we receive personal data from them in connection with the Service.

2.3 Messaging channels that are not offered as live customer-chat products of the Service (including Meta Messenger customer chat and Instagram messaging, unless and until we expressly enable them) are not current processing activities under this Policy. If we enable additional channels, we shall update this Policy.

3. Roles: controller and processor

3.1 Account and Service administration. When you create a dashboard account, join an organization, pay a subscription, contact us about the Service, or use Bird Eye as a developer or affiliate, we act as a data controller for the personal data we collect for those purposes.

3.2 Organization Customers and Visitors. Organizations and their authorized users (“Organization Customers”) use the Service to operate AI-assisted and human-assisted conversations with end customers, website visitors, WhatsApp correspondents, and portal users (collectively, “Visitors”). In relation to Visitor personal data processed on behalf of an Organization Customer (for example chat transcripts, pre-chat fields, ticket messages, and Widget analytics for that organization’s sites), we act as a data processor (or equivalent service provider) and the Organization Customer remains the data controller (or equivalent) of that Visitor data, except where we are required by law to process such data for our own compliance, security, or dispute-resolution purposes.

3.3 Organization Customers are solely responsible for:

(a) providing appropriate privacy notices to Visitors;
(b) establishing a lawful basis for collection and disclosure of Visitor data to the Service;
(c) obtaining any consent required by applicable law (including where a WordPress storefront identifies a logged-in shopper to the agent); and
(d) configuring the Service (including pre-chat fields, knowledge sources, database connections, and channel integrations) in a lawful manner.

3.4 Visitors who interact with an Organization Customer’s Widget, WhatsApp number, or portal should also review that Organization Customer’s privacy notice. Where your request concerns Visitor data controlled by an Organization Customer, we may redirect you to that Organization Customer or act only on documented instructions from them, unless applicable law requires otherwise.

4. Categories of personal data we process

Depending on how the Service is used, we may process the following categories of personal data.

4.1 Account holder and team data

(a) Identity and contact details: first name, last name, email address, telephone number.
(b) Authentication data: password hashes; email one-time passcodes (stored in hashed form); authenticator (TOTP) secrets (stored encrypted); backup codes (stored hashed); session cookies; Flutter access and refresh tokens; handoff codes between web and mobile; invitation tokens.
(c) Role and membership data: user role, user type, organization membership, invitation status, partner or referral attributes where applicable.
(d) Profile updates submitted through the dashboard or Android App.

4.2 Organization profile and configuration data

(a) Organization name, organization email, organization telephone, country, currency, industry, website URL, website type, address fields where provided, logo, description, allowed domains.
(b) Widget and agent configuration: agent display name, welcome message, personality and mood settings, colours, logo, pre-chat field definitions, knowledge and sitemap settings, domain allowlists.
(c) Team invitations: invitee email, role, inviter identity, expiry and status.
(d) Organization security policy settings (including whether a second authentication factor is required and which methods are allowed).
(e) Optional organization outbound email (SMTP) settings, including host, port, encryption mode, username, from-address, and credentials stored in encrypted form.
(f) Optional organization database connection settings (host, port, database name, username, and credentials stored in encrypted form or via our secrets vault), together with acknowledgment records for such connections.
(g) WordPress site binding data: site URL, plugin version, connection codes (stored hashed), feature flags, and encrypted WooCommerce or WordPress application credentials where supplied.

4.3 Visitor and conversation data

(a) Identity and contact details provided in chat, pre-chat forms, offline messages, support requests, or portal authentication (including name, email, telephone, and other configured pre-chat fields).
(b) Message content sent by Visitors, AI systems, or human agents, including attachments or media metadata where the channel supports them.
(c) Session metadata: session token, widget identifier, organization key, chat mode, channel (for example website or WhatsApp), timestamps, and activity markers.
(d) Technical metadata: IP address, inferred or derived country, browser, device, operating system, and user-agent strings.
(e) Custom fields associated with a session (including structured visitor attributes used for support and continuity).
(f) Ticket data: requester details, ticket messages, internal notes, events, ratings, and AI-generated summaries where enabled.
(g) Portal read-state records keyed to visitor email and session.
(h) Contact list attributes and contact exclusion (hide-from-list) records.
(i) Daily briefing and action-item content derived from conversations and site analytics for the Organization Customer.

