Skip to content
Sign in

Privacy policy

Last updated: 24 September 2026

Creative Districts Africa (CDA), Kenya, operates this service and is responsible for the personal information described here. For privacy questions or requests, email support@creativedistricts.africa.

Information you provide

  • Account information. When you sign up or sign in, our authentication provider, Clerk, processes your name, email address, credentials, verification and session information. If you choose Google sign-in, Google shares the basic identity information you authorise, such as your name, email address and profile image. CDA does not request access to your Gmail messages, contacts or Google Drive files.
  • Optional profile. You can provide your country, creative disciplines, career stage, interests, organisation and website. These details are private account information, not a public creator profile.
  • Saved resources and alerts. We store the resources you save and the names, search text, filters and enabled status of alerts you create, linked to your account.
  • Support. If you contact us, we receive your contact details and the information you include in your message.

You can browse public listings without an account. An account is needed to save resources or manage alerts. Profile fields are optional. Please keep passwords, identity documents and sensitive personal information out of search text, profile fields and alert names.

Search, activity and technical information

We process your search text and filters to find resources. CDA’s ordinary search records store a hashed fingerprint of the search, a request identifier, selected country, result count and time. Production-capacity searches may also record creative disciplines and a demand signal. Outbound-link records contain an event identifier, resource, link type and time. These analytics records are not linked to an account ID in CDA’s database. Saved alerts separately retain the search text you choose to save.

Hosting and authentication services process technical information such as IP addresses, browser and device information, requests, session activity and errors to deliver and protect the service. CDA’s request-limit counters use a keyed hash of an IP address or account identifier. A hash is not a promise of anonymity. Search currently does not send your query to an AI provider.

How we use information

We use information to provide accounts, saved resources and alerts; respond to support requests; understand catalogue demand and resource engagement; prevent abuse; and administer access and investigate problems. Where a legal basis is required, we rely on providing the service you request, consent for optional information and alerts, our legitimate interests in operating and securing CDA, and applicable legal obligations. You can withdraw optional choices without closing your account.

Search results help you discover resources. They do not decide whether you qualify for funding, admission or another opportunity. The listed provider makes those decisions.

Email and cookies

Clerk sends authentication and account-security emails. When alert delivery is available and you enable an alert, Zoho ZeptoMail processes your email address and the message content to deliver matching resources. We keep delivery status, attempts and provider references, and record bounced addresses or complaints to prevent further unwanted or undeliverable messages. CDA’s alert sender disables email-open and email-click tracking.

You can pause or delete an alert in Alerts. Alert emails also include a pause link and support one-click unsubscribe. Pausing alerts does not stop authentication or security emails.

Clerk uses cookies and similar browser storage for sign-in, session continuity and security. CDA does not currently install advertising cookies or a separate marketing or session-replay analytics tool. Your browser can block or delete cookies, but account features may stop working.

Who receives information

Authorised CDA administrators can access account information and recorded activity to operate and support the service. Our main service providers are:

  • Clerk for authentication, account management and security emails.
  • Vercel for website hosting, request processing and catalogue image storage.
  • Neon for the database holding CDA account and catalogue records.
  • Zoho ZeptoMail for alert delivery and delivery feedback.
  • Google when you choose Google sign-in.
  • TypeSafe to suggest resource types from public page titles, summaries and publisher names when staff import catalogue sources.

These providers operate internationally. Information may be processed outside Kenya, including in the United States. Their privacy and data-processing terms describe their practices and safeguards; contact us for information about transfers affecting your data. We do not sell your personal information or use it for targeted advertising. We may disclose information where required by law or necessary to address a security incident.

Public catalogue listings may include professional information from their named sources. Following an external source or application link takes you to another organisation’s service and privacy practices. CDA does not submit an application on your behalf.

Retention and deletion

Your profile, saves and alerts remain available while your account exists unless you edit or remove them. After verified account deletion is processed, CDA removes your profile, saves, alerts and associated delivery records. We retain a minimal account identifier and deletion record to prevent a deleted account being recreated by stale requests and to preserve historical audit records.

Account deletion does not automatically remove staff-access and moderation audits, email suppression records, webhook event identifiers, or search and outbound-link records that are not linked to your account. Suppression records retain the email address and reason so we can avoid sending to it again. These records do not currently have a fixed automatic expiry. Expired request-limit counters are removed by scheduled maintenance.

Provider logs and backups follow the relevant provider’s retention practices and are not necessarily erased at the same time as the active application data. Contact us to request deletion or ask about retained information; we will assess what can be removed and explain any information that needs to be retained.

Your choices and rights

You can edit or clear optional details in Profile, remove saved resources, and pause or delete alerts. Contact support@creativedistricts.africa to request access, a copy, correction or deletion of your personal information, or to object to or ask us to restrict processing. Where applicable, you can withdraw consent or request data portability. We may need to verify your identity before acting on a request.

You can raise a complaint with Kenya’s Office of the Data Protection Commissioner, or another data-protection authority with jurisdiction. Please also contact us if you believe a child has supplied personal information that needs attention.

Security and changes

We use HTTPS, authenticated access controls and checks on account ownership to protect information. No online service can guarantee complete security. We update this policy when our practices change and show the revision date above. Material changes will be brought to your attention through the service or an appropriate account communication.