4.4 WhatsApp channel data

(a) Linked WhatsApp telephone number for an organization.
(b) Peer identifiers (typically telephone numbers) for inbound and outbound threads.
(c) Message content and thread linkage to chat sessions in the Service.
(d) Connection status and operational records required to maintain the channel.

4.5 Meta / Facebook data

(a) OAuth state and authorization artefacts during Facebook Login for Business.
(b) Page identifiers and names.
(c) Page access tokens stored in encrypted form.
(d) Content created or published through the Service (text, images, or video) and related engagement data returned by Meta APIs to the extent required to operate posting features.

4.6 WordPress and WooCommerce-related data

(a) Site connection and credential data described in clause 4.2(g).
(b) Where the Organization Customer enables logged-in shopper identification: WordPress user identifier, email, display name, and optional WooCommerce customer identifier, transmitted to the Service to associate a Visitor session with a known shopper.
(c) Order and billing fields retrieved from the merchant’s WooCommerce store when the Organization Customer has connected WooCommerce tools and the Service queries that store on the Organization Customer’s instructions. Order and media libraries remain on the merchant’s WordPress or WooCommerce systems; chat transcripts are stored in the Service, not in the WordPress database.

4.7 Billing and payment data

(a) Subscription and plan identifiers, usage and token accounting, amounts, currency (including Kenyan Shillings), tax or VAT fields as displayed in the product, and payment status.
(b) M-Pesa related data: customer name, email, telephone number used for STK push, payer account references, transaction references, initiation metadata (including IP address, user agent, and device descriptors where captured), and provider callback payloads necessary to confirm or reconcile payment.
(c) Partner fee records linked to paid transactions where the partner program applies.

We do not operate card payments through Stripe or similar card processors within the Service as of the Effective Date. Payments for subscriptions are processed through Safaricom M-Pesa as configured in the product.

4.8 Analytics, logging, and device data

(a) Widget site analytics events: anonymous visitor identifier, page URL, path, title, referrer, country code, browser family, operating system family, device type, user agent, IP address, organization and widget identifiers, and timestamps.
(b) Large-language-model usage events: organization, widget, session, route, model, token counts, cost accounting fields, and related metadata.
(c) Activity logs: actor email, action, category, target, description, metadata, IP address, and user agent.
(d) Application and operational logs maintained for security, reliability, and support (which may include truncated request or response diagnostics for troubleshooting).
(e) Firebase Cloud Messaging registration tokens, platform label, and user-agent information for push notifications.
(f) Android App local storage of authentication tokens in platform secure storage and limited account roster information in local preferences.

4.9 Staff Agent workspace data

(a) Conversations between authorized dashboard or Android users and the internal staff Agent workspace.
(b) Message text, attachments metadata, and tool-audit records (including tool invocation summaries and related request metadata) generated while using organizational tools.

4.10 Knowledge and content data

(a) Website and sitemap content retrieved or indexed for the Organization Customer’s agent knowledge.
(b) Data sources and documents uploaded or linked by the Organization Customer.
(c) Derived vector or retrieval representations used to answer Visitor or staff queries.
(d) Social content drafts and published posts managed through the Service.

4.11 Marketing site and communications data

(a) Information submitted through contact or “Talk to us” forms on juaagent.com.
(b) Transactional email content and delivery metadata (registration codes, password reset links, security notices, product notifications, and monthly reports where enabled).

We do not sell personal data.

5. Sources of personal data

5.1 We obtain personal data from:

(a) you directly (registration, profile, configuration, payments, support);
(b) your organization administrators and teammates (invitations, role assignments, shared configuration);
(c) Visitors interacting with Organization Customer channels;
(d) automated collection from devices and browsers (cookies, tokens, IP address, user agent, analytics events);
(e) Meta Platforms in connection with Facebook Login and Page APIs;
(f) WhatsApp channel operation for linked numbers;
(g) WordPress and WooCommerce systems when connected by the Organization Customer;
(h) Safaricom M-Pesa payment APIs and callbacks; and
(i) service providers acting on our instructions (for example email delivery and AI inference providers).

6. Purposes of processing and lawful bases

6.1 We process personal data for the purposes and on the lawful bases set out below. Where the DPA or other applicable law requires a specific basis, we rely on the basis indicated.

6.2 Where we rely on consent for a specific optional processing activity, you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal. Withdrawal may limit related features.

6.3 We do not use personal data to train public foundation models for unrelated third parties. We use personal data to operate, secure, and improve the Service for Organization Customers, including generating AI responses and operational summaries as part of the contracted features.

7. Disclosure of personal data

7.1 We disclose personal data only as described in this Policy or with your direction, including to:

(a) Organization members with appropriate roles (owners, team members, assignees) who access the same organization’s inbox, tickets, analytics, and settings;
(b) Processors and sub-processors that host or process data on our behalf under contractual obligations of confidentiality and security, including:

1. infrastructure providers hosting our databases, application servers, caches, and queues (including PostgreSQL data stores and Redis-backed job or cache systems used by the Service);
2. the Concierge runtime at concierge.juaagent.com, which powers Widget conversations and related session handling;
3. large-language-model providers used to generate completions (including OpenRouter and any model provider configured for the Service);
4. transactional email providers (including Resend) and, where an Organization Customer configures custom SMTP, that Organization Customer’s mail server;
5. Safaricom (M-Pesa / Daraja) for payment initiation and confirmation;
6. Google Firebase Cloud Messaging for push delivery;
7. Meta Platforms, Inc. and its affiliates for Facebook Login, Page APIs, and related products the Organization Customer connects;
8. WhatsApp transport operated as part of the Service for linked organizational numbers;
9. secrets-management infrastructure used to store platform and organizational credentials (including OpenBao vault paths used by the Service); and
10. optional media storage services where dual-write or media hosting features are enabled;

(c) professional advisers under confidentiality obligations;
(d) authorities where required by law, court order, or to protect rights, safety, or security; and
(e) a successor in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to appropriate protections.

7.2 Organization Customers may export or display Visitor data within their own systems (including WordPress administration interfaces that call our APIs). Such disclosure is controlled by the Organization Customer.

7.3 We do not sell personal data and do not share personal data for cross-context behavioural advertising as a business model of the Service.

8. International transfers

8.1 The Service is operated with primary operational orientation to Kenya (including Africa/Nairobi scheduling and Kenyan Shilling billing). Nonetheless, personal data may be transferred to, stored in, or accessed from countries other than Kenya because our processors (including AI inference, email, push, hosting, and Meta services) may be located abroad.

8.2 Where we transfer personal data internationally, we shall take steps designed to ensure an appropriate level of protection, including contractual safeguards with processors and security controls described in this Policy, as required by applicable law.

8.3 Questions about transfers may be sent to [email protected].

9. Retention

9.1 We retain personal data only for as long as necessary for the purposes set out in this Policy, including to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements.

9.2 Without limiting clause 9.1:

(a) Account and organization data are retained for the life of the account or organization relationship and for a reasonable period thereafter for backup, audit, and legal purposes.
(b) Visitor chats, tickets, analytics, and related organization records are retained while the organization remains active on the Service and until deleted in accordance with product functionality, Organization Customer instructions we can reasonably implement, or our retention and deletion processes.
(c) Staff Agent workspace conversations that become inactive may be purged automatically after approximately thirty (30) days of inactivity under our current operational settings. This purge does not by itself delete Visitor chat sessions.
(d) Authentication artefacts (one-time codes, pending registration sessions, short-lived tokens) expire according to their configured lifetimes.
(e) Payment and billing records may be retained for longer periods where required for accounting, tax, or dispute purposes.
(f) Contact exclusion records hide a contact from certain lists; they are not a complete erasure of all historical chat content.

9.3 As of the Effective Date, the Service does not provide a fully automated self-service “delete my account” control for all data categories. Deletion and erasure requests shall be submitted to [email protected]. We shall assess each request under applicable law and our processor obligations to Organization Customers. Certain organization-level deletions may only be executable by authorized administrative processes.

9.4 Residual copies may remain in encrypted backups for a limited period consistent with our backup cycles, after which they are overwritten or become inaccessible in the ordinary course.

10. Security

10.1 We implement administrative, technical, and organizational measures appropriate to the risk, including:

(a) access controls and authenticated sessions;
(b) transport encryption (HTTPS) for production web traffic;
(c) HttpOnly session cookies with Secure flags in production and SameSite restrictions;
(d) hashing of passwords and one-time codes;
(e) encryption of certain secrets at rest (including SMTP passwords, WooCommerce or WordPress credentials, Meta Page tokens, and TOTP secrets, using application cryptography and/or vault storage);
(f) segregation of platform secrets in a secrets vault;
(g) optional organization-required two-factor authentication; and
(h) logging and operational monitoring.

10.2 No method of transmission or storage is completely secure. You are responsible for maintaining the confidentiality of credentials, devices, and recovery codes issued to you.

10.3 If we become aware of a personal data breach affecting your personal data, we shall notify you and competent authorities as required by applicable law.

11. Your rights

11.1 Subject to the DPA and other applicable law, you may have the right to:

(a) be informed about the processing of your personal data;
(b) access personal data we hold about you;
(c) request correction of inaccurate or incomplete personal data;
(d) request deletion or erasure of personal data;
(e) object to or request restriction of certain processing;
(f) withdraw consent where processing is consent-based; and
(g) lodge a complaint with the Office of the Data Protection Commissioner (Kenya) or another competent supervisory authority.

11.2 To exercise rights against Bluecrane as controller, email [email protected] with sufficient detail to identify the request and the relevant account or interaction. We may request additional information to verify your identity.

11.3 If your request concerns Visitor data controlled by an Organization Customer, we may require that the request be directed to that Organization Customer, or we may act as processor only on their documented instructions, except where we are legally required to respond directly.

11.4 We shall respond within the timeframes required by applicable law. We may refuse or limit requests where permitted (for example where fulfilment would adversely affect the rights of others, reveal trade secrets improperly, or conflict with legal retention duties).

12. Children

12.1 The Service is directed to businesses and adult users. It is not intended for children.

12.2 We do not knowingly collect personal data from children below the age of eighteen (18), or below any higher age of digital consent required in the relevant jurisdiction, for the purpose of offering the Service to them.

12.3 If you believe a child has provided personal data to us, contact [email protected] and we shall take appropriate steps to delete such data where required.

13. Cookies and similar technologies

13.1 We and our Service components use cookies, local storage, tokens, and similar technologies for:

(a) authentication and session continuity on the dashboard and related web surfaces;
(b) portal visitor authentication tokens;
(c) Widget operation and anonymous analytics identifiers;
(d) preference and security features; and
(e) push notification device registration.

13.2 Essential cookies and tokens are required for the Service to function. If you disable them, parts of the Service may not work.

13.3 As of the Effective Date, the core Service does not integrate third-party advertising cookies or third-party advertising pixels as a product feature. Organization Customers remain responsible for any tracking technologies they place on their own websites independently of the Service.

14. Platform-specific disclosures

14.1 Website (juaagent.com)

The marketing site may collect contact-form submissions, standard server and security logs, and, where used, portal authentication data for /conversations and related visitor messaging features that call our portal APIs.

14.2 Dashboard (dashboard.juaagent.com)

The dashboard processes account, organization, chat, ticket, analytics, billing, security, team, knowledge, channel, and settings data described in this Policy. Browser sessions use cookies as described in clause 13.

14.3 Android App (com.juaagent.dashboard)

(a) The Android App provides feature parity with the dashboard for authorized account functions (including chats, tickets, staff Agent workspace, analytics, settings, subscription payment flows, and team tools).
(b) The Android App requires network access (Internet permission) to communicate with https://dashboard.juaagent.com.
(c) Authentication tokens are stored using platform secure storage mechanisms. Limited account roster metadata may be stored in local preferences.
(d) As of the Effective Date, the Android App is distributed as an installable application we authorize; we do not claim a Google Play Store listing in this Policy.

14.4 WordPress Plugin

(a) Chat transcripts are stored in the Service, not in the WordPress database.
(b) Product images and media remain in the merchant’s WordPress media library unless separately uploaded to the Service.
(c) Shop order data remains on the merchant’s WooCommerce system; the Service may retrieve order or billing fields when tools are connected and invoked.
(d) If logged-in shopper identification is enabled, the plugin may transmit WordPress user identity attributes to the Service. Organization Customers must disclose this in their own privacy notices.
(e) API authentication uses the same account credentials and tokens as the dashboard and Android App.

14.5 Website Widget (Concierge)

The Widget loads from concierge.juaagent.com, collects conversation and technical data described in clause 4.3 and analytics in clause 4.8, and may present configurable pre-chat fields. Domain allowlists configured by the Organization Customer restrict where the Widget may be embedded.

14.6 WhatsApp

When an Organization Customer links a WhatsApp number, message content and telephone identifiers are processed to deliver and store conversations in the organization’s inbox. One WhatsApp number is associated with one organization; a number already linked to another organization is refused. Meta’s and WhatsApp’s own terms and privacy policies also apply to use of those platforms.

14.7 Facebook Page posting

When an Organization Customer connects a Facebook Page, we process OAuth tokens and Page data to publish content authorized by that customer. Meta’s terms and privacy policy apply to Meta’s processing. Messenger and Instagram messaging are not live customer-chat features of the Service as of the Effective Date.

14.8 Bird Eye

Bird Eye accounts and tooling process developer or affiliate credentials, verification data, and organization-management actions. Such processing is covered by this Policy and by our Terms of Service.

15. Artificial intelligence processing

15.1 The Service uses artificial intelligence systems to generate replies, classifications, summaries, briefs, and similar outputs. To do so, message content, configured knowledge, and related context may be transmitted to AI providers acting as processors or sub-processors.

15.2 AI outputs may be inaccurate or incomplete. Organization Customers and their staff remain responsible for reviewing outputs before relying on them for legal, financial, medical, or other high-risk decisions, and for supervising human handoff where appropriate.

15.3 Human agents of the Organization Customer may view full conversation histories. Authorized Bluecrane personnel may access data as needed for support, security, and operations under confidentiality obligations.

16. Automated decision-making

16.1 The Service uses automated systems (including AI) to generate conversational responses and operational summaries. These features are tools for Organization Customers and do not, by themselves, constitute solely automated decisions that produce legal effects about individuals within the meaning of applicable law, except where an Organization Customer chooses to use outputs in that manner.

16.2 Organization Customers are responsible for any automated decision-making they implement using the Service.

17. Changes to this Policy

17.1 We may amend this Policy from time to time. The updated Policy shall be published at https://juaagent.com/privacy-policy with a revised Last Updated date.

17.2 Where changes are material, we shall take reasonable steps to notify account holders (for example by email or in-product notice) where practicable. Continued use of the Service after the effective date of an update constitutes acceptance of the updated Policy to the extent permitted by law.

18. Governing interpretation for privacy complaints

18.1 Privacy complaints and requests should first be sent to [email protected].

18.2 You may also lodge a complaint with the Office of the Data Protection Commissioner in Kenya, or with another competent authority if applicable to you.

19. Contact

For all privacy and data-protection matters:

Bluecrane Creatives Limited
Email: [email protected]
Product site: https://juaagent.com
Dashboard: https://dashboard.juaagent.com

End of Privacy Policy